A business system operation risk monitoring method based on non-intrusive dynamic observation

Abstract

The application relates to the technical field of risk monitoring, and discloses a business system operation risk monitoring method based on non-intrusive dynamic observation, which is used for solving the problem of failure instance survivor bias risk identification under non-intrusive observation when business system operation risk monitoring is carried out, and comprises the following steps: acquiring business instance continuous observation state data according to a business module operation data group, generating a business instance composition consistency index according to the business instance continuous observation state data, judging whether the business module operation data group satisfies a statistical consistency condition according to the business instance composition consistency index, and if the statistical consistency condition is not satisfied, reconstructing the corresponding business module operation data group to generate a reconstructed business module operation data group, so that the reliability of business system operation risk monitoring and the detection stability under complex operation scenarios are effectively improved.

Description

Technical Field

[0001] This invention relates to the field of risk monitoring technology, and more specifically to a method for monitoring operational risks of business systems based on non-intrusive dynamic observation. Background Technology

[0002] With the widespread adoption of cloud computing, microservices, containerized deployment, and distributed architectures, business systems are increasingly moving towards high concurrency, high availability, and dynamic elastic deployment. Business operations typically involve the collaborative operation of multiple business modules, service instances, and network nodes. To ensure the continuous and stable operation of these systems, operations personnel usually need to acquire real-time data on their operational status, monitor and analyze performance anomalies, service anomalies, and network anomalies, and promptly conduct fault warnings and maintenance based on the monitoring results. In recent years, with the continuous development of application performance monitoring (APM), log monitoring, and observability technologies, acquiring business system operational status data through non-intrusive dynamic observation has gradually become an important technological development direction in the field of business system operational risk monitoring.

[0003] Existing methods for monitoring operational risks in business systems typically involve collecting operational log data, system performance monitoring data, and network communication data from the business system. This data undergoes unified time processing, format parsing, and field mapping to obtain standard operational data records. These records are then categorized and aggregated according to business modules, and operational metrics, log events, and network communication metrics for each module are statistically analyzed to generate corresponding operational status data. Finally, the operational status data of each business module is compared with a preset operational benchmark to determine its operational status. Based on these results, the overall business system operation monitoring results are generated, thus completing the business system operational risk monitoring. This monitoring method can meet the risk monitoring needs of most business system operation scenarios and has been widely applied in business system operation monitoring platforms, application performance monitoring platforms, and intelligent operation and maintenance platforms.

[0004] However, the above-mentioned technologies have at least the following technical problems:

[0005] Since business systems typically operate using microservice architecture, containerized deployment, or distributed cluster deployment, some service instances may experience a loss of continuous data acquisition due to reasons such as abnormal program exit, container rebuilding, node failure, network isolation, or changes in the operating environment, while other service instances can still report operational data normally. During this process, the number of operational data records corresponding to a business module will change as some service instances stop reporting, ensuring that the operational status data of the business module primarily comes from service instances that are still able to continuously report operational data.

[0006] Meanwhile, existing methods for monitoring operational risks in business systems typically rely on currently acquired operational data sets from business modules to statistically analyze their operational status. However, these methods often fail to adequately consider changes in the sources of this data during continuous monitoring. When some service instances stop reporting operational data while others continue to do so, the operational status data for a business module may only reflect the operational status of the continuously reporting service instances, rather than accurately reflecting the actual operational status of the entire business module. This can lead to deviations in the determination of the operational status of business modules, affecting the accuracy of operational monitoring results and ultimately reducing the reliability of operational risk monitoring and the stability of monitoring in complex operational scenarios. Summary of the Invention

[0007] In order to overcome the above-mentioned defects of the prior art, the present invention provides a business system operation risk monitoring method based on non-intrusive dynamic observation to solve the problems existing in the background art.

[0008] To achieve the above objectives, the present invention provides the following technical solution:

[0009] A method for monitoring operational risks of a business system based on non-intrusive dynamic observation includes the following steps: Step 1: Obtain operational log data, system performance monitoring data, and network communication data corresponding to the target business system, and process them with a unified timestamp to obtain standard operational monitoring data; Step 2: Standardize the standard operational monitoring data to obtain standard operational data records; the standard operational data records include timestamp information, business module identification information, business instance identification information, operational indicator data, log event data, service call relationship data, and network communication indicator data; the service call relationship data includes the identifier information of the calling initiating business instance, the identifier information of the called business instance, the identifier information of the service interface, and the call response status information; Step 3: Arrange the standard operational data records according to the timestamp information, and classify and aggregate them according to the business module identification information to obtain multiple business module operational data groups; Step 4: Obtain the business instance observation continuity parameter based on the business module operational data groups. Step 1: Generate a business instance composition consistency index by associating business instance response maintenance parameters and business instance load-bearing parameters; Step 2: Determine whether the business module running data group meets the statistical consistency conditions based on the business instance composition consistency index; if it does, set the statistical weight information of each standard running data record in the business module running data group to one, and obtain the reconstructed business module running data group; if it does not meet the conditions, reconstruct the business module running data group to generate the reconstructed business module running data group; Step 3: Perform weighted statistics on the running indicator data, log event data, and network communication indicator data in the reconstructed business module running data group according to the statistical weight information, and obtain the business module running status data; Step 4: Compare the business module running status data with the preset running benchmark data to obtain the running status judgment result; Step 5: Generate the business system running monitoring result based on the running status judgment result, and send the result to the running monitoring terminal for display.

[0010] Preferably, the steps for obtaining the business instance composition consistency index are as follows: obtaining the business instance observation continuity parameter, and calculating the observation continuity coefficient based on the business instance observation continuity parameter; obtaining the business instance correlation response retention parameter, and calculating the correlation retention coefficient based on the business instance correlation response retention parameter; obtaining the business instance load bearing parameter, and calculating the load bearing coefficient based on the business instance load bearing parameter; normalizing the observation continuity coefficient, correlation retention coefficient, and load bearing coefficient to obtain the normalized observation continuity coefficient, correlation retention coefficient, and load bearing coefficient; and calculating the business instance composition consistency index based on the normalized observation continuity coefficient, correlation retention coefficient, and load bearing coefficient.

[0011] Preferably, the steps for obtaining the business instance observation continuity parameter are as follows: extracting the business instance identifier information and timestamp information corresponding to each standard operation data record in each business module operation data group; grouping the standard operation data records belonging to the same business instance according to the business instance identifier information; arranging the grouped standard operation data records in chronological order according to the timestamp information to obtain the instance operation record sequence corresponding to each business instance; calculating the time interval between adjacent standard operation data records in each instance operation record sequence; and statistically analyzing each time interval according to the business module operation data group; arranging all the time intervals obtained from the statistical analysis of each business module operation data group according to their numerical values; and taking the time interval in the middle position as the observation period duration of the corresponding business module operation data group; when each business module operation data group... When the total number of time intervals obtained is even, the average of the two middle intervals is taken as the observation period length of the corresponding business module's running data group. Based on the observation period length, the time range between the first generation of standard running data records for each business instance and the current monitoring time is divided into multiple consecutive observation periods. The number of standard running data records generated by each business instance in each consecutive observation period is counted. When the number of standard running data records is greater than zero, the corresponding consecutive observation period is marked as a valid observation period. When the number of standard running data records is equal to zero, the corresponding consecutive observation period is marked as a missing observation period. The corresponding period marking results are arranged according to the time order of each consecutive observation period to generate the observation period marking sequence for each business instance, and the observation period marking sequence is used as the observation continuity parameter for the business instance.

[0012] Preferably, the steps for calculating the observation continuity coefficient based on the observation continuity parameter of the business instance are as follows: For each observation period marker sequence, segments of consecutively missing observation periods are merged to obtain multiple consecutive missing observation segments. The number of missing observation periods contained in each consecutive missing observation segment and the position number of the last missing observation period in the observation period marker sequence are counted to obtain the corresponding segment missing length and segment end position number. The product of the segment missing length and segment end position number corresponding to each consecutive missing observation segment is calculated to obtain the corresponding missing position association value. The missing position association values ​​are summed, and the ratio between the summation result and the square of the length of the corresponding observation period marker sequence is calculated to obtain the cumulative missing position value of the corresponding business instance. The segment missing length corresponding to each consecutive missing observation segment is squared, and the summation results are calculated and compared with the summation result of all missing observation periods. The ratio between the number of periods and the length of the corresponding observation period marker sequence is used to obtain the missing segment cluster value of the corresponding business instance; the square root of the product of the missing position cumulative value and the missing segment cluster value is calculated to obtain the observation interruption value of the corresponding business instance, and the difference between the value and the observation interruption value is calculated to obtain the instance observation continuity coefficient of the corresponding business instance; when there are no missing observation periods in the observation period marker sequence, the missing position cumulative value and the missing segment cluster value of the corresponding business instance are both set to zero, and the instance observation continuity coefficient of the corresponding business instance is set to one; when the instance observation continuity coefficient of any business instance is equal to zero, the observation continuity coefficient of the corresponding business module is set to zero; when the instance observation continuity coefficients of all business instances are greater than zero, the reciprocal of the instance observation continuity coefficient is calculated, the reciprocals are summed, and the ratio between the number of business instances contained in the corresponding business module and the summation result is calculated to obtain the observation continuity coefficient of the corresponding business module.

[0013] Preferably, the step of obtaining the service instance associated response retention parameter is as follows: Based on the observation period marker sequence corresponding to each service instance, identify whether there are consecutive missing observation segments at the end of the observation period marker sequence, and take the service instance with consecutive missing observation segments at the end of the observation period marker sequence as the target service instance; take the consecutive missing observation segments at the end of the observation period marker sequence of the corresponding target service instance as the target consecutive missing observation segments, and take the first missing observation period in the target consecutive missing observation segments as the corresponding target missing start period; extract a preset number of consecutive observation periods before the target missing start period from the service module running data group where each target service instance is located, and take the extracted consecutive observation periods as the baseline observation period of the corresponding target service instance; extract consecutive observation periods starting from the corresponding target missing start period and having the same number as the baseline observation periods, and take the extracted consecutive observation periods as the verification observation period of the corresponding target service instance; extract the called service instance identifier from the service call relationship data corresponding to the baseline observation period. The service call relationship data with the same business instance identifier information as the target business instance is obtained. The call initiating instance identifier information in the extracted service call relationship data is deduplicated to obtain the baseline associated instance set for the corresponding target business instance. The number of corresponding service call relationship data is counted to obtain the baseline call count. From the service call relationship data corresponding to the verification observation period, service call relationship data with the same call instance identifier information as the target business instance is extracted. The call initiating instance identifier information in the extracted service call relationship data is deduplicated to obtain the verification associated instance set for the corresponding target business instance. The number of corresponding service call relationship data and the number of service call relationship data with abnormal or no response status information are counted to obtain the verification call count and abnormal response count. Based on the baseline associated instance set, verification associated instance set, baseline call count, verification call count, and abnormal response count, the business instance associated response maintenance parameter for the corresponding target business instance is generated.

[0014] Preferably, the step of calculating the association retention coefficient based on the business instance association response retention parameter is as follows: The intersection of the baseline association instance set and the verification association instance set is processed to obtain the association continuation instance set; the ratio between the number of business instances in the association continuation instance set and the number of business instances in the baseline association instance set is calculated to obtain the association source continuation value; the ratio between the number of verification calls and the number of baseline calls is calculated; when the ratio between the number of verification calls and the number of baseline calls is greater than one, the value one is used as the call behavior continuation value; when the ratio between the number of verification calls and the number of baseline calls is less than or equal to one, the corresponding ratio is used as the call behavior continuation value; the ratio between the number of abnormal responses and the number of verification calls is calculated to obtain the abnormal response ratio; the association source continuation value and the call behavior continuation value are calculated. The cube root of the product of the first value and the abnormal response ratio is used to obtain the associated response interruption value of the corresponding target business instance. The difference between the first value and the associated response interruption value is calculated to obtain the instance association retention coefficient of the corresponding target business instance. When the baseline associated instance set is empty or the baseline call count is zero, the instance association retention coefficient of the corresponding target business instance is set to one. When the verification call count is zero, the abnormal response ratio of the corresponding target business instance is set to zero, and the instance association retention coefficient of the corresponding target business instance is set to one. The average value of the instance association retention coefficients of each target business instance in the corresponding business module is calculated to obtain the association retention coefficient of the corresponding business module. When there is no target business instance in the corresponding business module, the association retention coefficient of the corresponding business module is set to one.

[0015] Preferably, the steps for obtaining the service instance load-bearing parameters are as follows: Extract service call relationship data from the service call relationship data corresponding to each benchmark observation period, where the called service instance identifier information is the same as the business instance identifier information of the corresponding target service instance; classify the extracted service call relationship data according to the service interface identifier information, and count the number of service call relationship data corresponding to each service interface identifier information to obtain the benchmark load quantity of each interface of the corresponding target service instance; extract business instances other than the target service instance that generate standard operating data records within the verification observation period from the business module operation data group where each target service instance is located, to obtain the candidate load-bearing business instances of the corresponding target service instance; and count the load of each candidate load-bearing business instance... For example, the number of service call relationship data corresponding to each service interface identifier information within the baseline observation period and the verification observation period is calculated, and the difference between the number of service call relationship data corresponding to the same service interface identifier information for the same candidate business instance during the verification observation period and the number of service call relationship data during the baseline observation period is calculated; the difference with a value greater than zero is retained as the corresponding interface load growth quantity, and the difference with a value less than or equal to zero is set to zero; according to the service interface identifier information, the interface load growth quantity corresponding to each candidate business instance is summed to obtain the interface acceptance growth quantity corresponding to each service interface identifier information; the baseline interface load quantity and the interface acceptance growth quantity corresponding to each target business instance are used as the business instance load acceptance parameters.

[0016] Preferably, the step of calculating the load capacity coefficient based on the service instance load capacity parameters is as follows: Calculate the ratio between the interface load capacity increase and the interface baseline load for each service interface identifier; when the ratio is greater than one, use one as the interface load capacity ratio for the corresponding service interface identifier; when the ratio is less than or equal to one, use the ratio as the interface load capacity ratio for the corresponding service interface identifier; sum the baseline load for each interface corresponding to the same target service instance to obtain the total baseline load for the target service instance, and calculate the ratio between the baseline load for each interface and the total baseline load to obtain the load capacity ratio for the corresponding service interface identifier. The load ratio of each service interface is calculated. The product of the interface load capacity ratio and the interface load percentage is calculated, and the products are summed to obtain the load capacity strength of the corresponding target service instance. The difference between the value and the load capacity strength is calculated to obtain the instance load capacity coefficient of the corresponding target service instance. When the baseline load of the target service instance is zero, the instance load capacity coefficient of the corresponding target service instance is set to one. The average of the instance load capacity coefficients of each target service instance within the corresponding service module is calculated to obtain the load capacity coefficient of the corresponding service module. When there is no target service instance within the corresponding service module, the load capacity coefficient of the corresponding service module is set to one.

[0017] Preferably, the step of reconstructing the business module operation data group to generate the reconstructed business module operation data group includes: counting the number of standard operation data records generated by each target business instance within the corresponding baseline observation period and the total number of standard operation data records generated by the corresponding business module operation data group within the baseline observation period, and calculating the ratio between the number of standard operation data records corresponding to each target business instance and the total number of standard operation data records to obtain the corresponding baseline statistical contribution ratio; calculating the product of the baseline statistical contribution ratio corresponding to each target business instance and the corresponding instance load-bearing coefficient to obtain the missing statistical contribution ratio of the corresponding target business instance; extracting the service interface identifier information from the service call relationship data where the called business instance identifier information is the same as the business instance identifier information of the corresponding target business instance from the service call relationship data within the corresponding baseline observation period of each target business instance, and performing deduplication processing to obtain the baseline interface set of the corresponding target business instance; and counting the service interface identifier information corresponding to each business instance within the verification observation period in the corresponding business module operation data group and the corresponding... The number of identical service interface identifiers in the baseline interface set is used to obtain the number of overlapping interfaces for the corresponding business instance. The number of overlapping interfaces for each target business instance is summed, and the ratio between the number of overlapping interfaces and the summation result is calculated to obtain the contribution allocation ratio for the corresponding business instance. When the summation result is zero, the ratio between the summation result and the number of corresponding business instances is used as the contribution allocation ratio for each business instance. The missing statistical contribution ratio for each target business instance is multiplied by the contribution allocation ratio for each business instance, and the product is used as the statistical weight information for the corresponding business instance. When the same business instance corresponds to multiple statistical weight information, the multiple statistical weight information is summed to obtain the final statistical weight information for the corresponding business instance. The final statistical weight information for each business instance is added to the corresponding standard running data record within the verification observation period to obtain the weighted running data record. The weighted running data record includes the standard running data record and the statistical weight information. All weighted running data records within the verification observation period are used as the reconstructed business module running data group.

[0018] The technical effects and advantages of this invention are as follows:

[0019] The system obtains continuous observation status data of business instances based on the business module running data group, and generates a consistency index of business instance composition based on the continuous observation status data of business instances. It then determines whether the business module running data group meets the statistical consistency conditions based on the business instance composition consistency index. If the statistical consistency conditions are not met, the corresponding business module running data group is reconstructed to generate a reconstructed business module running data group, which effectively improves the reliability of business system operation risk monitoring and the detection stability under complex operation scenarios. Attached Figure Description

[0020] Figure 1 A flowchart of a business system operation risk monitoring method based on non-intrusive dynamic observation is provided for an embodiment of this application. Detailed Implementation

[0021] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings. In addition, the forms of the various structures described in the following embodiments are merely illustrative. The business system operation risk monitoring method based on non-intrusive dynamic observation involved in the present invention is not limited to the structures described in the following embodiments. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0022] This invention provides a method for monitoring operational risks of business systems based on non-intrusive dynamic observation, such as... Figure 1 As shown, it includes the following steps:

[0023] Step 1: Obtain the operation log data, system performance monitoring data, and network communication data corresponding to the target business system, and perform unified timestamp processing on the operation log data, system performance monitoring data, and network communication data to obtain standard operation monitoring data;

[0024] Step 2: Perform data format parsing, abnormal missing value handling, and unified field mapping on the standard operation monitoring data to obtain standard operation data records;

[0025] Standard operational data records include timestamp information, business module identification information, business instance identification information, operational metric data, log event data, service call relationship data, and network communication metric data; service call relationship data includes the initiating business instance identification information, the called business instance identification information, the service interface identification information, and the call response status information; among them, the service interface identification information is used to identify the business interface accessed by the corresponding service call, and can be obtained by parsing the interface name, interface path, service method name, or interface code in the service call log;

[0026] The initiating business instance identifier information is used to represent the business instance that initiated the service call; the called business instance identifier information is used to represent the business instance that received the service call; the call response status information is used to represent the response status of the corresponding service call, which may include normal response status, abnormal response status, and no response status.

[0027] Step 3: Arrange the standard operation data records in chronological order according to the timestamp information, and classify and collect the standard operation data records belonging to the same business module according to the business module identification information to obtain multiple business module operation data groups;

[0028] Each business module's runtime data group includes multiple consecutive standard runtime data records for the corresponding business module;

[0029] Step 4: Obtain the continuous observation status data of the business instance based on the business module running data group. The continuous observation status data of the business instance includes the business instance observation continuity parameter, the business instance associated response maintenance parameter, and the business instance load carrying parameter. Generate the business instance composition consistency index based on the continuous observation status data of the business instance.

[0030] In this embodiment, it should be specifically explained that the steps for obtaining the consistency index of the business instance composition are as follows:

[0031] Obtain the observation continuity parameters of the business instance, and calculate the observation continuity coefficient based on the observation continuity parameters of the business instance;

[0032] Obtain the business instance association response retention parameters, and calculate the association retention coefficient based on the business instance association response retention parameters;

[0033] Obtain the load capacity parameters of the business instance, and calculate the load capacity coefficient based on the load capacity parameters of the business instance;

[0034] The observation continuity coefficient, correlation maintenance coefficient, and load bearing coefficient are normalized to obtain normalized observation continuity coefficient, correlation maintenance coefficient, and load bearing coefficient. It should be noted that in this embodiment, vector normalization can be used to normalize these coefficients. Specifically, the observation continuity coefficient, correlation maintenance coefficient, and load bearing coefficient are combined to form a three-dimensional vector. The norm value is obtained by calculating the square root of the sum of squares of each component of the three-dimensional vector, and each coefficient is divided by the norm value to complete the normalization process under a unified scale. Since the observation continuity coefficient, correlation maintenance coefficient, and load bearing coefficient reflect the continuous observation continuity of the business instance, the correlation response maintenance of the business instance, and the load bearing of the business instance, respectively, their numerical distribution and variation range differ. Normalization can eliminate the influence of differences in the value range and variation range of different coefficients on the subsequent calculation results of the business instance composition consistency index, improving the stability and comparability of the business instance composition consistency index calculation results. Since the vector normalization method is existing technology, its specific calculation process will not be described in detail in this embodiment.

[0035] The consistency index of business instances is calculated based on the normalized observation continuity coefficient, correlation retention coefficient, and load capacity coefficient. The specific steps for obtaining the index are as follows:

[0036] ;

[0037] In the formula, This represents the consistency index of business instances. This is represented by the normalized observation continuity coefficient. An increase in the observation continuity coefficient indicates a higher degree to which business instances in the business module's running data group remain within the statistical object, and a decrease in the occurrence of business instances continuously disappearing and exiting the statistical object. This results in a more stable business instance composition, and therefore an increase in the business instance composition consistency index. Conversely, a decrease in the observation continuity coefficient indicates an increase in the occurrence of business instances continuously disappearing and exiting the statistical object. This makes the statistical object corresponding to the business module's running data group more prone to change, reducing the stability of the business instance composition, and therefore a decrease in the business instance composition consistency index. This represents the normalized association preservation coefficient. An increase in the association preservation coefficient indicates that after the target business instance stops being observed, the association response relationship between business instances remains stable. The probability of changes in the statistical objects corresponding to the business module's running data group due to abnormal business instance failure decreases, resulting in a more stable business instance composition. Therefore, the business instance composition consistency index increases. Conversely, a decrease in the association preservation coefficient indicates that after the target business instance stops being observed, the association response relationship between business instances changes significantly. The probability of changes in the statistical objects corresponding to the business module's running data group due to abnormal business instance failure increases, resulting in decreased business instance composition stability. Therefore, the business instance composition consistency index decreases. This represents the normalized load capacity factor. An increase in the load capacity factor indicates that after the target service instance stops observation, the original service load is less likely to be taken over by other service instances, and the composition of service instances corresponding to the service module's running data group remains stable; therefore, the service instance composition consistency index increases. Conversely, a decrease in the load capacity factor indicates that after the target service instance stops observation, the original service load is more likely to be taken over by other service instances, and the possibility of changes in the composition of service instances corresponding to the service module's running data group increases; therefore, the service instance composition consistency index decreases. , , This represents the weighting coefficients of the normalized observation continuity coefficient, the normalized correlation preservation coefficient, and the normalized load-bearing coefficient, and... , , , The weights can be obtained using the Analytic Hierarchy Process (AHP), an existing method for determining the weights of multiple indicators. AHP establishes pairwise comparison relationships between multiple evaluation indicators to form a corresponding judgment matrix, and calculates the weight coefficients for each indicator through a consistency test. Since AHP is existing technology, its specific calculation process will not be described in detail in this embodiment.

[0038] In this embodiment, it should be specifically explained that the steps for obtaining the continuity parameter of the business instance observation are as follows:

[0039] Extract the business instance identifier information and timestamp information corresponding to each standard running data record in each business module running data group. Collect the standard running data records belonging to the same business instance according to the business instance identifier information, and arrange the collected standard running data records in chronological order according to the timestamp information to obtain the instance running record sequence corresponding to each business instance.

[0040] Calculate the time interval between adjacent standard running data records in each instance running record sequence, and statistically analyze each time interval according to the business module running data group; arrange all time intervals obtained from the statistical analysis of each business module running data group according to their numerical values, and take the time interval in the middle position as the observation period of the corresponding business module running data group; when the total number of time intervals obtained from the statistical analysis of each business module running data group is even, take the average of the time intervals in the middle two positions as the observation period of the corresponding business module running data group.

[0041] Based on the duration of the observation period, the time range between the time when each business instance first generates a standard operating data record and the current monitoring time is divided into multiple consecutive observation periods;

[0042] It should be noted that the current monitoring time is the system time corresponding to the end of the current monitoring task, which is obtained by using the timestamp recorded by the business system monitoring platform, and is an existing technology.

[0043] It should be noted that the continuous observation period is divided into fixed time windows with consecutive beginnings and endings, based on the duration of the observation period. That is, the time when the business instance first generates standard operational data records is taken as the starting time, and multiple consecutive, non-overlapping time windows are sequentially divided according to the observation period duration. Each time window corresponds to one continuous observation period. This embodiment uses a fixed time window division method, which is a commonly used data window division method in this field, and this embodiment does not limit it.

[0044] The number of standard operating data records generated by each business instance in each continuous observation period is counted; when the number of standard operating data records is greater than zero, the corresponding continuous observation period is marked as a valid observation period.

[0045] When the number of standard operating data records is zero, the corresponding continuous observation period is marked as a missing observation period; the corresponding period marking results are arranged according to the time order of each continuous observation period to generate the observation period marking sequence for each business instance, and the observation period marking sequence is used as the observation continuity parameter of the business instance.

[0046] In this embodiment, it should be specifically explained that the steps for calculating the observation continuity coefficient based on the observation continuity parameter of the business instance are as follows:

[0047] For each observation period marked sequence, the missing observation periods with consecutive time positions are merged to obtain multiple consecutive missing observation segments. The number of missing observation periods contained in each consecutive missing observation segment and the position number of the last missing observation period in the observation period marked sequence are counted to obtain the corresponding missing segment length and segment end position number.

[0048] Calculate the product of the missing segment length and the segment end position number for each consecutive observation missing segment to obtain the corresponding missing position association value; sum the missing position association values ​​and calculate the ratio between the summation result and the square of the length of the corresponding observation period marker sequence to obtain the cumulative missing position value for the corresponding business instance.

[0049] The missing segment lengths corresponding to each consecutive missing observation segment are squared, the results of each squared process are summed, and the ratio between the summation result and the product of the total number of missing observation periods and the length of the corresponding observation period label sequence is calculated to obtain the missing segment cluster value of the corresponding business instance.

[0050] Calculate the square root of the product of the cumulative value of missing locations and the cluster value of missing segments to obtain the observation interruption value of the corresponding business instance, and calculate the difference between the first value and the observation interruption value to obtain the instance observation continuity coefficient of the corresponding business instance.

[0051] When there are no missing observation periods in the observation period marker sequence, the cumulative value of the missing position and the cluster value of the missing segment of the corresponding business instance are both set to zero, and the instance observation continuity coefficient of the corresponding business instance is set to one.

[0052] When the instance observation continuity coefficient of any business instance is equal to zero, the observation continuity coefficient of the corresponding business module is set to zero; when the instance observation continuity coefficients of all business instances are greater than zero, the reciprocal of the observation continuity coefficient of each instance is calculated, the reciprocals are summed, and the ratio between the number of business instances contained in the corresponding business module and the summation result is calculated to obtain the observation continuity coefficient of the corresponding business module.

[0053] In this embodiment, it should be specifically explained that the steps for obtaining the service instance associated response persistence parameters are as follows:

[0054] Based on the observation period marker sequence corresponding to each business instance, identify whether there are consecutive missing observation segments at the end of the observation period marker sequence, and take the business instance with consecutive missing observation segments at the end of the observation period marker sequence as the target business instance; take the consecutive missing observation segments at the end of the observation period marker sequence of the corresponding target business instance as the target consecutive missing observation segments, and take the first missing observation period in the target consecutive missing observation segments as the corresponding target missing start period;

[0055] Extract a preset number of continuous observation periods from the business module running data group where each target business instance is located, before the target missing start period, and use the extracted continuous observation periods as the benchmark observation period for the corresponding target business instance.

[0056] It should be noted that the preset number is the number of consecutive observation periods used to limit the length of the associated benchmark period and the verification observation period. It can be determined according to the service call frequency of the business system, or it can be the minimum number of consecutive observation periods corresponding to the historical service call number when it tends to be stable. This embodiment uses the existing sliding window length determination method to obtain it, and this embodiment does not limit it.

[0057] Extract continuous observation periods starting from the missing period of the corresponding target and having the same number of observation periods as the baseline observation periods, and use the extracted continuous observation periods as the verification observation periods for the corresponding target business instance;

[0058] It should be noted that when the number of missing observation periods contained in the missing segment of the target continuous observation is less than the preset number, all continuous observation periods from the starting period of the target missing period to the current monitoring time will be used as the verification observation period of the corresponding target business instance, and continuous observation periods with the same number of verification observation periods will be extracted from before the starting period of the target missing period as the benchmark observation period of the corresponding target business instance.

[0059] From the service call relationship data corresponding to the baseline observation period, extract the service call relationship data where the identifier information of the called business instance is the same as that of the business instance corresponding to the target business instance. Then, deduplicate the call initiating instance identifier information in the extracted service call relationship data to obtain the baseline associated instance set of the corresponding target business instance. Count the number of corresponding service call relationship data to obtain the baseline call count.

[0060] From the service call relationship data corresponding to the verification observation period, extract the service call relationship data where the identifier information of the called business instance is the same as that of the business instance corresponding to the target business instance, and deduplicate the call initiation instance identifier information in the extracted service call relationship data to obtain the verification associated instance set of the corresponding target business instance;

[0061] Count the number of corresponding service call relationship data and the number of service call relationship data with abnormal response status or no response status to obtain the number of verified calls and the number of abnormal responses.

[0062] Based on the baseline associated instance set, the verification associated instance set, the baseline call count, the verification call count, and the number of abnormal responses, generate the business instance associated response retention parameters for the corresponding target business instance.

[0063] In this embodiment, it should be specifically explained that the step of calculating the association retention coefficient based on the business instance association response retention parameter is as follows:

[0064] The intersection of the baseline associated instance set and the verification associated instance set is processed to obtain the associated continuation instance set. The ratio between the number of business instances in the associated continuation instance set and the number of business instances in the baseline associated instance set is calculated to obtain the associated source continuation value.

[0065] Calculate the ratio between the number of verification calls and the baseline number of calls; when the ratio is greater than one, use one as the continuation value for the call behavior; when the ratio is less than or equal to one, use the corresponding ratio as the continuation value for the call behavior.

[0066] Calculate the ratio between the number of abnormal responses and the number of verification calls to obtain the percentage of abnormal responses;

[0067] Calculate the cube root of the product of the associated source continuation value, the call behavior continuation value, and the value one minus the abnormal response ratio value to obtain the associated response interruption value of the corresponding target business instance. Then calculate the difference between the value one and the associated response interruption value to obtain the instance association retention coefficient of the corresponding target business instance.

[0068] When the set of baseline associated instances is empty or the number of baseline calls is zero, the instance association retention coefficient of the corresponding target business instance is set to one; when the number of verification calls is zero, the percentage of abnormal responses of the corresponding target business instance is set to zero, and the instance association retention coefficient of the corresponding target business instance is set to one.

[0069] Calculate the average of the instance association retention coefficients of each target business instance within the corresponding business module to obtain the association retention coefficient of the corresponding business module; when there is no target business instance within the corresponding business module, set the association retention coefficient of the corresponding business module to one.

[0070] In this embodiment, it should be specifically explained that the steps for obtaining the service instance load balancing parameters are as follows:

[0071] From the service call relationship data corresponding to each benchmark observation period, extract the service call relationship data where the called business instance identifier information is the same as the business instance identifier information of the corresponding target business instance; classify the extracted service call relationship data according to the service interface identifier information, and count the number of service call relationship data corresponding to each service interface identifier information to obtain the benchmark load of each interface of the corresponding target business instance.

[0072] From the business module running data group where each target business instance is located, extract the business instances that generate standard running data records within the verification observation period, excluding the target business instances, to obtain the candidate business instances that will take over the corresponding target business instances.

[0073] The number of service call relationship data corresponding to each service interface identifier information for each candidate service instance is counted in the baseline observation period and the verification observation period. The difference between the number of service call relationship data for the same candidate service instance corresponding to the same service interface identifier information in the verification observation period and the number of service call relationship data in the baseline observation period is calculated. The difference with a value greater than zero is retained as the corresponding interface load growth, and the difference with a value less than or equal to zero is set to zero.

[0074] Based on the service interface identification information, the number of interface load increases corresponding to each candidate business instance is summed to obtain the number of interface load increases corresponding to each service interface identification information.

[0075] The baseline load of each target business instance and the increase in the number of interfaces it can handle are used as the load handling parameters for the business instance.

[0076] In this embodiment, it should be specifically explained that the step of calculating the load capacity coefficient based on the service instance load capacity parameters is as follows:

[0077] Calculate the ratio between the number of new connections handled by each service interface identifier and the baseline load of the interface. When the ratio is greater than one, use one as the interface load handling ratio of the corresponding service interface identifier. When the ratio is less than or equal to one, use the ratio as the interface load handling ratio of the corresponding service interface identifier.

[0078] The baseline load of each interface corresponding to the same target business instance is summed to obtain the total baseline load of the corresponding target business instance. The ratio between the baseline load of each interface and the total baseline load is calculated to obtain the interface load ratio of the corresponding service interface identification information.

[0079] Calculate the product of the interface load capacity ratio and the interface load percentage corresponding to each service interface identifier information, and sum the products to obtain the load capacity of the corresponding target business instance.

[0080] Calculate the difference between the first value and the load-bearing strength to obtain the instance load-bearing coefficient of the corresponding target business instance;

[0081] When the baseline total load of the target business instance is equal to zero, the instance load capacity factor of the corresponding target business instance is set to one.

[0082] Calculate the average of the instance load capacity coefficients of each target business instance within the corresponding business module to obtain the load capacity coefficient of the corresponding business module; when there is no target business instance within the corresponding business module, set the load capacity coefficient of the corresponding business module to one.

[0083] Step 5: Determine whether the business module running data group meets the statistical consistency conditions based on the consistency index of the business instance. If the statistical consistency conditions are met, set the statistical weight information of each standard running data record in the corresponding business module running data group to one, and generate the corresponding weighted running data record to obtain the reconstructed business module running data group. If the statistical consistency conditions are not met, reconstruct the corresponding business module running data group to generate the reconstructed business module running data group.

[0084] It should be noted that the statistical weight information is used to represent the statistical contribution of the corresponding business instance in the business module's running status statistics process. The statistical weight information is used for subsequent business module running status statistics and does not change the running indicator data, log event data, and network communication indicator data in the corresponding standard running data record.

[0085] In this embodiment, it should be specifically explained that the step of determining whether the running data group of the business module meets the statistical consistency condition based on the consistency index of the business instance composition is as follows:

[0086] The consistency index of business instance composition is compared with the consistency threshold. If the consistency index of business instance composition is greater than or equal to the consistency threshold, it is determined that the data group of business module operation meets the statistical consistency condition. If the consistency index of business instance composition is less than the consistency threshold, it is determined that the data group of business module operation does not meet the statistical consistency condition. It should be noted that the consistency threshold is used to determine whether the consistency index of business instance composition meets the statistical consistency condition. It can be obtained by using an adaptive threshold determination method in the prior art. For example, the consistency threshold of the corresponding business module can be automatically determined based on the distribution of the consistency index of business instance composition corresponding to multiple historical monitoring periods and in combination with preset statistical rules. This embodiment does not limit this.

[0087] In this embodiment, it should be specifically explained that the steps for reconstructing the corresponding business module runtime data group and generating the reconstructed business module runtime data group are as follows:

[0088] The number of standard operating data records generated by each target business instance within the corresponding baseline observation period and the total number of standard operating data records generated by the corresponding business module operating data group within the baseline observation period are counted separately. The ratio between the number of standard operating data records for each target business instance and the total number of standard operating data records is calculated to obtain the corresponding baseline statistical contribution ratio.

[0089] The missing statistical contribution ratio of the corresponding target business instance is obtained by multiplying the baseline statistical contribution ratio of each target business instance with the load capacity coefficient of the corresponding instance.

[0090] Extract the service interface identifier information from the service call relationship data within the benchmark observation period corresponding to each target business instance. The service interface identifier information is the same as the business instance identifier information of the corresponding target business instance. Then, perform deduplication to obtain the benchmark interface set of the corresponding target business instance.

[0091] The number of service interface identifiers corresponding to each business instance in the corresponding business module's running data group during the verification observation period is counted separately, and the number of service interface identifiers that are the same as those in the corresponding baseline interface set is obtained to obtain the number of interfaces that overlap for the corresponding business instance.

[0092] The number of overlapping interfaces corresponding to the same target business instance is summed, and the ratio between the number of overlapping interfaces and the summation result is calculated to obtain the contribution allocation ratio of the corresponding business instance. When the summation result is equal to zero, the ratio between the value one and the number of corresponding business instances is taken as the contribution allocation ratio of each business instance.

[0093] Calculate the product of the missing statistical contribution ratio corresponding to each target business instance and the contribution allocation ratio corresponding to each business instance, and use the product as the statistical weight information of the corresponding business instance; when the same business instance corresponds to multiple statistical weight information, sum the multiple statistical weight information to obtain the final statistical weight information of the corresponding business instance.

[0094] The final statistical weight information corresponding to each business instance is added to the corresponding standard operating data record within the verification observation period to obtain the weighted operating data record; the weighted operating data record includes the standard operating data record and the statistical weight information.

[0095] All weighted operational data records within the verification observation period will be used as the operational data group for the reconstructed business modules.

[0096] Step 6: Based on the statistical weight information corresponding to each weighted running data record, perform weighted statistics on the running indicator data, log event data, and network communication indicator data in the reconstructed business module running data group to obtain the corresponding business module running status data.

[0097] It should be noted that, in this embodiment, when performing weighted statistics on operational indicator data, each operational indicator data can be multiplied by its corresponding statistical weight information and then subjected to weighted average processing; when performing weighted statistics on log event data and network communication indicator data, the corresponding number of events or indicators can be multiplied by its statistical weight information and then subjected to summation processing. The weighted average processing and weighted summation processing are both existing technologies, and this embodiment will not provide a detailed description of their specific calculation processes.

[0098] Step 7: Compare and process the running status data of each business module with the corresponding preset running baseline data to obtain the running status judgment result of each business module;

[0099] It should be noted that the preset operating baseline data can be obtained using the historical operating baseline establishment method in the prior art. The preset operating baseline data of the corresponding business module is generated by statistical analysis based on the operating indicator data during the historical normal operation period of the corresponding business module. This embodiment does not limit this.

[0100] Step 8: Generate business system operation monitoring results based on the operation status determination results of each business module, and send the business system operation monitoring results to the operation monitoring terminal for display.

[0101] In conclusion, the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

[0102] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for monitoring operational risks of business systems based on non-intrusive dynamic observation, characterized in that, Includes the following steps: Step 1: Obtain the operation log data, system performance monitoring data, and network communication data corresponding to the target business system, and process them with a unified timestamp to obtain standard operation monitoring data; Step 2: Standardize the standard operation monitoring data to obtain standard operation data records; Standard operational data records include timestamp information, business module identification information, business instance identification information, operational metric data, log event data, service call relationship data, and network communication metric data; service call relationship data includes the initiating business instance identification information, the called business instance identification information, the service interface identification information, and the call response status information; Step 3: Arrange the standard running data records according to the timestamp information, and classify and collect them according to the business module identification information to obtain multiple business module running data groups; Step 4: Based on the business module running data group, obtain the business instance observation continuity parameter, business instance associated response retention parameter, and business instance load carrying parameter, and generate the business instance composition consistency index. Step 5: Determine whether the business module running data group meets the statistical consistency conditions based on the consistency index of the business instance composition; if it does, set the statistical weight information of each standard running data record in the business module running data group to one to obtain the reconstructed business module running data group; if it does not meet the conditions, reconstruct the business module running data group to generate the reconstructed business module running data group. Step 6: Based on the statistical weight information, perform weighted statistics on the operation indicator data, log event data, and network communication indicator data in the reconstructed business module operation data group to obtain the business module operation status data; Step 7: Compare the business module's operating status data with the preset operating baseline data to obtain the operating status determination result; Step 8: Generate the business system operation monitoring results based on the operation status determination results, and send the results to the operation monitoring terminal for display.

2. The method for monitoring operational risks of a business system based on non-intrusive dynamic observation according to claim 1, characterized in that: The steps for obtaining the consistency index of the business instance composition are as follows: Obtain the observation continuity parameters of the business instance, and calculate the observation continuity coefficient based on the observation continuity parameters of the business instance; Obtain the business instance association response retention parameters, and calculate the association retention coefficient based on the business instance association response retention parameters; Obtain the load capacity parameters of the business instance, and calculate the load capacity coefficient based on the load capacity parameters of the business instance; The observation continuity coefficient, correlation preservation coefficient, and load bearing coefficient are normalized to obtain the normalized observation continuity coefficient, correlation preservation coefficient, and load bearing coefficient. The consistency index of business instances is calculated based on the normalized observation continuity coefficient, correlation retention coefficient, and load bearing coefficient.

3. The method for monitoring operational risks of a business system based on non-intrusive dynamic observation according to claim 2, characterized in that, The steps for obtaining the continuity parameter of the business instance observation are as follows: Extract the business instance identifier information and timestamp information corresponding to each standard running data record in each business module running data group. Collect the standard running data records belonging to the same business instance according to the business instance identifier information, and arrange the collected standard running data records in chronological order according to the timestamp information to obtain the instance running record sequence corresponding to each business instance. Calculate the time interval between adjacent standard running data records in each instance running record sequence, and statistically analyze each time interval according to the business module running data group; arrange all the time intervals obtained from the statistical analysis of each business module running data group according to their numerical values, and take the time interval in the middle position as the observation period of the corresponding business module running data group. When the total number of time intervals obtained from the data group of each business module is even, the average of the time intervals in the two middle positions is taken as the observation period of the corresponding business module's data group. Based on the duration of the observation period, the time range between the time when each business instance first generates a standard operating data record and the current monitoring time is divided into multiple consecutive observation periods; Count the number of standard operational data records generated by each business instance within each continuous observation period; When the number of standard operating data records is greater than zero, the corresponding continuous observation period is marked as a valid observation period; When the number of standard operating data records is zero, the corresponding continuous observation period is marked as a missing observation period; the corresponding period marking results are arranged according to the time order of each continuous observation period to generate the observation period marking sequence for each business instance, and the observation period marking sequence is used as the observation continuity parameter of the business instance.

4. The method for monitoring operational risks of a business system based on non-intrusive dynamic observation according to claim 3, characterized in that, The steps for calculating the observation continuity coefficient based on the observation continuity parameter of the business instance are as follows: For each observation period marked sequence, the missing observation periods with consecutive time positions are merged to obtain multiple consecutive missing observation segments. The number of missing observation periods contained in each consecutive missing observation segment and the position number of the last missing observation period in the observation period marked sequence are counted to obtain the corresponding missing segment length and segment end position number. Calculate the product of the missing segment length and the segment end position number for each consecutive observation missing segment to obtain the corresponding missing position association value; sum the missing position association values ​​and calculate the ratio between the summation result and the square of the length of the corresponding observation period marker sequence to obtain the cumulative missing position value for the corresponding business instance. The missing segment lengths corresponding to each consecutive missing observation segment are squared, the results of each squared process are summed, and the ratio between the summation result and the product of the total number of missing observation periods and the length of the corresponding observation period label sequence is calculated to obtain the missing segment cluster value of the corresponding business instance. Calculate the square root of the product of the cumulative value of missing locations and the cluster value of missing segments to obtain the observation interruption value of the corresponding business instance, and calculate the difference between the first value and the observation interruption value to obtain the instance observation continuity coefficient of the corresponding business instance. When there are no missing observation periods in the observation period marker sequence, the cumulative value of the missing position and the cluster value of the missing segment of the corresponding business instance are both set to zero, and the instance observation continuity coefficient of the corresponding business instance is set to one. When the instance observation continuity coefficient of any business instance is equal to zero, the observation continuity coefficient of the corresponding business module is set to zero; when the instance observation continuity coefficients of all business instances are greater than zero, the reciprocal of the observation continuity coefficient of each instance is calculated, the reciprocals are summed, and the ratio between the number of business instances contained in the corresponding business module and the summation result is calculated to obtain the observation continuity coefficient of the corresponding business module.

5. The method for monitoring operational risks of a business system based on non-intrusive dynamic observation according to claim 4, characterized in that: The steps for obtaining the service instance associated response persistence parameters are as follows: Based on the observation period marker sequence corresponding to each business instance, identify whether there are consecutive missing observation segments at the end of the observation period marker sequence, and take the business instance with consecutive missing observation segments at the end of the observation period marker sequence as the target business instance; take the consecutive missing observation segments at the end of the observation period marker sequence of the corresponding target business instance as the target consecutive missing observation segments, and take the first missing observation period in the target consecutive missing observation segments as the corresponding target missing start period; Extract a preset number of continuous observation periods from the business module running data group where each target business instance is located, before the target missing start period, and use the extracted continuous observation periods as the benchmark observation period for the corresponding target business instance. Extract continuous observation periods starting from the missing period of the corresponding target and having the same number of observation periods as the baseline observation periods, and use the extracted continuous observation periods as the verification observation periods for the corresponding target business instance; From the service call relationship data corresponding to the baseline observation period, extract the service call relationship data where the identifier information of the called business instance is the same as that of the business instance corresponding to the target business instance, and deduplicate the call initiating instance identifier information in the extracted service call relationship data to obtain the baseline associated instance set of the corresponding target business instance; Count the number of corresponding service call relationship data to obtain the baseline call count; From the service call relationship data corresponding to the verification observation period, extract the service call relationship data where the identifier information of the called business instance is the same as that of the business instance corresponding to the target business instance, and deduplicate the call initiation instance identifier information in the extracted service call relationship data to obtain the verification associated instance set of the corresponding target business instance; Count the number of corresponding service call relationship data and the number of service call relationship data with abnormal response status or no response status to obtain the number of verified calls and the number of abnormal responses. Based on the baseline associated instance set, the verification associated instance set, the baseline call count, the verification call count, and the number of abnormal responses, generate the business instance associated response retention parameters for the corresponding target business instance.

6. The method for monitoring operational risks of a business system based on non-intrusive dynamic observation according to claim 5, characterized in that: The step of calculating the association retention coefficient based on the business instance association response retention parameter is as follows: The intersection of the baseline associated instance set and the verification associated instance set is processed to obtain the associated continuation instance set. The ratio between the number of business instances in the associated continuation instance set and the number of business instances in the baseline associated instance set is calculated to obtain the associated source continuation value. Calculate the ratio of the number of verification calls to the number of baseline calls; When the ratio between the number of verification calls and the base number of calls is greater than one, the value one is used as the continuation value for the call behavior; when the ratio between the number of verification calls and the base number of calls is less than or equal to one, the corresponding ratio is used as the continuation value for the call behavior. Calculate the ratio of the number of abnormal responses to the number of verification calls to obtain the percentage of abnormal responses; Calculate the cube root of the product of the associated source continuation value, the call behavior continuation value, and the value one minus the abnormal response ratio value to obtain the associated response interruption value of the corresponding target business instance. Then calculate the difference between the value one and the associated response interruption value to obtain the instance association retention coefficient of the corresponding target business instance. When the set of baseline associated instances is empty or the number of baseline calls is zero, the instance association retention coefficient of the corresponding target business instance is set to one; when the number of verification calls is zero, the percentage of abnormal responses of the corresponding target business instance is set to zero, and the instance association retention coefficient of the corresponding target business instance is set to one. Calculate the average of the instance association retention coefficients of each target business instance within the corresponding business module to obtain the association retention coefficient of the corresponding business module; when there is no target business instance within the corresponding business module, set the association retention coefficient of the corresponding business module to one.

7. The method for monitoring operational risks of a business system based on non-intrusive dynamic observation according to claim 5, characterized in that: The steps for obtaining the load balancing parameters of the service instance are as follows: From the service call relationship data corresponding to each benchmark observation period, extract the service call relationship data where the called business instance identifier information is the same as the business instance identifier information of the corresponding target business instance; The extracted service call relationship data is classified according to the service interface identification information, and the number of service call relationship data corresponding to each service interface identification information is counted to obtain the baseline load of each interface of the corresponding target business instance. From the business module running data group where each target business instance is located, extract the business instances that generate standard running data records within the verification observation period, excluding the target business instances, to obtain the candidate business instances that will take over the corresponding target business instances. The number of service call relationship data corresponding to each service interface identifier information for each candidate business instance is counted in the baseline observation period and the verification observation period, and the difference between the number of service call relationship data corresponding to the same service interface identifier information for the same candidate business instance in the verification observation period and the number of service call relationship data in the baseline observation period is calculated. Retain the differences with values ​​greater than zero as the corresponding interface load increase, and set the differences with values ​​less than or equal to zero to zero; Based on the service interface identification information, the number of interface load increases corresponding to each candidate business instance is summed to obtain the number of interface load increases corresponding to each service interface identification information. The baseline load of each target business instance and the increase in the number of interfaces it can handle are used as the load handling parameters for the business instance.

8. The method for monitoring operational risks of a business system based on non-intrusive dynamic observation according to claim 7, characterized in that: The steps for calculating the load capacity coefficient based on the load capacity parameters of the business instance are as follows: Calculate the ratio between the number of new connections handled by each service interface identifier and the baseline load of the interface. When the ratio is greater than one, use one as the interface load handling ratio of the corresponding service interface identifier. When the ratio is less than or equal to one, use the ratio as the interface load handling ratio of the corresponding service interface identifier. The baseline load of each interface corresponding to the same target business instance is summed to obtain the total baseline load of the corresponding target business instance. The ratio between the baseline load of each interface and the total baseline load is calculated to obtain the interface load ratio of the corresponding service interface identification information. Calculate the product of the interface load capacity ratio and the interface load percentage corresponding to each service interface identifier information, and sum the products to obtain the load capacity of the corresponding target business instance. Calculate the difference between the first value and the load-bearing strength to obtain the instance load-bearing coefficient of the corresponding target business instance; When the baseline total load of the target business instance is equal to zero, the instance load capacity factor of the corresponding target business instance is set to one. Calculate the average of the instance load capacity coefficients of each target business instance within the corresponding business module to obtain the load capacity coefficient of the corresponding business module; when there is no target business instance within the corresponding business module, set the load capacity coefficient of the corresponding business module to one.

9. The method for monitoring operational risks of a business system based on non-intrusive dynamic observation according to claim 8, characterized in that: The steps for reconstructing the business module runtime data group to generate the reconstructed business module runtime data group are as follows: The number of standard operating data records generated by each target business instance within the corresponding baseline observation period and the total number of standard operating data records generated by the corresponding business module operating data group within the baseline observation period are counted separately. The ratio between the number of standard operating data records corresponding to each target business instance and the total number of standard operating data records is calculated to obtain the corresponding baseline statistical contribution ratio. The missing statistical contribution ratio of the corresponding target business instance is obtained by multiplying the baseline statistical contribution ratio of each target business instance with the load capacity coefficient of the corresponding instance. Extract the service interface identifier information from the service call relationship data within the benchmark observation period corresponding to each target business instance. The service interface identifier information is the same as the business instance identifier information of the corresponding target business instance. Then, perform deduplication to obtain the benchmark interface set of the corresponding target business instance. The number of service interface identifiers corresponding to each business instance in the corresponding business module's running data group during the verification observation period is counted separately, and the number of service interface identifiers that are the same as those in the corresponding baseline interface set is obtained to obtain the number of interfaces that overlap for the corresponding business instance. The number of overlapping interfaces corresponding to the same target business instance is summed, and the ratio between the number of overlapping interfaces and the summation result is calculated to obtain the contribution allocation ratio of the corresponding business instance. When the summation result is equal to zero, the ratio between the value one and the number of corresponding business instances is taken as the contribution allocation ratio of each business instance. Calculate the product of the missing statistical contribution ratio corresponding to each target business instance and the contribution allocation ratio corresponding to each business instance, and use the product as the statistical weight information of the corresponding business instance; when the same business instance corresponds to multiple statistical weight information, sum the multiple statistical weight information to obtain the final statistical weight information of the corresponding business instance. The final statistical weight information corresponding to each business instance is added to the corresponding standard operating data record within the verification observation period to obtain the weighted operating data record; the weighted operating data record includes the standard operating data record and the statistical weight information. All weighted operational data records within the verification observation period will be used as the operational data group for the reconstructed business modules.

Images