Artificial intelligence-based low-code operational anomaly identification system

Abstract

This invention discloses an AI-based low-code runtime anomaly identification system, comprising a data acquisition module, a node runtime anomaly identification module, a process runtime anomaly identification module, and a low-code runtime anomaly management module. This invention relates to the field of data processing technology, specifically to an AI-based low-code runtime anomaly identification system. This solution innovatively proposes performing full-dimensional anomaly prediction before low-code deployment and operation, and conducting three-level progressive runtime anomaly identification, thereby improving the stability of low-code process operation. It introduces TT tensor decomposition technology to construct a Laplace matrix, and uses a dynamic correlation matrix matching the current node component type as the correlation weight for graph convolution operations, improving the accuracy of the low-code node anomaly identification output. It employs a sine and cosine periodic perturbation chaotic mapping strategy and introduces a dual adaptive step-size mechanism to improve the optimization algorithm, thereby enhancing the stability and identification accuracy of the process runtime anomaly identification model.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, specifically to a low-code runtime anomaly identification system based on artificial intelligence. Background Technology

[0002] The Low-Code Anomaly Identification System is an intelligent management system designed for enterprise low-code development platform application operation scenarios. Utilizing big data processing and artificial intelligence technologies, it collects, integrates, and intelligently analyzes multi-source data during the low-code application process. This enables intelligent identification and full-process control of various operational problems in low-code applications, providing scientific, accurate, and efficient data-driven decision support for low-code operation and maintenance personnel. Ultimately, it ensures the stable operation of low-code business applications, reduces manual operation and maintenance costs, and improves the overall intelligence level of low-code platform operation and maintenance management.

[0003] However, traditional low-code runtime anomaly identification systems suffer from technical problems such as time lag and incomplete detection dimension coverage, leading to untimely and incomplete low-code anomaly identification. Existing models for low-code node anomaly identification use fixed static dependency adjacency matrices, and the tensor decomposition factor matrix initialization method lacks prior guidance on process topology and cannot achieve dynamic association modeling, resulting in inaccurate low-code node anomaly identification output results. Furthermore, existing models for process runtime anomaly identification suffer from unreasonable hyperparameter settings, leading to insufficient accuracy in model output results. Summary of the Invention

[0004] To address the above issues and overcome the shortcomings of existing technologies, this invention provides an AI-based low-code runtime anomaly identification system. Addressing the technical problems of traditional low-code runtime anomaly identification systems, such as time lag and incomplete detection dimension coverage, leading to untimely and incomplete anomaly identification, this solution innovatively proposes performing full-dimensional anomaly prediction after the low-code business process is built but before deployment. It also pioneers a three-level progressive anomaly identification system for nodes, sub-processes, and the entire process, solving the core problems of traditional post-event detection lag and incomplete anomaly coverage. This improves the stability of low-code process operation, reduces the anomaly false negative rate, and achieves pre-deployment anomaly warning and full-dimensional, full-level anomaly coverage identification before low-code process deployment. Furthermore, existing models for low-code node anomaly identification suffer from limitations such as the inability of fixed static dependency adjacency matrices to adapt to the differentiated association patterns of multiple heterogeneous nodes in low-code, the lack of prior guidance on process topology in tensor decomposition factor matrix initialization, and the inability of traditional graph convolution to combine node types for dynamic association modeling, resulting in difficulties in low-code node anomaly identification. To address the technical issues of inaccurate output results and high rates of missed and false positives, this solution innovatively introduces TT tensor decomposition technology and constructs a Laplacian matrix. It also uses a dynamic correlation matrix matching the current node component type as the correlation weight for graph convolution operations, effectively reducing the initial sensitivity of tensor decomposition, accurately quantifying the strength of dependencies between nodes, reducing missed and false positives in anomaly identification, and improving the accuracy of low-code node anomaly identification output results. Furthermore, addressing the technical problems of existing models for process operation anomaly identification, such as unreasonable hyperparameter settings, coarse optimization methods, insufficient optimization precision, unbalanced fixed-step search, and uneven initial population distribution leading to insufficient model output accuracy, this solution innovatively adopts a sine and cosine periodic perturbation chaotic mapping strategy and introduces a dual adaptive step-size mechanism to improve the optimization algorithm. This improves the traversal uniformity of the initial hyperparameter population, enhances the synergistic ability of global hyperparameter exploration and local fine optimization, improves hyperparameter optimization precision and efficiency, and ultimately enhances the stability and accuracy of the process operation anomaly identification model.

[0005] The technical solution adopted by the present invention is as follows: The low-code runtime anomaly identification system based on artificial intelligence provided by the present invention includes a data acquisition module, a node runtime anomaly identification module, a process runtime anomaly identification module, and a low-code runtime anomaly management module; The data acquisition module specifically obtains low-code runtime management optimization data through data acquisition operations and data preprocessing. The node operation anomaly identification module specifically involves first constructing a node operation anomaly identification model, then training the model, and finally identifying node operation anomalies in real time to obtain real-time node operation anomaly identification results. The construction of the node operation anomaly identification model is specifically as follows: First, high-dimensional embedding features of nodes are extracted. Then, a third-order dynamic association graph tensor of nodes is constructed based on TT tensor decomposition. The dynamic association matrix is ​​extracted from this tensor. The dynamic association matrix is ​​used as the association weight for graph convolution operation to perform dynamic graph convolution weighted aggregation operation. At the same time, global association features are obtained. The two are fused to obtain node anomaly enhancement features. Finally, node operation anomaly identification output is performed to complete the construction of the node operation anomaly identification model. The process operation anomaly identification module specifically constructs a dual-model architecture for process anomaly identification, adopts a sine and cosine periodic perturbation chaotic mapping strategy and introduces a dual adaptive step size mechanism to improve the optimization algorithm, thereby constructing a hyperparameter optimization algorithm. The hyperparameters of the model are optimized through the hyperparameter optimization algorithm to obtain the optimal sub-process anomaly identification model and the optimal full-process anomaly identification model. Based on the two optimal models, the real-time identification of sub-process operation anomalies and the real-time identification of full-process operation anomalies are progressively completed to obtain the real-time sub-process operation anomaly identification results and the real-time full-process operation anomaly identification results. The low-code runtime exception management module specifically enables comprehensive intelligent exception prediction and management before the official deployment and launch of low-code business processes, based on real-time node runtime exception identification results, real-time sub-process runtime exception identification results, and real-time full-process runtime exception identification results.

[0006] Furthermore, the data acquisition module specifically obtains low-code runtime management raw data through data acquisition operations, and performs data preprocessing on the raw data to obtain low-code runtime management optimized data; the low-code runtime management raw data includes reference low-code data and target low-code data; both the reference low-code data and the target low-code data include low-code business node layer data, low-code business sub-process layer data, and low-code business full-process layer data; The reference low-code data also includes node operation anomaly identification results, sub-process operation anomaly identification results, and full process operation anomaly identification results; The data preprocessing specifically involves standardizing and feature-selecting the raw low-code runtime management data to obtain optimized low-code runtime management data.

[0007] Furthermore, the node operates an anomaly detection module, specifically including the following steps: Building a node operation anomaly detection model includes the following steps: Extracting high-dimensional embedding features of nodes specifically includes the following steps: To generate common embedding features for nodes, firstly, a linear transformation is performed on the low-code business node layer feature dataset in the low-code operation management optimization data through convolution operations to generate basic high-dimensional features for nodes. Secondly, a linear mapping layer with shared weights is used to perform feature transformations on the component type encoding matrix, subprocess level encoding matrix, and full process level encoding matrix of the node, respectively, to obtain the node component type embedding features, subprocess level embedding features, and full process level embedding features. Finally, a feature concatenation operation is performed to obtain the common embedding features for nodes. The static dependency adjacency matrix of nodes is constructed by extracting the direct dependencies of all nodes from the node dependency data in the low-code business node layer, constructing an N-order square matrix matching the total number of nodes, and assigning values ​​to the matrix elements according to the direct dependencies between nodes to obtain the static dependency adjacency matrix of nodes. ; The node topology embedding matrix is ​​generated by calculating the normalized Laplacian matrix based on the node static dependency adjacency matrix, extracting the eigenvectors corresponding to the smallest q non-zero eigenvalues ​​of the matrix, and concatenating the eigenvectors column by column to generate the node topology embedding matrix. Multi-source embedding feature fusion specifically involves performing a dimensional transformation on the node topology embedding matrix through a linear mapping layer. This transforms the original dimension of the topology embedding into a dimension consistent with the total dimension after concatenating the node's basic high-dimensional features and common embedding features, thus obtaining the node topology embedding features. Then, the node's basic high-dimensional features and common embedding features are concatenated along the channel dimension and multiplied element-wise with the node topology embedding features to obtain the node high-dimensional embedding features. The construction of the node dynamic association graph tensor is as follows: First, based on the defined dimensional structure of the third-order dynamic association graph tensor, the TT tensor decomposition method is used to perform low-rank decomposition on the dimensional structure of the third-order dynamic association graph tensor, which is decomposed into the pre-node factor matrix, the node type factor tensor, and the post-node factor matrix. Then, differential initialization is performed on the three types of decomposition factors, and the tensor is reconstructed using the initialized three types of factors to obtain the low-rank dynamic association graph tensor. Finally, ReLU activation and Softmax normalization are performed on the low-rank dynamic association graph tensor in sequence to obtain the node third-order dynamic association graph tensor. The pre-node factor matrix and the post-node factor matrix are initialized using the node topology embedding matrix, and the node type factor tensor is initialized using a random orthogonal initialization method. To extract node anomaly enhancement features, the process involves first embedding high-dimensional features of nodes and then performing weight calibration on the channel dimensions of the node features using a channel attention mechanism. After batch standardization, basic enhancement features are obtained. Then, based on the node's third-order dynamic association graph tensor, a dynamic association matrix matching the current node component type is extracted. This dynamic association matrix is ​​used as the association weight for graph convolution operations. A single-layer dynamic graph convolution weighted aggregation operation is performed based on the dynamic association matrix to fuse the basic enhancement features with pre- and post-dependency associations between nodes, resulting in aggregated features. Simultaneously, a Transformer self-attention neural network is used to globally encode the basic enhancement features, resulting in global association features. Finally, the aggregated features and global association features are residually superimposed and fused to obtain the node anomaly enhancement features. The node operation anomaly identification output is specifically as follows: First, a linear mapping is performed on the node anomaly enhancement features through a fully connected layer to obtain node classification features adapted to multi-classification tasks. Then, a Softmax normalization mapping is performed on the node classification features to calculate the probability distribution of each node in each anomaly category. Finally, the category with the highest probability is selected as the operation anomaly identification result of the node using the maximum confidence rule. The node operation anomaly detection model training is specifically carried out by using the low-code business node layer feature dataset in the reference low-code data as the model training data to obtain the trained node operation anomaly detection model. Real-time identification of node operation anomalies involves inputting the low-code business node layer feature dataset from the target low-code data into the trained node operation anomaly identification model to obtain real-time node operation anomaly identification results.

[0008] Furthermore, the process execution anomaly detection module specifically includes the following steps: A dual-model architecture for process anomaly identification is constructed. Specifically, based on the Transformer encoder architecture, a sub-process anomaly identification model and a full-process anomaly identification model are constructed respectively. Then, the low-code reference data in the low-code operation management optimization data is used as the training data for the sub-process anomaly identification model and the full-process anomaly identification model. Iterative training of the sub-process anomaly identification model and the full-process anomaly identification model are carried out to obtain the trained sub-process anomaly identification model and the trained full-process anomaly identification model. Constructing a hyperparameter optimization algorithm, specifically by building a hyperparameter optimization algorithm through an improved optimization algorithm, includes the following steps: Initializing search individuals involves encoding the model's hyperparameters into search individual position vectors, and iteratively generating a chaotic sequence using a chaotic mapping strategy with sine and cosine periodic perturbations. The chaotic variables are then linearly mapped to the preset value ranges of each hyperparameter, resulting in an initial population of P search individuals with their position vectors. The formula used is as follows: ; In the formula, Indicates the first A chaotic variable value, Indicates the first A chaotic variable value, Indicates the disturbance coefficient; The fitness value of the search individual is calculated by substituting the hyperparameter combination corresponding to the position of the search individual into the target model to complete the construction and verification, using the performance index of the model as the fitness value of the search individual, completing the fitness calculation of all initial search individuals, traversing the fitness values ​​of all initial search individuals, and selecting the position of the search individual with the best fitness as the global optimal position of the search individual. The double adaptive step size is calculated as follows: In each iteration, all individuals in the current population are sorted in descending order of fitness value. The fitness value ranking of the k-th individual is determined based on this ranking. Finally, the adaptive search step size for each individual is calculated based on the current iteration number and the individual's fitness value ranking. The formula used is as follows: ; In the formula, This represents the adaptive search step size of the k-th search individual in the t-th iteration. This represents the initial search step size, and t represents the current iteration number. Indicates the maximum number of iterations. Indicates the step size decay exponent. This represents the step size weighting coefficient. This represents the fitness ranking of the k-th search individual; The search individual position update is specifically based on the spatial distance between any two search individuals and the adaptive search step size of the search individual, and iteratively updates the position vector of the current search individual to generate the position of the next generation of search individuals; The search iteration terminates when the global optimal position of the search individual is higher than the fitness threshold or when the number of iterations reaches the maximum number of iterations. The global optimal position of the search individual specifically refers to the optimal combination of hyperparameters of the model. Model hyperparameter optimization specifically involves using a hyperparameter optimization algorithm to independently optimize the hyperparameters of the sub-process anomaly identification model and the full-process anomaly identification model, respectively, to obtain the optimal hyperparameter combination for each of the two models. Then, based on the optimal hyperparameter combinations of the two models, the hyperparameters of the trained sub-process anomaly identification model and the trained full-process anomaly identification model are adjusted to obtain the optimal sub-process anomaly identification model and the optimal full-process anomaly identification model. Real-time identification of subprocess operation anomalies involves taking the real-time node operation anomaly identification results and the low-code business subprocess layer feature dataset in the target low-code data as input data and inputting them into the optimal subprocess anomaly identification model to obtain the real-time subprocess operation anomaly identification results. Real-time identification of anomalies in the entire process involves taking the real-time node operation anomaly identification results, the real-time sub-process operation anomaly identification results, and the low-code business full-process layer feature dataset in the target low-code data as input data, and inputting them into the optimal full-process anomaly identification model to obtain the real-time full-process operation anomaly identification results.

[0009] Furthermore, the low-code runtime anomaly management module specifically performs standardized risk classification and control of three levels of anomaly results for low-code runtime business process nodes, sub-processes, and the entire process based on real-time node runtime anomaly identification results, real-time sub-process runtime anomaly identification results, and real-time full-process runtime anomaly identification results. This enables intelligent anomaly prediction and management across the entire chain and all aspects before the official deployment and launch of the low-code business process.

[0010] The beneficial effects achieved by the present invention using the above solution are as follows: (1) In response to the technical problems of traditional low-code operation anomaly identification systems, such as time lag and incomplete detection dimension coverage, which lead to untimely low-code anomaly identification and incomplete identification scope, resulting in business interruption, data anomalies, and high failure rate of complex low-code processes, this solution innovatively proposes to perform full-dimensional anomaly prediction after the low-code business process is built and before deployment and operation. At the same time, it pioneers a three-level progressive operation anomaly identification of nodes, sub-processes and the whole process, which solves the core problems of the lag and incomplete coverage of traditional post-event detection. It avoids process operation failures in advance, reduces the time spent on fault rectification, and fully covers all kinds of low-code operation anomalies. It improves the accuracy of anomaly identification of complex low-code processes, improves the stability of low-code process operation, reduces the failure rate of anomalies, and realizes the pre-deployment warning of anomalies and full-dimensional and full-level anomaly coverage identification before the deployment of low-code processes.

[0011] (2) To address the technical problems in existing low-code node anomaly identification models, such as the inability of fixed static dependency adjacency matrices to adapt to the differentiated association patterns of multiple heterogeneous nodes, the lack of prior guidance on process topology in the initialization method of tensor decomposition factor matrices, and the inability of traditional graph convolution to combine node types to achieve dynamic association modeling, resulting in inaccurate output results and high false negative and false positive rates in low-code node anomaly identification, this solution innovatively introduces TT tensor decomposition technology. It models the node's pre-node, type, and post-node dimensions as a third-order dynamic association graph tensor, and simultaneously constructs a Laplace matrix as the initialization prior for the TT decomposition pre-node and post-node factor matrices. The dynamic association matrix matching the current node component type serves as the association weight for graph convolution operations. This performs a single-layer dynamic graph convolution weighted aggregation operation, accelerating model training convergence, effectively reducing the sensitivity of tensor decomposition initialization, accurately quantifying the strength of dependencies between nodes, improving the accuracy and relevance of node association feature mining, enhancing the model's adaptability and generalization ability to low-code multi-heterogeneous nodes and complex process topologies, reducing missed and false positives in anomaly identification, improving the accuracy of low-code node anomaly identification outputs, and achieving accurate identification of low-code multi-heterogeneous node operational anomalies, providing underlying feature support for process operational anomaly identification.

[0012] (3) In view of the technical problems that existing models for identifying abnormal process operation have unreasonable hyperparameter settings, and that the optimization method is rough, the optimization accuracy is insufficient, the fixed step size search is unbalanced, and the initial population distribution is uneven, resulting in insufficient accuracy of the model output results, this solution innovatively adopts a sine and cosine periodic perturbation chaotic mapping strategy and introduces a dual adaptive step size mechanism to improve the optimization algorithm. This improves the traversal uniformity of the initial hyperparameter population, enhances the synergistic ability of global hyperparameter exploration and local fine optimization, improves the hyperparameter optimization accuracy and optimization efficiency, avoids premature convergence and local optimum traps, strengthens the stability and identification accuracy of the abnormal process operation model, and finally achieves efficient and accurate identification of abnormal operation of low-code business sub-processes and the entire process. Attached Figure Description

[0013] Figure 1 A schematic diagram of the modules of the low-code runtime anomaly identification system based on artificial intelligence provided by the present invention; Figure 2 A flowchart illustrating the process of running the anomaly detection module for nodes; Figure 3 A flowchart illustrating the process of building a node operation anomaly identification model in the node operation anomaly identification module; Figure 4 A flowchart illustrating the process operation exception identification module; Figure 5A flowchart illustrating the process of building a hyperparameter optimization algorithm in the process operation anomaly identification module; The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used together with the embodiments of the invention to explain the invention and do not constitute a limitation thereof. Detailed Implementation

[0014] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0015] In the description of this invention, it should be understood that the terms "upper", "lower", "front", "rear", "left", "right", "top", "bottom", "inner", "outer", etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of describing this invention and simplifying the description, and do not indicate or imply that the system or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this invention.

[0016] Example 1, see Figure 1 The present invention provides an artificial intelligence-based low-code runtime anomaly identification system, which includes a data acquisition module, a node runtime anomaly identification module, a process runtime anomaly identification module, and a low-code runtime anomaly management module. The data acquisition module specifically obtains low-code runtime management optimization data through data acquisition operations and data preprocessing, and sends the data to the node runtime anomaly identification module and the process runtime anomaly identification module. The node operation anomaly identification module receives data sent by the data acquisition module and is used to complete the prediction and identification of single node operation anomalies after the low-code business process is built and before formal deployment and operation. Specifically, it first builds a node operation anomaly identification model and trains the node operation anomaly identification model. Finally, it identifies node operation anomalies in real time, obtains real-time node operation anomaly identification results, and sends the data to the process operation anomaly identification module and the low-code operation anomaly management module. The process operation anomaly identification module receives data sent by the data acquisition module and the node operation anomaly identification module. It is used to take over the node operation anomaly identification results after the low-code business process is built and before it is officially deployed and run, and to complete the hierarchical progressive operation anomaly prediction from the sub-process level to the full process level. It identifies hidden logical anomalies and chain failure risks that cannot be detected by a single node across nodes and sub-processes. Specifically, it first constructs a dual-model architecture for process anomaly identification, adopts a sine and cosine periodic perturbation chaotic mapping strategy and introduces a dual adaptive step size mechanism to improve the optimization algorithm, thereby constructing a hyperparameter optimization algorithm. The hyperparameters of the model are optimized through the hyperparameter optimization algorithm to obtain the optimal sub-process anomaly identification model and the optimal full process anomaly identification model. Based on the two optimal models, the real-time identification of sub-process operation anomalies and the real-time identification of full process operation anomalies are progressively completed to obtain the real-time sub-process operation anomaly identification results and the real-time full process operation anomaly identification results, and then sends the data to the low-code operation anomaly management module. The low-code runtime anomaly management module receives data sent by the node runtime anomaly identification module and the process runtime anomaly identification module. Specifically, based on the real-time node runtime anomaly identification results, the real-time sub-process runtime anomaly identification results, and the real-time full-process runtime anomaly identification results, it realizes comprehensive intelligent anomaly prediction and management before the low-code business process is officially deployed and launched.

[0017] By performing the above operations, this solution addresses the technical problems of traditional low-code runtime anomaly identification systems, such as time lag and incomplete detection dimension coverage, which lead to untimely and incomplete low-code anomaly identification, resulting in business interruptions, data anomalies, and high false negative rates in complex low-code processes. This innovative solution proposes performing full-dimensional anomaly prediction after the low-code business process is built but before deployment. It also pioneers a three-level progressive anomaly identification system, addressing the core issues of lag and incomplete anomaly coverage in traditional post-event detection. This proactively avoids process runtime failures, reduces the time spent on fault rectification, comprehensively covers all types of low-code runtime anomalies, improves the accuracy of anomaly identification in complex low-code processes, enhances the stability of low-code process operation, reduces the false negative rate, and achieves pre-deployment anomaly warning and full-dimensional, full-level anomaly coverage identification.

[0018] Example 2, see Figure 1This embodiment is based on the above embodiment. The data acquisition module is used to convert the business process code that has been visually dragged and dropped in the low-code platform into structured and interpretable feature field data after the low-code business process is built and before it is officially deployed and run. This provides standardized data input for subsequent node, sub-process, and full-process hierarchical anomaly identification. Specifically, it obtains the original low-code operation management data through data acquisition operations and performs data preprocessing on the original data to obtain low-code operation management optimized data. The original low-code operation management data includes reference low-code data and target low-code data. Both the reference low-code data and the target low-code data include low-code business node layer data, low-code business sub-process layer data, and low-code business full-process layer data. The data acquisition operation specifically involves parsing the business process code and extracting structured features; The business process code is parsed and structured feature extracted to convert the design-state code of the target business process that has been built but not yet formally deployed from unstructured or semi-structured code text into structured and interpretable feature fields, generating low-code runtime management raw data. Specifically, the full design-state code file of the business process is pulled through the native code parsing engine of the low-code platform. Abstract syntax tree parsing technology and DSL code parsing technology are used to perform line-by-line deep parsing and semantic mapping of the code file. Layered feature extraction is completed according to the three-level architecture of node, sub-process, and full process, generating low-code business node layer data, low-code business sub-process layer data, and low-code business full process layer data. The design-state code includes, but is not limited to, process definition DSL code in JSON format specific to low-code platforms, visual orchestration XML code conforming to the BPMN 2.0 specification, custom Python and JavaScript script code embedded in nodes, YAML code for visual rule configuration, and JSONSchema code for data connector interface configuration. The business node refers to the smallest executable unit of a low-code business process. It is a functional unit with independently encapsulated standardized business capabilities that users can drag and drop from the low-code platform's visual component library onto the process editing canvas. It is the smallest indivisible execution granularity in the process; including but not limited to leave application submission nodes, department head approval nodes, annual leave balance verification nodes, attendance conflict verification nodes, conditional branch judgment nodes, general manager approval nodes, approval result notification nodes, and attendance data synchronization nodes. The business sub-process refers to a reusable process module with independent closed-loop business capabilities, formed by combining and encapsulating multiple business nodes with strong business logic. It serves as an intermediate-level functional unit connecting business nodes and the entire business process, supporting one-click encapsulation and cross-process reuse within a low-code platform without the need to repeatedly build node combinations. Examples include, but are not limited to, the HR attendance automatic verification sub-process that can be reused in the entire process of attendance-related business such as leave, overtime, time off, and business trips, and the financial compliance verification sub-process that can be reused in the entire process of financial business such as procurement, reimbursement, and payment. The aforementioned full business process refers to a low-code business process instance that can be independently deployed and run, formed by visual orchestration of multiple business nodes and at least one business sub-process, and possesses end-to-end complete business closed-loop capabilities. It covers the entire execution logic of the business from initiation to completion; including but not limited to the full process of employee paid annual leave application approval, employee overtime compensatory time off approval, enterprise procurement application approval, and employee business trip reporting approval. The low-code business node layer data specifically refers to the structured feature data corresponding to the smallest execution unit of the low-code business process, and is also the basic constituent unit of the sub-process layer and the full process layer data; it includes node basic attribute data, node configuration data, node logical data, node dependency data, and node permission data; The basic attribute data of the node includes the node's unique identifier ID, the encoding of the native component type of the low-code platform to which the node belongs, and the coordinates and hierarchical encoding of the node in the workflow editing canvas. The node configuration data includes node input parameter mapping rules, node output parameter mapping rules, a list of business form fields bound to the node, node form validation rule expressions, a list of third-party data connectors bound to the node, node interface call timeout thresholds, node interface exception retry counts, number of lines of custom script code embedded in the node, node custom script language type, node script loop complexity index, and a list of visualization page components bound to the node. The node logic data includes node pre-trigger condition expressions, node post-execution rules, node condition branch judgment logic, node loop execution termination conditions, node single instance execution timeout threshold, node exception fallback handling rules, node state transition rules, node execution priority configuration, and node rollback execution rules. The node dependency data includes the number of dependent nodes, a list of unique identifiers for preceding nodes, a list of unique identifiers for subsequent nodes, a list of global parameters associated with the nodes, a list of cross-node data interaction fields, and a list of third-party system interfaces that the nodes depend on. The node permission data includes node operation permission configuration rules, node data viewing permission configuration rules, node approval permission level rules, node data anonymization rules, node operation log retention rules, and node unauthorized operation interception rules. The low-code business sub-process layer data specifically refers to the structured feature data corresponding to reusable independent business sub-processes encapsulated in the low-code platform. It serves as an intermediate feature carrier connecting the node layer and the full-process layer, including sub-process basic attribute data, sub-process structure data, sub-process logic data, sub-process dependency data, and sub-process reuse data. The basic attribute data of the subprocess includes the subprocess unique identifier ID, the business process unique identifier ID to which the subprocess belongs, the subprocess name, the subprocess encapsulation type code, the low-code process engine version number adapted by the subprocess, the total number of business nodes contained in the subprocess, and the statistical data on the distribution of node types within the subprocess. The subprocess structure data includes the number of branch nodes in the subprocess, the number of loop nodes in the subprocess, the number of manually processed nodes in the subprocess, the number of automatically executed nodes in the subprocess, the number of parallel node groups in the subprocess, the maximum nesting level of the subprocess, the number of closed-loop links in the subprocess, the length of the longest execution path in the subprocess, and the average connectivity of nodes in the subprocess. The sub-process logical data includes branch flow triggering rules within the sub-process, sub-process loop execution termination conditions, sub-process closed-loop verification rules, sub-process global parameter transfer mapping rules, sub-process business rule constraint list, sub-process single instance execution timeout threshold, sub-process exception fallback handling rules, and sub-process data flow verification rules. The subprocess dependency data includes a list of subprocess pre-dependent node IDs, a list of subprocess post-related node IDs, subprocess call entry trigger rules, a list of subprocess data interaction fields, and parameter mapping rules between subprocess and main process. The sub-process reuse data includes the cumulative number of times the sub-process is reused across the entire platform, the distribution data of sub-process reuse business scenarios, the historical modification and iteration count of the sub-process, the historical distribution data of sub-process exception types, and the configuration of the business scope of the sub-process. The low-code business process layer data specifically refers to the global structured feature data of the complete end-to-end low-code business process, including basic attribute data, topology data, engine adaptation data, and cross-system interaction data. The basic attribute data of the entire process includes the unique identifier ID of the entire business process, the business scenario code to which the process belongs, the total number of business nodes contained in the process, the total number of business sub-processes contained in the process, the total number of branch nodes in the process, and the total number of loop nodes in the process. The full-process topology data includes the length of the critical execution path, the maximum execution depth, the average connectivity of nodes, the average path length, the number of branch convergence points, the number of parallel execution links, the unique identifier ID of the start node, and the unique identifier ID of the end node. The engine adaptation data includes the maximum number of concurrent instances in the entire process, the global execution timeout threshold for the entire process, the global configuration for retrying abnormal events in the entire process, and the configuration for the engine resource consumption threshold for the entire process. The cross-system interaction data includes the total number of data connectors bound to the entire process, the total number of external interface calls to the entire process, the cross-system data synchronization rules to the entire process, and the global interface authentication configuration to the entire process. The reference low-code data also includes node operation anomaly identification results, sub-process operation anomaly identification results, and full process operation anomaly identification results; The results of node operation anomaly identification, sub-process operation anomaly identification, and full process operation anomaly identification are all classified into five categories: normal, logic anomaly, configuration anomaly, flow anomaly, and permission anomaly. The data preprocessing is used to convert non-standardized low-code runtime management raw data into standardized feature data suitable for model input requirements; specifically, it involves standardizing and selecting features from the low-code runtime management raw data to obtain optimized low-code runtime management data. The standardization process is used to unify the coding specifications and numerical scale of all features and eliminate the interference of features with different scales on the model weight learning. Specifically, the label coding method is first used to map the category field in the original data to the corresponding integer value according to the category value. Then, the Z-Score standardization method is used to standardize all continuous variables so that each continuous variable meets the uniform numerical scale range. The feature selection is used to eliminate redundant features that are irrelevant to low-code runtime anomalies, and to select core features with strong discriminative power for anomaly identification, thereby reducing the computational complexity of the model and avoiding model overfitting caused by redundant features. Specifically, the Pearson correlation analysis method is used to calculate the linear correlation coefficient between each feature of the node layer, sub-process layer, and full process layer and the corresponding level runtime anomaly identification result label, and to select core features whose absolute correlation coefficient is greater than the preset threshold of each level, thus obtaining the low-code business node layer feature dataset, the low-code business sub-process layer feature dataset, and the low-code business full process layer feature dataset.

[0019] Example 3, see Figure 1 , Figure 2 and Figure 3 This embodiment is based on the above embodiment. The node operation anomaly identification module is used to predict and identify single node operation anomalies after the low-code business process is built and before formal deployment and operation, providing a basic judgment basis for subsequent sub-process and full-process layered anomaly identification; specifically, it includes the following steps: A node runtime anomaly identification model is constructed to build an anomaly identification capability architecture adapted to low-code heterogeneous nodes, enabling node runtime status discrimination and multi-class anomaly identification. Specifically, the model includes the following steps: Extracting high-dimensional embedding features of nodes specifically includes the following steps: Common node embedding features are generated to extract common business patterns among nodes of the same type and level, generating common node embedding features shared throughout the entire process. This achieves reuse of business patterns among nodes of the same type while avoiding model redundancy caused by independent branch parameters. Specifically, firstly, a 1×1 convolution operation is used to perform a linear transformation on the low-code business node layer feature dataset in the low-code operation management optimization data, generating high-dimensional basic features of nodes with uniform dimensions. Secondly, a linear mapping layer with shared weights is used to perform feature transformation on the component type encoding matrix, subprocess level encoding matrix, and full process level encoding matrix of the node, respectively, to obtain node component type embedding features, subprocess level embedding features, and full process level embedding features. Finally, feature concatenation is performed to obtain the common node embedding features shared throughout the entire process. The formulas used are as follows: ; ; ; ; ; In the formula, Represents the basic high-dimensional features of nodes. This indicates the embedding feature of the node component type. This indicates the embedding features of the node sub-process hierarchy. This represents the embedded features at the node's entire process level. , , and Let represent the weight matrix of a 1×1 convolution, the linear mapping matrix of node component types with shared weights, the linear mapping matrix of node sub-process levels with shared weights, and the linear mapping matrix of node full-process levels with shared weights, respectively. , , and These represent the bias terms of a 1×1 convolution, the node component type bias terms with shared weights, the node sub-process level bias terms with shared weights, and the node full-process level bias terms with shared weights, respectively. This represents the common embedding features of nodes. This indicates a feature concatenation operation. This represents the low-code business node layer feature dataset in the low-code runtime management optimization data. The component type encoding matrix representing the node's component type. This represents the sub-process hierarchy encoding matrix to which a node belongs. The element in the i-th row of the matrix is ​​the hierarchy encoding of the i-th node in the sub-process execution chain. This represents the full-process hierarchical encoding matrix to which a node belongs, where the element in the i-th row of the matrix is ​​the hierarchical encoding of the i-th node in the full-process execution chain; The node static dependency adjacency matrix is ​​constructed to create a topology matrix representing the pre- and post-execution dependencies between nodes in a low-code business process, fully restoring the inherent topology of the process. Specifically, based on the node dependency data in the low-code business node layer data, the direct dependencies of all nodes are extracted, an N-order square matrix matching the total number of nodes is constructed, and the matrix elements are assigned values ​​according to the direct dependencies between nodes to obtain the node static dependency adjacency matrix. ; The node static dependency adjacency matrix represents a directed adjacency matrix that shows the predecessor and successor execution dependencies between nodes. Specifically, it is an N-row, N-column matrix filled with zeros. In this matrix, the row number corresponds to the preceding node number, the column number corresponds to the following node number, and the matrix elements... This indicates whether node i is a dependent node of node j. If node i is a dependent node of node j, then assign a value. ,otherwise ; A node topology embedding matrix is ​​generated to extract prior information about global and local associations between nodes from the low-code process topology. This matrix contains process topology characteristics, injecting inherent business process dependencies into the model and addressing the slow convergence and susceptibility to local optima caused by random initialization. Specifically, a normalized Laplacian matrix is ​​calculated based on the node static dependency adjacency matrix. The eigenvectors corresponding to the q smallest non-zero eigenvalues ​​of this matrix are extracted, and the eigenvectors are concatenated column-wise to generate the node topology embedding matrix. The formula used is as follows: ; ; In the formula, This represents the normalized Laplacian matrix, used to characterize the topological associations of nodes in a low-code flow. Let represent an N-order identity matrix, with all diagonal elements being 1 and all other elements being 0. The degree matrix corresponding to the static dependency adjacency matrix A of nodes is an N-order diagonal matrix with diagonal elements of 1. , arrive Let q represent the eigenvectors corresponding to the smallest q non-zero eigenvalues ​​of the normalized Laplacian matrix L. This represents the node topology embedding matrix, where q is the preset topology embedding dimension; Multi-source embedding feature fusion is used to deeply fuse basic node features, common features, and topological features to generate the final high-dimensional node embedding features. Specifically, a linear mapping layer is used to perform a dimensionality transformation on the node topological embedding matrix, converting the original dimension of the topological embedding to the same dimension as the total dimension after concatenating the basic high-dimensional node features and the common node embedding features, thus obtaining the node topological embedding features. Then, the basic high-dimensional node features and the common node embedding features are concatenated by channel dimension, and then element-wise multiplied with the node topological embedding features to obtain the node high-dimensional embedding features. The formula used is as follows: ; ; In the formula, and These represent the weight matrix and bias term of the embedded linear mapping, respectively. Represents the node topology embedding features. This represents the high-dimensional embedding features of the nodes. This represents element-wise multiplication. The node dynamic association graph tensor construction method is used to build dynamic association graph tensors adapted to low-code heterogeneous nodes, replacing the traditional fixed topological adjacency matrix. It accurately describes the dynamic dependency relationships between predecessor and successor nodes under different component types and feature dimensions. Specifically, it first defines the dimensional structure of a third-order dynamic association graph tensor, then uses the TT tensor decomposition method to perform low-rank decomposition on the third-order dynamic association graph tensor, decomposing it into a predecessor node factor matrix, a node type factor tensor, and a successor node factor matrix. Next, it performs differential initialization operations on the three types of decomposition factors, and uses the initialized three types of factors to reconstruct the tensor, obtaining a low-rank dynamic association graph tensor. Finally, it performs ReLU activation processing and Softmax normalization processing on the low-rank dynamic association graph tensor in sequence to obtain the node third-order dynamic association graph tensor. The predecessor node factor matrix and the successor node factor matrix are initialized using the node topological embedding matrix, and the node type factor tensor is initialized using a random orthogonal initialization method. The TT tensor decomposition method is specifically TensorTrain tensor decomposition. The tensor dimension of the third-order dynamic association graph tensor structure is: The first dimension is the preceding node dimension, the second dimension T is the node component type dimension, and the third dimension is the following node dimension. The elements in the tensor are used to represent the dynamic association weights between the preceding node, node type, and following node. This method extracts node anomaly enhancement features to mine global-local business relationships between nodes through dynamic graph convolution, strengthening the feature representation that is strongly correlated with node operational anomalies. This replaces the inefficient feature extraction method of traditional fixed graph convolution, improving the accuracy of anomaly identification. Specifically, it first embeds high-dimensional features into nodes and performs weight calibration on the channel dimension of node features using a channel attention mechanism. Then, it performs batch standardization to obtain basic enhancement features. Next, based on the node's third-order dynamic association graph tensor, it extracts a dynamic association matrix that matches the current node component type and uses this dynamic association matrix as the association weight for graph convolution operations. Based on the dynamic association matrix, it performs single-layer dynamic graph convolution weighted aggregation operations to fuse the basic enhancement features with pre- and post-dependency associations between nodes to obtain aggregated features. At the same time, it uses a Transformer self-attention neural network to globally encode the basic enhancement features to obtain global association features. Finally, it performs residual superposition and fusion of the aggregated features and global association features to obtain node anomaly enhancement features. The dynamic association matrix is ​​obtained by extracting the type dimension from the node's third-order dynamic association graph tensor using the unique index of the component type to which the current node belongs as the index, through fixed slicing. The two-dimensional dynamic association matrix is ​​the core topological weight adapted to the characteristics of low-code heterogeneous nodes. The elements in the matrix are processed by ReLU activation and Softmax row-level normalization. The interval-based continuous weight values ​​differ from the node static dependency adjacency matrix, which only contains discrete values ​​of 0 or 1. The static dependency adjacency matrix only represents a fixed topological skeleton indicating whether there are direct predecessor and successor dependencies between nodes, while the dynamic association matrix quantifies the strength of dependencies between nodes. Furthermore, different component types of nodes correspond to specific dynamic association matrices. The formula used is as follows: ; ; ; ; In the formula, Indicates basic augmentation features, This indicates a batch standardization operation, specifically calculating the sample mean and sample variance of the feature data along the channel dimension, and then standardizing the feature data to a normal distribution range with a mean of 0 and a variance of 1 through a linear transformation. This indicates the channel attention mechanism operation. This represents the total number of convolution kernels in a single-layer dynamic graph convolution. This represents a dynamic association matrix that matches the component type of the current node. In a single-layer dynamic graph convolution, the first... The learnable weight matrix corresponding to each convolutional kernel This represents the aggregated features of the output of a single-layer dynamic graph convolution. This represents the operation of a self-attention neural network. Indicates global correlation features. Indicates abnormal enhancement features of nodes; The node operation anomaly identification output is used to accurately determine the running status of low-code business nodes and identify multiple types of anomalies. It adapts to the anomaly judgment characteristics of nodes of different component types, and overcomes the shortcomings of traditional fixed threshold identification, such as poor adaptability to heterogeneous low-code nodes, inability to accurately distinguish anomaly types, and high false positive and false negative rates. It effectively improves the accuracy and targeting of anomaly identification. Specifically, it first performs linear mapping on the node anomaly enhancement features through a fully connected layer to obtain node classification features adapted to multi-classification tasks. Then, it performs Softmax normalization mapping on the node classification features to calculate the probability distribution of each node in each anomaly category. Finally, it uses the maximum confidence rule to select the category with the highest probability as the operation anomaly identification result of the node. The node operation anomaly detection model training is used to complete the supervised iterative optimization of the node operation anomaly detection model and calibrate the learnable parameters of the model across the entire chain; specifically, the low-code business node layer feature dataset in the reference low-code data is used as the training data of the model to train the model and obtain the trained node operation anomaly detection model. The model training specifically employs a multi-class cross-entropy loss function and uses backpropagation algorithm and gradient descent optimization method to iteratively update the weight matrix and bias parameters of the node running anomaly identification model. The model parameters are continuously optimized through multiple rounds of iteration. When the preset maximum number of training times is reached or the loss function value converges to a set threshold, the iterative training stops. Real-time identification of node operation anomalies involves inputting the low-code business node layer feature dataset from the target low-code data into the trained node operation anomaly identification model to obtain real-time node operation anomaly identification results.

[0020] By performing the above operations, this solution addresses the technical problems in existing low-code node anomaly identification models. These problems include the inability of fixed static dependency adjacency matrices to adapt to the differentiated association patterns of multiple heterogeneous nodes in low-code systems, the lack of prior guidance on process topology in the initialization method of tensor decomposition factor matrices, and the inability of traditional graph convolution to combine node types for dynamic association modeling. This results in inaccurate output and high false negative rates in low-code node anomaly identification. This innovatively introduces TT tensor decomposition technology, modeling the node's pre-node, type, and post-node dimensions as a third-order dynamic association graph tensor. Simultaneously, a Laplacian matrix is ​​constructed as the initialization prior for the TT decomposition pre-node and post-node factor matrices. Furthermore, the dynamic association matrix matching the current node component type is used as the association weight for graph convolution operation, and a single-layer dynamic graph convolution weighted aggregation operation is performed. This accelerates the model training convergence speed, effectively reduces the sensitivity of tensor decomposition initialization, accurately quantifies the strength of dependencies between nodes, improves the accuracy and targeting of node association feature mining, enhances the model's adaptability and generalization ability to low-code multi-heterogeneous nodes and complex process topologies, reduces the missed and false judgments in anomaly identification, improves the accuracy of low-code node anomaly identification output results, and achieves accurate identification of low-code multi-heterogeneous node operation anomalies, providing underlying feature support for process operation anomaly identification.

[0021] Example 4, see Figure 1 , Figure 4 and Figure 5 This embodiment is based on the above embodiment. The process operation anomaly identification module is used to receive the node operation anomaly identification results after the low-code business process is built and before formal deployment and operation, and to complete the hierarchical progressive operation anomaly prediction from the sub-process level to the full process level, identifying hidden logical anomalies and cascading failure risks across nodes and sub-processes that cannot be detected by a single node; specifically, it includes the following steps: A dual-model architecture for process anomaly identification is constructed. Specifically, based on the Transformer encoder architecture, a sub-process anomaly identification model and a full-process anomaly identification model are constructed respectively. Then, the low-code reference data in the low-code operation management optimization data is used as the training data for the sub-process anomaly identification model and the full-process anomaly identification model. Iterative training of the sub-process anomaly identification model and the full-process anomaly identification model are carried out to obtain the trained sub-process anomaly identification model and the trained full-process anomaly identification model. The sub-process anomaly identification model adopts a 2-layer lightweight Transformer encoder architecture, which captures the temporal flow dependencies and combinational logic associations between nodes in the sub-process through a multi-head self-attention mechanism. The full-process anomaly identification model adopts a 6-layer standard Transformer encoder architecture and captures long-distance dependencies across sub-processes and nodes and the characteristics of the critical path of the entire process through a global multi-head self-attention mechanism. The iterative training of the subprocess anomaly identification model specifically involves using the node execution anomaly identification results in the reference low-code data and the low-code business subprocess layer feature dataset as training data, using the corresponding subprocess execution anomaly identification results as training labels, employing a multi-class cross-entropy loss function, and iteratively updating the weight matrix and bias parameters of the subprocess anomaly identification model through backpropagation algorithm and gradient descent optimization method. The model parameters are continuously optimized through multiple rounds of iteration. When the preset maximum number of training times is reached or the loss function value converges to a set threshold, the iterative training stops. The iterative training of the full-process anomaly detection model specifically involves using the node execution anomaly detection results, sub-process execution anomaly detection results, and low-code business full-process layer feature dataset in the reference low-code data as training data, using the corresponding full-process execution anomaly detection results as training labels, employing a multi-class cross-entropy loss function, and iteratively updating the weight matrix and bias parameters of the full-process anomaly detection model through backpropagation algorithm and gradient descent optimization method. The model parameters are continuously optimized through multiple rounds of iteration. When the preset maximum number of training times is reached or the loss function value converges to a set threshold, the iterative training stops. A hyperparameter optimization algorithm is constructed to optimize the hyperparameters of the sub-process anomaly detection model and the full-process anomaly detection model, with the goal of maximizing model performance. Specifically, the hyperparameter optimization algorithm is constructed through an improved optimization algorithm, including the following steps: Initialize search individuals to encode the core hyperparameters of the target model into searchable position vectors and generate an initial population covering a reasonable search space. Specifically, encode the model's hyperparameters into search individual position vectors and use a chaotic mapping strategy with sine and cosine periodic perturbations to iteratively generate a chaotic sequence. Linearly map the chaotic variables to the preset value range of each hyperparameter to obtain an initial search individual population of P search individual position vectors. The location vector of each search individual uniquely corresponds to a set of hyperparameter combinations of candidate models, forming the initial population of search individuals; The hyperparameters of the model include the number of attention heads, the dimension of hidden layers, the location encoding method, and the dimension of the feedforward network. The formula used is as follows: ; ; In the formula, Indicates the first A chaotic variable value, Indicates the first A chaotic variable value, This represents the disturbance coefficient, with a range of values. , This indicates the upper boundary of the hyperparameter values. This indicates the lower boundary of the hyperparameter values. This indicates the location of the k-th searched individual; The fitness value of the search individual is calculated to quantitatively evaluate the model performance of the initial hyperparameter combination, select the initial optimal hyperparameter combination, provide a benchmark for algorithm iteration and optimization, and achieve an objective evaluation of the quality of hyperparameters. Specifically, the hyperparameter combination corresponding to the position of the search individual is substituted into the target model to complete the construction and validation. The model's performance index is used as the fitness value of the search individual. The fitness values ​​of all initial search individuals are calculated. The fitness values ​​of all initial search individuals are traversed, and the position of the search individual with the best fitness is selected as the global optimal position of the search individual. A dual adaptive step size is calculated to dynamically adjust the algorithm's search step size, addressing the limitation of traditional optimization algorithms with fixed step sizes in balancing global hyperparameter exploration and local hyperparameter refinement. In the early iterations, a large step size allows for rapid traversal of the hyperparameter space, while in the later iterations, a small step size precisely optimizes the optimal hyperparameter range, balancing optimization efficiency and accuracy. Specifically, in each iteration, all search individuals in the current population are sorted according to their fitness values ​​from largest to smallest. The fitness ranking of the k-th search individual is determined based on this ranking. Finally, the adaptive search step size for each search individual is calculated based on the current iteration number and the individual's fitness ranking. The formula used is as follows: ; In the formula, This represents the adaptive search step size of the k-th search individual in the t-th iteration. This represents the initial search step size, and t represents the current iteration number. Indicates the maximum number of iterations. Indicates the step size decay exponent. This represents the step size weighting coefficient. This represents the fitness ranking of the k-th search individual; The search individual position update is used to achieve iterative optimization of the search individual's position. Based on the fitness differences of search individuals, an attraction-oriented mechanism is formed, driving individuals to move directionally towards regions with better hyperparameter combinations, thus completing local fine-tuning of the hyperparameter search space. Specifically, based on the spatial distance between any two search individuals and the adaptive search step size of the search individual, the position vector of the current search individual is iteratively updated to generate the position of the next generation of search individuals. The formula used is as follows: ; In the formula, This represents the position of the k-th search entity in the (t+1)-th iteration. This represents the position of the k-th search entity in the t-th iteration. This represents the maximum attractiveness coefficient of the searched individual, with a value range of [value range missing]. , This represents the absorption coefficient of the searched individual, with a value range of [value range missing]. , This represents the Euclidean distance between the position vectors of the k-th and j-th search individuals. This represents the position of the j-th search individual in the t-th iteration. Let represent the random perturbation term of the k-th search individual in the t-th iteration, which is between A random number uniformly distributed within a range; The search iteration terminates when the global optimal position of the search individual is higher than the fitness threshold or when the number of iterations reaches the maximum number of iterations. The global optimal position of the search individual specifically refers to the optimal combination of hyperparameters of the model. Model hyperparameter optimization specifically involves using a hyperparameter optimization algorithm to independently optimize the hyperparameters of the sub-process anomaly identification model and the full-process anomaly identification model, respectively, to obtain the optimal hyperparameter combination for each of the two models. Then, based on the optimal hyperparameter combinations of the two models, the hyperparameters of the trained sub-process anomaly identification model and the trained full-process anomaly identification model are adjusted to obtain the optimal sub-process anomaly identification model and the optimal full-process anomaly identification model. Real-time subprocess operation anomaly identification is used to identify risks of cross-node combined operation anomalies within a subprocess that cannot be detected by a single node. Specifically, the real-time node operation anomaly identification results and the low-code business subprocess layer feature dataset in the target low-code data are used as input data and input into the optimal subprocess anomaly identification model to obtain the real-time subprocess operation anomaly identification results. Real-time identification of anomalies throughout the entire process is used to identify risks of anomalies that cannot be detected by a single node or a single subprocess, as well as global links across subprocesses. Specifically, the real-time node operation anomaly identification results, the real-time subprocess operation anomaly identification results, and the low-code business full-process layer feature dataset in the target low-code data are used as input data and fed into the optimal full-process anomaly identification model to obtain the real-time full-process operation anomaly identification results.

[0022] By performing the above operations, this solution addresses the technical problems of existing models for identifying process operation anomalies, such as unreasonable hyperparameter settings, coarse optimization methods, insufficient optimization accuracy, unbalanced fixed-step-size search, and uneven initial population distribution, leading to insufficient accuracy in model output results. This solution innovatively adopts a sine and cosine periodic perturbation chaotic mapping strategy and introduces a dual adaptive step-size mechanism to improve the optimization algorithm. This enhances the traversal uniformity of the initial hyperparameter population, strengthens the synergistic ability of global hyperparameter exploration and local fine optimization, improves hyperparameter optimization accuracy and efficiency, avoids premature convergence and local optimum traps, strengthens the stability and accuracy of the process operation anomaly identification model, and ultimately achieves efficient and accurate identification of low-code business sub-processes and the entire process operation anomalies.

[0023] Example 5, see Figure 1 This embodiment is based on the above embodiment. The low-code operation exception management module specifically performs standardized risk classification and control of three levels of exception results for low-code operation business process nodes, sub-processes and the entire process based on the real-time node operation exception identification results, real-time sub-process operation exception identification results and real-time full-process operation exception identification results. This enables intelligent exception prediction and management of the entire chain and all aspects before the low-code business process is officially deployed and launched.

[0024] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0025] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention.

[0026] The present invention and its embodiments have been described above. This description is not restrictive, and the accompanying drawings are only one embodiment of the present invention; the actual structure is not limited thereto. In conclusion, if those skilled in the art are inspired by this description and design similar structures and embodiments without departing from the spirit of the invention, such designs should fall within the protection scope of the present invention.

Claims

1. A low-code runtime anomaly detection system based on artificial intelligence, characterized in that: It includes a data acquisition module, a node operation anomaly identification module, a process operation anomaly identification module, and a low-code operation anomaly management module; The data acquisition module specifically obtains low-code runtime management optimization data through data acquisition operations and data preprocessing. The node operation anomaly identification module specifically involves first constructing a node operation anomaly identification model, then training the node operation anomaly identification model and performing real-time node operation anomaly identification to obtain real-time node operation anomaly identification results. The construction of the node operation anomaly identification model is specifically as follows: First, high-dimensional embedding features of nodes are extracted. Then, a third-order dynamic association graph tensor of nodes is constructed based on TT tensor decomposition. The dynamic association matrix is ​​extracted from this tensor. The dynamic association matrix is ​​used as the association weight for graph convolution operation to perform dynamic graph convolution weighted aggregation operation. At the same time, global association features are obtained. The two are fused to obtain node anomaly enhancement features. Finally, node operation anomaly identification output is performed to complete the construction of the node operation anomaly identification model. The process operation anomaly identification module specifically constructs a dual-model architecture for process anomaly identification, adopts a sine and cosine periodic perturbation chaotic mapping strategy and introduces a dual adaptive step size mechanism to improve the optimization algorithm, thereby constructing a hyperparameter optimization algorithm. The hyperparameters of the model are optimized through the hyperparameter optimization algorithm to obtain the optimal sub-process anomaly identification model and the optimal full-process anomaly identification model. Based on the two optimal models, the real-time identification of sub-process operation anomalies and the real-time identification of full-process operation anomalies are progressively completed to obtain the real-time sub-process operation anomaly identification results and the real-time full-process operation anomaly identification results. The low-code runtime exception management module specifically enables comprehensive intelligent exception prediction and management before the official deployment and launch of low-code business processes, based on real-time node runtime exception identification results, real-time sub-process runtime exception identification results, and real-time full-process runtime exception identification results. 2.The low-code runtime anomaly identification system based on artificial intelligence according to claim 1, wherein: The node operation anomaly detection module specifically includes the following steps: Build a node operation anomaly identification model; The node operation anomaly detection model training is specifically carried out by using the low-code business node layer feature dataset in the reference low-code data as the model training data to obtain the trained node operation anomaly detection model. Real-time identification of node operation anomalies involves inputting the low-code business node layer feature dataset from the target low-code data into the trained node operation anomaly identification model to obtain real-time node operation anomaly identification results. 3.The low-code runtime anomaly identification system based on artificial intelligence of claim 2, wherein: The construction node runs an anomaly detection model, which specifically includes the following steps: Extract high-dimensional embedding features from nodes; The construction of the node dynamic association graph tensor is as follows: First, based on the defined dimensional structure of the third-order dynamic association graph tensor, the TT tensor decomposition method is used to perform low-rank decomposition on the dimensional structure of the third-order dynamic association graph tensor, which is decomposed into the pre-node factor matrix, the node type factor tensor, and the post-node factor matrix. Then, differential initialization is performed on the three types of decomposition factors, and the tensor is reconstructed using the initialized three types of factors to obtain the low-rank dynamic association graph tensor. Finally, ReLU activation and Softmax normalization are performed on the low-rank dynamic association graph tensor in sequence to obtain the node third-order dynamic association graph tensor. The pre-node factor matrix and the post-node factor matrix are initialized using the node topology embedding matrix, and the node type factor tensor is initialized using a random orthogonal initialization method. To extract node anomaly enhancement features, the process involves first embedding high-dimensional features of nodes and then performing weight calibration on the channel dimensions of the node features using a channel attention mechanism. After batch standardization, basic enhancement features are obtained. Then, based on the node's third-order dynamic association graph tensor, a dynamic association matrix matching the current node component type is extracted. This dynamic association matrix is ​​used as the association weight for graph convolution operations. A single-layer dynamic graph convolution weighted aggregation operation is performed based on the dynamic association matrix to fuse the basic enhancement features with pre- and post-dependency associations between nodes, resulting in aggregated features. Simultaneously, a Transformer self-attention neural network is used to globally encode the basic enhancement features, resulting in global association features. Finally, the aggregated features and global association features are residually superimposed and fused to obtain the node anomaly enhancement features. The node operation anomaly identification output is specifically achieved by first performing a linear mapping on the node anomaly enhancement features through a fully connected layer to obtain node classification features adapted to multi-classification tasks, and then performing a Softmax normalization mapping on the node classification features to calculate the probability distribution of each node in each anomaly category. Finally, the highest probability category is selected as the operation anomaly identification result of the node using the maximum confidence rule.

4. The low-code run-time anomaly identification system based on artificial intelligence according to claim 3, characterized in that: The extraction of high-dimensional embedding features of nodes specifically includes the following steps: To generate common embedding features for nodes, firstly, a linear transformation is performed on the low-code business node layer feature dataset in the low-code operation management optimization data through convolution operations to generate basic high-dimensional features for nodes. Secondly, a linear mapping layer with shared weights is used to perform feature transformations on the component type encoding matrix, subprocess level encoding matrix, and full process level encoding matrix of the node, respectively, to obtain the node component type embedding features, subprocess level embedding features, and full process level embedding features. Finally, a feature concatenation operation is performed to obtain the common embedding features for nodes. The node static dependency adjacency matrix is constructed, specifically, based on the node dependency data in the low-code business node layer data, direct dependency relationships of all nodes are extracted, an N-order square matrix matching the total number of nodes is constructed, matrix element assignment is completed according to the direct dependency relationships between nodes, and the node static dependency adjacency matrix is obtained ; The node topology embedding matrix is ​​generated by calculating the normalized Laplacian matrix based on the node static dependency adjacency matrix, extracting the eigenvectors corresponding to the smallest q non-zero eigenvalues ​​of the matrix, and concatenating the eigenvectors column by column to generate the node topology embedding matrix. Multi-source embedding feature fusion specifically involves performing a dimensional transformation on the node topology embedding matrix through a linear mapping layer. This transforms the original dimension of the topology embedding into a dimension consistent with the total dimension after concatenating the node's basic high-dimensional features and common embedding features, thus obtaining the node topology embedding features. Then, the node's basic high-dimensional features and common embedding features are concatenated along the channel dimension and multiplied element-wise with the node topology embedding features to obtain the node high-dimensional embedding features. 5.The artificial intelligence-based low-code operational anomaly identification system of claim 1, wherein: The process operation anomaly detection module specifically includes the following steps: A dual-model architecture for process anomaly identification is constructed. Specifically, based on the Transformer encoder architecture, a sub-process anomaly identification model and a full-process anomaly identification model are constructed respectively. Then, the low-code reference data in the low-code operation management optimization data is used as the training data for the sub-process anomaly identification model and the full-process anomaly identification model. Iterative training of the sub-process anomaly identification model and the full-process anomaly identification model are carried out to obtain the trained sub-process anomaly identification model and the trained full-process anomaly identification model. Construct hyperparameter optimization algorithms; Model hyperparameter optimization specifically involves using a hyperparameter optimization algorithm to independently optimize the hyperparameters of the sub-process anomaly identification model and the full-process anomaly identification model, respectively, to obtain the optimal hyperparameter combination for each of the two models. Then, based on the optimal hyperparameter combinations of the two models, the hyperparameters of the trained sub-process anomaly identification model and the trained full-process anomaly identification model are adjusted to obtain the optimal sub-process anomaly identification model and the optimal full-process anomaly identification model. Real-time identification of subprocess operation anomalies involves taking the real-time node operation anomaly identification results and the low-code business subprocess layer feature dataset in the target low-code data as input data and inputting them into the optimal subprocess anomaly identification model to obtain the real-time subprocess operation anomaly identification results. Real-time identification of anomalies in the entire process involves taking the real-time node operation anomaly identification results, the real-time sub-process operation anomaly identification results, and the low-code business full-process layer feature dataset in the target low-code data as input data, and inputting them into the optimal full-process anomaly identification model to obtain the real-time full-process operation anomaly identification results. 6.The low-code runtime anomaly identification system based on artificial intelligence of claim 5, wherein: The construction of the hyperparameter optimization algorithm specifically includes the following steps: Initializing search individuals involves encoding the model's hyperparameters into search individual position vectors, and iteratively generating a chaotic sequence using a chaotic mapping strategy with sine and cosine periodic perturbations. The chaotic variables are then linearly mapped to the preset value ranges of each hyperparameter, resulting in an initial search individual population containing the position vectors of P search individuals. The formula used is as follows: ； In the formula, Indicates the first A chaotic variable value, Indicates the first A chaotic variable value, Indicates the disturbance coefficient; The fitness value of the search individual is calculated by substituting the hyperparameter combination corresponding to the position of the search individual into the target model to complete the construction and verification, using the performance index of the model as the fitness value of the search individual, completing the fitness calculation of all initial search individuals, traversing the fitness values ​​of all initial search individuals, and selecting the position of the search individual with the best fitness as the global optimal position of the search individual. The double adaptive step size is calculated as follows: In each iteration, all individuals in the current population are sorted in descending order of fitness value. The fitness value ranking of the k-th individual is determined based on this ranking. Finally, the adaptive search step size for each individual is calculated based on the current iteration number and the individual's fitness value ranking. The formula used is as follows: ； In the formula, This represents the adaptive search step size of the k-th search individual in the t-th iteration. This represents the initial search step size, and t represents the current iteration number. Indicates the maximum number of iterations. Indicates the step size decay exponent. This represents the step size weighting coefficient. This represents the fitness ranking of the k-th search individual; The search individual position update is specifically based on the spatial distance between any two search individuals and the adaptive search step size of the search individual, and iteratively updates the position vector of the current search individual to generate the position of the next generation of search individuals; The search iteration terminates when the global optimal position of the search individual is higher than the fitness threshold or when the number of iterations reaches the maximum number of iterations. The global optimal position of the search individual specifically refers to the optimal combination of hyperparameters of the model.

7. The artificial intelligence-based low-code operational anomaly identification system of claim 1, wherein: The data acquisition module specifically obtains low-code runtime management raw data through data acquisition operations, and performs data preprocessing on the raw data to obtain low-code runtime management optimized data; the low-code runtime management raw data includes reference low-code data and target low-code data; Both the reference low-code data and the target low-code data include low-code business node layer data, low-code business sub-process layer data, and low-code business full-process layer data. The reference low-code data also includes node operation anomaly identification results, sub-process operation anomaly identification results, and full-process operation anomaly identification results; the data preprocessing specifically involves standardizing and feature-selecting the raw low-code operation management data to obtain optimized low-code operation management data.

8. The artificial intelligence-based low-code operational anomaly identification system of claim 1, wherein: The low-code runtime anomaly management module specifically performs standardized risk classification and control of three levels of anomaly results for low-code runtime business process nodes, sub-processes, and the entire process based on real-time node runtime anomaly identification results, real-time sub-process runtime anomaly identification results, and real-time full-process runtime anomaly identification results. This enables intelligent anomaly prediction and management across the entire chain and all aspects before the official deployment and launch of low-code business processes.

Images