Information system operation risk monitoring method and system based on historical behavior baseline

Abstract

The application relates to the technical field of operation risk monitoring, and discloses an information system operation risk monitoring method and system based on historical behavior baseline. The method comprises the following steps: extracting an operation characteristic vector according to operation metadata and associating a key performance index set, constructing a structured historical data set containing an execution context vector and a life cycle stage label, establishing a context self-adaptive baseline through context clustering layering, obtaining a basic comprehensive risk value by fusing single-index deviation and co-integration relationship deviation, outputting a comprehensive dynamic risk value after correction by a segmented risk acceleration function, and triggering a graded early warning. The application improves the environmental self-adaptive capability and multi-dimensional risk perception accuracy of information system operation risk monitoring.

Description

Technical Field

[0001] This application relates to the field of operational risk monitoring technology, and in particular to an information system operational risk monitoring method and system based on historical behavioral baselines. Background Technology

[0002] Information system operational risk monitoring is a crucial technical means to ensure the stable operation of core business systems. Existing technologies typically employ fixed threshold methods to monitor key performance indicators (KPIs) during operation. This involves operations personnel setting fixed upper and lower limits for alarms based on experience, such as CPU utilization, memory usage, and execution time. An alarm is triggered when the KPI value exceeds the preset range. Some improved solutions introduce a static baseline based on the statistical average of all historical data. This historical average serves as a single reference benchmark, and multiple indicators are independently assessed for deviation before being weighted and aggregated to generate a comprehensive risk score. These solutions have formed a complete closed loop in their technical architecture, from KPI collection and baseline comparison to risk alarms, and have been widely adopted in engineering applications across the industry.

[0003] However, the fixed threshold method relies entirely on manual experience for parameter configuration and cannot automatically adjust to dynamic changes in system load. In high-concurrency or resource-contact environments, the normal values ​​of indicators will be significantly higher, leading to numerous false alarms from the fixed threshold. Static baselines based on full historical data mix and statistically analyze historical data from different execution environments, causing the baseline to decouple from the current execution environment. The same deviation in indicators can have completely different risk implications in light-load and heavy-load environments, but the static baseline cannot distinguish this difference. Furthermore, existing multi-indicator fusion schemes only calculate the absolute deviation of each indicator independently and then sum them by weight, ignoring the important risk signal of the disruption of cointegration relationships between indicators, resulting in some hidden faults not being effectively identified. The use of equal-weighted risk judgment logic throughout the entire job execution process also makes it impossible to differentiate the perception of the true risks in the early stages of the job from those in the critical timeout stage, resulting in both false alarms and missed alarms. Summary of the Invention

[0004] This application provides a method and system for monitoring operational risks of information systems based on historical behavioral baselines. It solves the problems of high false alarm rate and missed detection of hidden risks in the prior art due to the decoupling of baseline and execution environment, independent judgment of indicators and equal weighting of scores throughout the process. It improves the environmental adaptability and multi-dimensional risk perception accuracy of operational risk monitoring of information systems.

[0005] Firstly, this application provides a method for monitoring operational risks of information systems based on historical behavioral baselines, the method comprising:

[0006] Step S1: Extract job feature vectors based on job metadata, and associate a set of key performance indicators based on the job feature vectors;

[0007] Step S2: Collect historical execution time-series data of the set of key performance indicators, synchronously record execution context vectors and job lifecycle stage annotations, and construct a structured historical dataset;

[0008] Step S3: Group the structured historical dataset according to the job lifecycle stage and cluster the execution context vector. Calculate the mean and standard deviation for each cluster subset to obtain the context hierarchical stage baseline parameter set, and calculate the cointegration relationship matrix for each indicator against historical cointegration. During job execution, use the mean and standard deviation of the nearest neighbor cluster subset matched with the current execution context vector in the context hierarchical stage baseline parameter set as the context adaptive baseline. Calculate the single indicator deviation and the relationship deviation based on the cointegration relationship matrix for each indicator's current value relative to the context adaptive baseline, and weight and fuse them according to stage weights to obtain the basic comprehensive risk value.

[0009] Step S4: Take the ratio of the execution time of the job to the historical average execution time as the execution progress ratio, substitute it into the segmented risk acceleration function to obtain the risk acceleration coefficient, multiply the risk acceleration coefficient by the basic comprehensive risk value to obtain the comprehensive dynamic risk value, and compare the comprehensive dynamic risk value with the warning threshold to trigger the warning.

[0010] Optionally, step S1 includes:

[0011] Extract job type code, data processing scale, scheduling cycle code, number of dependent jobs, historical average execution time, data source type code, and historical execution success rate from the job metadata repository to construct the job feature vector;

[0012] Based on the combined key of the job type code and the data source type code in the job feature vector, the corresponding set of key performance indicators is retrieved in the job type-indicator mapping rule table;

[0013] When the historical execution count corresponding to the job feature vector is less than 30, calculate the Euclidean distance between the job feature vector and the job feature vectors of each established baseline in the job family library. Take the baseline parameter of the job family with the smallest distance as the initial migration baseline. Use the ratio of the historical execution count of the target job to the sum of the historical execution count of the target job and 30 as the correction coefficient. Combine the correction coefficient with the initial migration baseline to obtain the migration correction baseline.

[0014] Optionally, step S2 includes:

[0015] Historical execution time-series data of each indicator in the set of key performance indicators are collected at a sampling interval of ten seconds.

[0016] Within sixty seconds before the start of each historically executed job, the average system CPU load rate, average memory usage rate, number of concurrent jobs, average disk I / O queue depth, and the current time period code are collected and combined to form the execution context vector.

[0017] Based on the time-series changes in CPU utilization in the historical execution time-series data, the sampling points are divided into the startup phase, resource loading phase, core execution phase, and termination phase, with the CPU utilization first exceeding the average value of the current execution, reaching the maximum value of 80%, and the CPU utilization being below the maximum value of 60% for ten consecutive sampling points as the phase boundaries. These phases are then labeled as the job lifecycle phases.

[0018] The historical execution time sequence data, the execution context vector, and the job lifecycle stage annotations are aligned and merged according to the sampling points to construct the structured historical dataset.

[0019] Optionally, in step S3, the structured historical dataset is grouped according to the job lifecycle stage and the execution context vector is clustered. The mean and standard deviation of each cluster subset are calculated to obtain the baseline parameter set of the context hierarchical stage. The cointegration relationship matrix is ​​obtained by calculating the historical cointegration relationship of each index, including:

[0020] The structured historical dataset is divided into four groups according to the startup phase, resource loading phase, core execution phase, and closing phase. The execution context vectors in each group are clustered using the K-Means algorithm. The number of clusters in each group is determined by grid search within a closed interval of silhouette coefficients from 2 to 6. The center vectors of each cluster are stored, and the arithmetic mean and standard deviation of each indicator in each cluster subset are calculated to obtain the baseline parameter set for the context hierarchical stage.

[0021] Based on the structured historical dataset of the core execution phase, Pearson correlation coefficients are calculated for each indicator pair. For indicator pairs with an absolute correlation coefficient of not less than 0.7, a linear regression model is established, the regression coefficients are fitted using the least squares method, and the residual standard deviation is recorded. All indicator pairs that meet the threshold, along with their regression coefficients and residual standard deviations, are stored in the cointegration matrix.

[0022] Optionally, in step S3, the mean and standard deviation of the nearest neighbor cluster subset in the baseline parameter set of the current execution context vector matching the context hierarchical stage are used as the context adaptive baseline, including:

[0023] During job execution, CPU usage is continuously collected at ten-second intervals. The current job lifecycle stage is marked in real time based on the stage boundary, and the current execution context vector is collected.

[0024] Based on the current execution context vector and the cluster center vectors of each cluster in the current stage of the context hierarchical stage baseline parameter set, calculate the Euclidean distance one by one, select the cluster subset corresponding to the cluster center with the smallest distance, and use the mean and standard deviation of the cluster subset as the context adaptive baseline.

[0025] Optionally, in step S3, the deviation of each indicator's current value relative to the context adaptive baseline and the deviation based on the cointegration matrix are calculated respectively, and the basic comprehensive risk value is obtained by weighting and fusing them according to the stage weights, including:

[0026] The absolute value of the difference between the current value of each indicator and the mean of the corresponding indicator in the context adaptive baseline is divided by the corresponding standard deviation to obtain the single indicator deviation of each indicator.

[0027] Based on the regression coefficients of each index pair in the cointegration relationship matrix, the current value of the index is substituted into the corresponding linear regression model to obtain the predicted value. The absolute value of the difference between the predicted value and the actual value is divided by the corresponding residual standard deviation to obtain the relationship deviation of each index pair.

[0028] The stage weights are defined as follows: 0.3 for the startup stage, 0.6 for the resource loading stage, 1.0 for the core execution stage, 1.5 for the execution time indicator in the closing stage, and 0.5 for the remaining indicators. The stage weighted average of the deviation of the single indicator and the stage weighted average of the deviation of the relationship are weighted and summed with coefficients of 0.6 and 0.4 respectively to obtain the basic comprehensive risk value.

[0029] Optionally, step S4 includes:

[0030] The execution progress ratio is obtained by dividing the execution time of the job by the historical average execution time.

[0031] Substituting the execution progress ratio into the piecewise risk acceleration function yields the risk acceleration coefficient α, whereby the piecewise risk acceleration function is:

[0032]

[0033] Where r is the execution progress ratio;

[0034] The comprehensive dynamic risk value is obtained by multiplying the risk acceleration coefficient by the basic comprehensive risk value.

[0035] The comprehensive dynamic risk value R is compared with the warning threshold. When the comprehensive dynamic risk value R satisfies 1.5≤R<2.0, a level attention warning is triggered; when it satisfies 2.0≤R<3.0, a level warning is triggered and the deviation details of each indicator are output; when R≥3.0, an emergency warning is triggered and the execution progress ratio, the basic comprehensive risk value, the top three indicators in terms of single indicator deviation, and the relationship deviation of each indicator pair are output simultaneously.

[0036] Secondly, this application provides an information system operation risk monitoring system based on historical behavior baselines, the information system operation risk monitoring system based on historical behavior baselines includes:

[0037] The extraction module is used to extract job feature vectors based on job metadata and associate a set of key performance indicators based on the job feature vectors.

[0038] The annotation module is used to collect historical execution time-series data of the set of key performance indicators, synchronously record execution context vectors and job lifecycle stage annotations, and construct a structured historical dataset.

[0039] The calculation module is used to group the structured historical dataset according to the job lifecycle stage and cluster the execution context vector. It calculates the mean and standard deviation of each cluster subset to obtain the context hierarchical stage baseline parameter set, and calculates the cointegration relationship matrix of each indicator with historical cointegration relationship. When the job is executed, the mean and standard deviation of the nearest neighbor cluster subset in the context hierarchical stage baseline parameter set matched with the current execution context vector are used as the context adaptive baseline. The current value of each indicator is calculated relative to the context adaptive baseline, and the deviation of the single indicator and the relationship based on the cointegration relationship matrix are calculated respectively. The basic comprehensive risk value is obtained by weighting and fusing according to the stage weight.

[0040] The triggering module is used to take the ratio of the execution time of the job to the historical average execution time as the execution progress ratio, substitute it into the segmented risk acceleration function to obtain the risk acceleration coefficient, multiply the risk acceleration coefficient by the basic comprehensive risk value to obtain the comprehensive dynamic risk value, and compare the comprehensive dynamic risk value with the warning threshold to trigger the warning.

[0041] The technical solution provided in this application solves the configuration burden problem of existing solutions that rely on manual specification of monitoring objects by automatically extracting seven-dimensional job feature vectors from the job metadata repository and associating them with a set of key performance indicators based on a type-indicator mapping rule table. This achieves fully automatic association from job profiles to monitoring indicator sets. During the historical data collection phase, the execution context vector and job lifecycle stage annotations are recorded synchronously to construct a structured historical dataset. This binds and stores the system resource environment status and performance indicator time-series data during job execution, breaking the inherent limitation of complete decoupling between the historical baseline and the execution environment in existing solutions. By grouping the structured historical dataset by lifecycle stage and performing K-Means clustering on the execution context vectors, the mean and standard deviation of each cluster subset are independently calculated to form a context hierarchical stage baseline parameter set. During job execution, the nearest neighbor cluster subset is matched using Euclidean distance to dynamically reconstruct the context adaptive baseline, ensuring that the baseline always corresponds to a historical baseline that is highly similar to the current execution environment. The system fundamentally eliminates systematic false alarms caused by environmental differences due to fixed historical baselines. It introduces a cointegration matrix based on Pearson correlation coefficient and least squares regression, and integrates the deviation of the relationship and the deviation of individual indicators with a two-layer weighted fusion according to stage weights to form a comprehensive risk value. This captures absolute deviations of individual indicators while identifying the disruption of cointegration relationships between indicators, effectively supplementing existing schemes that only make independent judgments on individual indicators. A segmented risk acceleration function is constructed based on the execution progress ratio. In the early stages of the operation, a coefficient less than 1 is used to suppress normal fluctuations; in the critical period, a quadratic function is used to amplify risk perception; and in the later stages, a linear high-slope is used to rapidly increase the comprehensive dynamic risk value, achieving the effect of dynamically adjusting the sensitivity of risk perception according to the progress of the operation. For new operations with insufficient historical execution counts, an operation family baseline migration mechanism based on the Euclidean distance of feature vectors is introduced. A correction coefficient controls the fusion ratio between the initial migration baseline and its own historical data, solving the monitoring blind spot problem of existing schemes in new operation scenarios.

[0042] The combined application of K-Means clustering and silhouette coefficient grid search enables the clustering granularity of the baseline parameter set in the context hierarchical stage to adapt to the actual distribution of historical data, rather than relying on manually preset fixed cluster numbers. The combination of Pearson correlation coefficient screening and least squares regression modeling ensures that the cointegration relationship matrix only includes statistically significant strongly correlated index pairs, avoiding interference from noise indices in the calculation of relationship deviation. The piecewise design of the piecewise risk acceleration function extends the impact of the execution progress ratio on the risk value from a linear relationship to a piecewise nonlinear mapping, enabling the comprehensive dynamic risk value to have response characteristics consistent with the actual risk evolution law at different execution stages. The organic combination of the above algorithms enables this invention to achieve substantial improvements in both monitoring accuracy and environmental adaptability in the specific application scenario of risk monitoring during information system operation, compared to existing solutions that simply rely on fixed thresholds or full historical average baselines. Attached Figure Description

[0043] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0044] Figure 1 This is a schematic diagram of an embodiment of the information system operation risk monitoring method based on historical behavior baselines in this application;

[0045] Figure 2 This is a schematic diagram comparing the CPU utilization deviation range of the fixed threshold baseline and the context adaptive baseline in the embodiments of this application. Detailed Implementation

[0046] This application provides a method and system for monitoring operational risks of an information system based on historical behavioral baselines. The terms "first," "second," "third," "fourth," etc. (if present) in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in a sequence other than that illustrated or described herein. Furthermore, the terms "comprising" or "having" and any variations thereof are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or device that includes a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or devices.

[0047] For ease of understanding, the specific process of the embodiments of this application is described below. Please refer to [link / reference]. Figure 1 One embodiment of the information system operation risk monitoring method based on historical behavior baselines in this application includes:

[0048] Step S1: Extract job feature vectors from job metadata and associate a set of key performance indicators based on the job feature vectors;

[0049] Specifically, the job feature vector consists of seven dimensions: job type code, data processing scale, scheduling cycle code, number of dependent jobs, historical average execution time, data source type code, and historical execution success rate. The values ​​for each dimension are directly readable fields from the job metadata repository, requiring no additional calculation. The job type code and data source type code are assigned using one-hot encoding. The data processing scale is taken as the base-10 logarithm of the average number of data rows processed in the last 30 historical executions to eliminate dimensional differences. Based on the combination key of the job type code and data source type code in this vector, a search is performed in a job type-metric mapping rule table pre-configured by operations personnel to obtain a set of key performance indicators. This set covers CPU utilization, memory usage, database connection count, SQL execution response time, disk I / O read / write throughput, and job execution time.

[0050] Step S2: Collect historical execution time-series data of key performance indicators, synchronously record execution context vectors and job lifecycle stage annotations, and construct a structured historical dataset;

[0051] Specifically, the execution context vector consists of five components: average system CPU load rate, average memory utilization rate, number of concurrent jobs, average disk I / O queue depth, and time segment code. All are averaged samples taken within 60 seconds before job startup. The 60-second window is set based on the assumption that system resource status tends to stabilize during this period, representing the actual load environment at job startup. The time segment code is assigned values ​​according to three categories: weekday peak hours, weekday off-peak hours, and holidays, reflecting the impact of business cycles on the overall system load pattern. Job lifecycle stages are automatically divided into four categories based on the slope change of the CPU utilization time-series curve: startup stage, resource loading stage, core execution stage, and termination stage. The boundaries of each stage are determined by the following criteria: CPU utilization first exceeding the current average, reaching the maximum value of 80%, or remaining below the maximum value of 60% for 10 consecutive sampling points. These 10 sampling points correspond to a 100-second continuous observation window, sufficient to eliminate interference from short-term fluctuations in stage division.

[0052] Step S3: Group the structured historical dataset according to the job lifecycle stage and cluster the execution context vectors. Calculate the mean and standard deviation of each cluster subset to obtain the context hierarchical stage baseline parameter set, and calculate the cointegration relationship matrix of each indicator with historical cointegration relationship. When the job is executed, use the mean and standard deviation of the nearest neighbor cluster subset in the context hierarchical stage baseline parameter set matched with the current execution context vector as the context adaptive baseline. Calculate the deviation of each indicator's current value relative to the context adaptive baseline and the deviation of the relationship based on the cointegration relationship matrix, and weight and fuse them according to the stage weight to obtain the basic comprehensive risk value.

[0053] Specifically, the construction process of the baseline parameter set for the context hierarchical stage is as follows: After grouping the structured historical dataset into four lifecycle stages, the execution context vectors within each group are clustered using the K-Means algorithm. The number of clusters is determined by grid search within the silhouette coefficient range of 2 to 6, and the number of clusters corresponding to the maximum silhouette coefficient is selected. This range balances the amount of historical data and the clustering granularity. The mean and standard deviation of each indicator within each cluster subset constitute the baseline parameters. The cointegration matrix is ​​built only based on the core execution stage data because the indicator behavior is most stable in this stage, and the linear relationship between indicators is most representative. Indicator pairs with an absolute correlation coefficient below 0.7 are not included in the matrix. 0.7 is the industry-recognized threshold for strong correlation; indicator pairs with a linear relationship below this value are unstable and do not meet the prerequisites for establishing a regression model. During job execution, the Euclidean distance between the current execution context vector and each cluster center is calculated. The mean and standard deviation of the nearest neighbor cluster subset are taken as the context adaptive baseline. This baseline is updated in real time as the life cycle stage switches. The deviation of a single indicator is the absolute value of the difference between the current value and the mean divided by the standard deviation. The deviation of a relationship is the absolute value of the difference between the current indicator and the actual value and the linear regression prediction value divided by the standard deviation of the residual. The two types of deviation reflect the absolute degree of deviation of a single indicator and the degree of destruction of the relationship between indicators, respectively.

[0054] Step S4: Use the ratio of the execution time of the job to the historical average execution time as the execution progress ratio, substitute it into the segmented risk acceleration function to obtain the risk acceleration coefficient, multiply the risk acceleration coefficient by the basic comprehensive risk value to obtain the comprehensive dynamic risk value, and compare the comprehensive dynamic risk value with the early warning threshold to trigger an early warning.

[0055] Specifically, the execution progress ratio is the ratio of the completed work time to the historical average execution time. The segmented risk acceleration function outputs a reduction coefficient less than 1 when the progress ratio is less than 0.5 to suppress normal fluctuations in the early stages. Between 0.5 and 0.8, the coefficient remains at 1.0 to maintain normal monitoring sensitivity. Between 0.8 and 1.0, the coefficient is amplified to 1.12 using a quadratic function to enhance the sensitivity of critical period warnings. Above 1.0, the coefficient increases linearly with a slope of 5.0, causing a sharp increase in the risk value of overdue work. All segmented parameter values ​​are determined through counterfactual backtesting of historical abnormal events. The comprehensive dynamic risk value is obtained by multiplying the risk acceleration coefficient by the basic comprehensive risk value. Warning thresholds are set at three levels: 1.5, 2.0, and 3.0, corresponding to attention level, warning level, and emergency level warnings, respectively. The criteria for these three threshold levels are: below 1.5, deviations are within the historical normal fluctuation range; between 1.5 and 2.0, mild anomalies require continuous monitoring; and above 3.0, the comprehensive risk has reached a level requiring immediate intervention.

[0056] In one specific embodiment, step S1 includes:

[0057] Extract job type code, data processing scale, scheduling cycle code, number of dependent jobs, historical average execution time, data source type code, and historical execution success rate from the job metadata repository to construct a job feature vector;

[0058] Based on the combined key of the job type code and the data source type code in the job feature vector, retrieve the corresponding set of key performance indicators in the job type-indicator mapping rule table;

[0059] When the historical execution count corresponding to the job feature vector is less than 30, calculate the Euclidean distance between the job feature vector and the job feature vectors of each established baseline in the job family library. Take the baseline parameter of the job family with the smallest distance as the initial migration baseline. Use the ratio of the historical execution count of the target job to the sum of the historical execution count of the target job and 30 as the correction coefficient. Combine the correction coefficient with the initial migration baseline to obtain the migration correction baseline.

[0060] Specifically, the job feature vector consists of seven dimensions. The job type code and data source type code are assigned using one-hot encoding. The data processing scale is taken as the base-10 logarithm of the average number of data rows processed in the last 30 historical executions to eliminate differences in units. The scheduling cycle code is assigned integer values ​​in the order of minutes, hours, days, weeks, and months. The number of dependent jobs is taken as the number of direct predecessor jobs of the job in the scheduling dependency chain. The historical average execution time is taken as the arithmetic mean of the execution times of the last 30 executions. The historical execution success rate is taken as the ratio of the number of successful executions to the total number of executions in the last 100 execution records. The job type-metric mapping rule table is pre-configured by operations and maintenance experts. It uses the combination key of the job type code and data source type code as an index to store the set of key performance indicators that need to be collected during the runtime of this type of job. Different combination keys correspond to different sets of indicators. For example, a data query relational database job corresponds to six indicators: CPU utilization, memory usage, number of database connections, SQL execution response time, disk I / O read / write throughput, and job execution time.

[0061] When the target job has been executed less than 30 times in the past, the amount of historical data is insufficient to support the independent establishment of a statistical baseline. 30 executions is the minimum sample size required for the baseline statistical parameters to stabilize; below this value, the confidence level of the statistical mean and standard deviation is insufficient. In this case, the Euclidean distance between the target job's feature vector and the feature vectors of each job with established baselines in the job family library is calculated. The job family library stores all jobs with the required number of historical executions and their baseline parameters. The job family with the smallest Euclidean distance is most similar to the target job in the feature space, and its baseline parameters are used as the initial baseline for migration. The correction coefficient is the ratio of the target job's own historical execution count to the sum of that count plus 30. When its own execution count is 0, the correction coefficient is 0, and the migration correction baseline is exactly equal to the initial migration baseline. As its own execution count increases, the correction coefficient approaches 1, and the migration correction baseline gradually converges to the target job's own statistical baseline. This design allows the baseline to dynamically transition with data accumulation, solving the monitoring blind spot problem when new jobs have no historical data.

[0062] In one specific embodiment, step S2 includes:

[0063] Collect historical execution time-series data of each indicator in the set of key performance indicators at a sampling interval of ten seconds;

[0064] Within sixty seconds before the start of each historically executed job, the average system CPU load rate, average memory usage rate, number of concurrent jobs, average disk I / O queue depth, and the current time period code are collected and combined into an execution context vector.

[0065] Based on the time-series changes in CPU utilization in historical execution time-series data, the sampling points are divided into startup phase, resource loading phase, core execution phase and closing phase, with the first time the CPU utilization exceeds the average value of the current execution, reaching the maximum value of 80%, and ten consecutive sampling points being below the maximum value of 60% as the phase boundaries, and are marked as job lifecycle phases.

[0066] Historical execution time sequence data, execution context vectors, and job lifecycle stage annotations are aligned and merged according to sampling points to construct a structured historical dataset.

[0067] Specifically, historical execution time-series data is collected at 10-second sampling intervals, capturing discrete time-series values ​​of each indicator in the key performance indicator set. This 10-second interval ensures real-time monitoring while avoiding data redundancy due to overly dense sampling, adapting to the performance change rates of most information system jobs. The five components of the execution context vector are all taken as the average of samples taken within 60 seconds before job startup. A 60-second window is sufficient to reflect the stable load state of system resources at the time of job startup; a window shorter than this is susceptible to instantaneous fluctuations. The time period coding is divided into three categories: peak hours on weekdays (value 1), off-peak hours on weekdays (value 2), and holidays (value 3). This three-category classification covers the main business cycle scenarios of information system job scheduling, enabling the context vector to perceive load patterns.

[0068] The division of job lifecycle stages is based on the slope changes of the CPU utilization time-series curve: the first time CPU utilization exceeds the average value of the current execution marks the end of the startup stage, at which point the job completes initialization and enters resource loading; when CPU utilization reaches 80% of the maximum value of the current execution, the resource loading stage ends, with 80% being an empirical threshold for the job to enter a stable high-load running state; when 10 consecutive sampling points are below 60% of the maximum value of the current execution, the core execution stage ends, with 10 sampling points corresponding to a 100-second continuous observation window to exclude misjudgments of stage switching due to brief fluctuations, and 60% being a typical level of CPU decline after the completion of core computing tasks; thereafter, the stage continues until job completion. The structured historical dataset merges historical execution time-series data, execution context vectors, and job lifecycle stage annotations, aligning and merging them by sampling timestamp. Each record contains the values ​​of each indicator at that moment, the stage number, and the corresponding execution context vector, forming a complete multidimensional dataset for subsequent grouping and modeling.

[0069] In one specific embodiment, in step S3, the structured historical dataset is grouped according to the job lifecycle stage and clustered by execution context vectors. The mean and standard deviation of each cluster subset are calculated to obtain the baseline parameter set for the context hierarchical stage, and the cointegration relationship matrix of each index with historical cointegration is calculated, including:

[0070] The structured historical dataset is divided into four groups according to the startup phase, resource loading phase, core execution phase and closing phase. The execution context vectors in each group are clustered using the K-Means algorithm. The number of clusters in each group is determined by grid search within the closed interval of silhouette coefficients from 2 to 6. The center vectors of each cluster are stored, and the arithmetic mean and standard deviation of each indicator in each cluster subset are calculated to obtain the baseline parameter set for the context hierarchical stage.

[0071] Based on the structured historical dataset of the core execution phase, Pearson correlation coefficients are calculated for each indicator pair. For indicator pairs with an absolute correlation coefficient of not less than 0.7, a linear regression model is established, the regression coefficients are fitted by the least squares method, and the residual standard deviation is recorded. All indicator pairs that meet the threshold, their regression coefficients, and residual standard deviations are stored in the cointegration matrix.

[0072] Specifically, after grouping the structured historical dataset into four lifecycle stages, the execution context vectors within each group serve as input to the K-Means algorithm. The K-Means algorithm iteratively updates the cluster centers with the goal of minimizing the sum of the Euclidean distances between each cluster center and the sample points within the group. The number of clusters is determined by a grid search within a closed interval of 2 to 6 for the silhouette coefficient, and the number of clusters maximizing the silhouette coefficient is taken as the final value. The lower limit of the search range of 2 ensures that the clusters are discriminative, while the upper limit of 6 is determined based on the number of effective environment combinations that can be formed by the five components of the execution context vector. Exceeding this range can easily lead to over-segmentation and insufficient sample size in each subset. The cluster center vectors of each cluster subset are stored separately for runtime matching. The arithmetic mean and standard deviation of each indicator within each subset together constitute the baseline parameter set for the context hierarchical stage.

[0073] The cointegration matrix is ​​built solely based on data from the core execution phase because this phase operates under stable, high-load conditions, resulting in the most stable linear relationships between indicators. Indicator values ​​in other phases are in a rapidly changing range, making their linear relationships unrepresentative. Pearson correlation coefficients are calculated for each indicator pair, with an absolute value of at least 0.7 used as the threshold for strong correlation. For indicator pairs meeting this threshold, one indicator is used as the independent variable and the other as the dependent variable. Linear regression coefficients are fitted using the least squares method, and the residual standard deviation is recorded. All indicator pairs meeting the threshold, along with their regression coefficients and residual standard deviations, are stored in the cointegration matrix as a reference benchmark for calculating runtime relationship deviations.

[0074] In one specific embodiment, step S3, using the mean and standard deviation of the nearest neighbor cluster subset in the baseline parameter set of the current execution context vector matching context hierarchical stage as the context adaptive baseline, includes:

[0075] During job execution, CPU usage is continuously collected at 10-second intervals. The current job lifecycle stage is marked in real time based on the stage boundary, and the current execution context vector is collected.

[0076] Based on the current execution context vector and the cluster center vectors of each cluster in the current stage of the context hierarchical stage baseline parameter set, calculate the Euclidean distance for each cluster center, select the cluster subset corresponding to the cluster center with the smallest distance, and use the mean and standard deviation of the cluster subset as the context adaptive baseline.

[0077] Specifically, during job execution, CPU utilization is continuously collected at 10-second intervals. This sampling interval is consistent with the historical data collection in step S2, ensuring that the runtime stage judgment logic and the offline stage annotation logic use the same time granularity, avoiding inconsistencies in stage boundary judgment results due to granularity differences. The current job lifecycle stage annotation is determined in real-time based on the stage boundary rules defined in step S2. The criteria for determining the current stage number are whether the CPU utilization first exceeds the average value of the current execution, whether it reaches 80% of the maximum value of the current execution, and whether 10 consecutive sampling points are below 60% of the maximum value of the current execution. The current execution context vector is collected 30 seconds after job startup. The collected content is completely consistent with the five components of the execution context vector in step S2, including the average system CPU load rate, average memory usage rate, number of concurrent jobs, average disk I / O queue depth, and time segment encoding. Each component is the average of the samples within the first 30 seconds after job startup. This 30-second window can be obtained after job initialization, balancing timeliness and stability.

[0078] After determining the current stage number, all cluster center vectors stored in this stage are extracted from the context hierarchical stage baseline parameter set. The Euclidean distance between the current execution context vector and each cluster center vector is calculated one by one. The Euclidean distance is the square root of the sum of the squares of the differences between the corresponding components of the two vectors. The smaller the distance, the more similar the current execution environment is to the historical execution environment represented by that cluster. The cluster subset corresponding to the cluster center with the smallest Euclidean distance is selected. The arithmetic mean and standard deviation of each indicator of this subset in the current stage are used as the context adaptive baseline. This baseline only contains statistical parameters of historical execution samples that are highly similar to the current execution environment. At each lifecycle stage switch, the above matching process is re-executed according to the new stage number, and the baseline content is updated to ensure that the baseline always corresponds to the combination of the current stage and the current environment.

[0079] Figure 2 This is a schematic diagram comparing the CPU utilization deviation range of a fixed threshold baseline and a context-adaptive baseline in an embodiment of this application. Figure 2 As shown, the horizontal axis represents the sampling time point (in 10 seconds), the vertical axis represents the CPU utilization rate, the solid line represents the actual value of the indicator, the dashed line represents the fixed threshold baseline, and the dotted line represents the context adaptive baseline. The fixed threshold baseline takes the static mean of all historical data. When the job indicator fluctuates periodically with the execution environment, it will produce a large area of ​​deviation (diagonal filled area) from the actual value. The context adaptive baseline, on the other hand, dynamically reconstructs the mean and standard deviation of the nearest neighbor cluster subset from the baseline parameter set of the context hierarchical stage based on the current execution context vector. It always gets close to the normal fluctuation center of the actual value of the indicator, so that the area of ​​the deviation (dotted filled area) is significantly smaller than the deviation area of ​​the fixed threshold baseline. Thus, it outputs a more accurate single indicator deviation under the same indicator fluctuation amplitude, avoiding false alarms caused by the decoupling of the baseline and the execution environment.

[0080] In one specific embodiment, step S3 involves calculating the single-indicator deviation and the relationship deviation based on the cointegration matrix for each indicator's current value relative to the context adaptive baseline, and then weighting and fusing them according to stage weights to obtain the basic comprehensive risk value, including:

[0081] The absolute value of the difference between the current value of each indicator and the mean of the corresponding indicator in the context adaptive baseline is divided by the corresponding standard deviation to obtain the single indicator deviation of each indicator.

[0082] Based on the regression coefficients of each indicator pair in the cointegration relationship matrix, the current value of the indicator is substituted into the corresponding linear regression model to obtain the predicted value. The absolute value of the difference between the predicted value and the actual value is divided by the corresponding residual standard deviation to obtain the relationship deviation of each indicator pair.

[0083] The stage weights are defined as follows: 0.3 for the startup stage, 0.6 for the resource loading stage, 1.0 for the core execution stage, 1.5 for the execution time indicator in the closing stage, and 0.5 for the other indicators. The stage weighted average of the deviation of the single indicator and the stage weighted average of the deviation of the relationship are weighted and summed with coefficients of 0.6 and 0.4 respectively to obtain the basic comprehensive risk value.

[0084] Specifically, the deviation of a single indicator is calculated by dividing the absolute value of the difference between the current value of each indicator and the mean of the corresponding indicator in the context adaptive baseline by the corresponding standard deviation. This calculation method is equivalent to standardized residuals, eliminating the influence of differences in the dimensions of different indicators on the comparison of deviation. The absolute value is used because the direction of deviation does not affect the risk assessment; only the magnitude of deviation determines the degree of risk. The deviation of a relationship uses the regression coefficients stored in the cointegration matrix as parameters. The actual value of the independent variable indicator at the current moment is substituted into the linear regression model to calculate the predicted value of the dependent variable indicator. Then, the absolute value of the difference between the actual value and the predicted value of the dependent variable indicator is divided by the standard deviation of the residuals. This calculation logic is consistent with the standardization method of the deviation of a single indicator. The standard deviation of the residuals is used as a divisor to make the expected value of the deviation of the relationship close to zero under the historical normal state. A significant increase in the deviation indicates that the cointegration relationship of the current indicator pair has been disrupted. The weighting of each stage is based on the following criteria: fluctuations in the startup stage are considered normal initialization behavior, so the weight is set at 0.3 to reduce the contribution of deviations in this stage to the risk value; the weighting of the resource loading stage is set at 0.6; the core execution stage is the main operating range of the operation, and the deviations in the indicators are the most representative of the risk, so the weighting is set at 1.0; in the closing stage, the timeout of the execution duration indicator directly reflects whether the operation has ended normally, so the weighting is set at 1.5, and the weighting of the remaining indicators is set at 0.5.

[0085] The deviation of each indicator is weighted according to the weight corresponding to the current stage and then averaged to obtain the stage-weighted average deviation of the single indicator. Similarly, the deviation of each indicator pair in the cointegration matrix is ​​weighted according to the arithmetic mean of the weights of the two indicators participating in that pair in the current stage and then averaged to obtain the stage-weighted average deviation of the relationship. The two are weighted and summed with coefficients of 0.6 and 0.4 respectively to obtain the basic comprehensive risk value. The allocation ratio of 0.6 and 0.4 is determined based on the backtesting results of historical abnormal events. Since the explanatory power of single indicator deviation is generally stronger than that of relationship deviation, it is given a higher weight. The sum of the two coefficients is 1.0 to ensure that the dimensions of the basic comprehensive risk value are consistent with those of the single indicator deviation and relationship deviation, facilitating direct comparison with the warning threshold.

[0086] In one specific embodiment, step S4 includes:

[0087] Divide the execution time of the task by the historical average execution time to obtain the execution progress ratio;

[0088] Substituting the execution progress ratio into the piecewise risk acceleration function yields the risk acceleration coefficient α, which is:

[0089]

[0090] Where r is the execution progress ratio;

[0091] Multiply the risk acceleration factor by the basic comprehensive risk value to obtain the comprehensive dynamic risk value;

[0092] The comprehensive dynamic risk value R is compared with the warning threshold. When the comprehensive dynamic risk value R meets the condition of 1.5≤R<2.0, a warning level warning is triggered; when it meets the condition of 2.0≤R<3.0, a warning level warning is triggered and the deviation details of each indicator are output; when R≥3.0, an emergency level warning is triggered and the execution progress ratio, the basic comprehensive risk value, the top three indicators in terms of single indicator deviation, and the relationship deviation of each indicator pair are output simultaneously.

[0093] Specifically, the execution progress ratio is the ratio of the job's executed time to the historical average execution time. The historical average execution time is taken from the corresponding component of the job's feature vector. This value is calculated during the modeling phase and is directly read during runtime. The segmented risk acceleration function divides the execution progress ratio range into four segments: When the progress ratio is less than 0.5, the job is in the early stage, and fluctuations in indicators are mostly normal resource initialization behavior. The acceleration coefficient is based on 0.5 and multiplied by 0.5 times the progress ratio, so that the acceleration coefficient linearly increases from 0.5 to 0.75 within the range of 0 to 0.5, applying a reduction of less than 1 to the basic comprehensive risk value to suppress early false alarms; when the progress ratio is between 0.5 and 0.8, the job is in a stable mid-term operation state, and the acceleration coefficient is taken as 1.0 without any adjustment. When the schedule ratio is between 0.8 and 1.0, the operation enters the critical period, increasing from 1.0 to 1.12 in the form of a quadratic function. The coefficient of the quadratic function is 3.0, which makes the acceleration coefficient accelerate smoothly within this range, avoiding abrupt changes in linear amplification near the critical point. When the schedule ratio is not lower than 1.0, the operation enters the overtime state, starting from 1.12 and increasing linearly with a slope of 5.0. The slope of 5.0 makes the risk value rise rapidly to the emergency warning range after the overtime. The parameters of each segment are determined by counterfactual backtesting calibration of historical abnormal events.

[0094] The risk acceleration coefficient is directly multiplied by the basic comprehensive risk value to obtain the comprehensive dynamic risk value. The multiplication structure ensures that the amplification effect of the acceleration coefficient on the risk value is proportional to the magnitude of the basic comprehensive risk value. The comprehensive dynamic risk value of high-risk operations increases more significantly during the critical period and beyond the critical period than that of low-risk operations. The three-level warning threshold is divided as follows: when it is below 1.5, the deviation of each indicator is within the normal historical fluctuation range and no warning is triggered; when the deviation is slight between 1.5 and 2.0, a level of attention warning is triggered and only logs are recorded; when the deviation is significant between 2.0 and 3.0, a level of warning warning is triggered and detailed deviation of each individual indicator is output to help maintenance personnel locate the source of the anomaly; when it is not lower than 3.0, the comprehensive risk reaches the level that requires immediate intervention, triggering an emergency warning and simultaneously outputting the execution progress ratio, basic comprehensive risk value, the top three indicators with the highest deviation of individual indicators, and the deviation of the relationship between each indicator pair, providing maintenance personnel with complete risk location information.

[0095] The above describes the information system operation risk monitoring method based on historical behavior baselines in the embodiments of this application. The following describes the information system operation risk monitoring system based on historical behavior baselines in the embodiments of this application. One embodiment of the information system operation risk monitoring system based on historical behavior baselines in the embodiments of this application includes:

[0096] The extraction module is used to extract job feature vectors based on job metadata and associate a set of key performance indicators based on the job feature vectors.

[0097] The annotation module is used to collect historical execution time-series data of the set of key performance indicators, synchronously record execution context vectors and job lifecycle stage annotations, and construct a structured historical dataset.

[0098] The calculation module is used to group the structured historical dataset according to the job lifecycle stage and cluster the execution context vector. It calculates the mean and standard deviation of each cluster subset to obtain the context hierarchical stage baseline parameter set, and calculates the cointegration relationship matrix of each indicator with historical cointegration relationship. When the job is executed, the mean and standard deviation of the nearest neighbor cluster subset in the context hierarchical stage baseline parameter set matched with the current execution context vector are used as the context adaptive baseline. The current value of each indicator is calculated relative to the context adaptive baseline, and the deviation of the single indicator and the relationship based on the cointegration relationship matrix are calculated respectively. The basic comprehensive risk value is obtained by weighting and fusing according to the stage weight.

[0099] The triggering module is used to take the ratio of the execution time of the job to the historical average execution time as the execution progress ratio, substitute it into the segmented risk acceleration function to obtain the risk acceleration coefficient, multiply the risk acceleration coefficient by the basic comprehensive risk value to obtain the comprehensive dynamic risk value, and compare the comprehensive dynamic risk value with the warning threshold to trigger the warning.

[0100] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for monitoring operational risks of an information system based on historical behavioral baselines, characterized in that, The method includes: Step S1: Extract job feature vectors based on job metadata, and associate a set of key performance indicators based on the job feature vectors; Step S2: Collect historical execution time-series data of the set of key performance indicators, synchronously record execution context vectors and job lifecycle stage annotations, and construct a structured historical dataset; Step S3: Group the structured historical dataset according to the job lifecycle stage and cluster the execution context vector. Calculate the mean and standard deviation for each cluster subset to obtain the context hierarchical stage baseline parameter set, and calculate the cointegration relationship matrix for each indicator against historical cointegration. During job execution, use the mean and standard deviation of the nearest neighbor cluster subset matched with the current execution context vector in the context hierarchical stage baseline parameter set as the context adaptive baseline. Calculate the single indicator deviation and the relationship deviation based on the cointegration relationship matrix for each indicator's current value relative to the context adaptive baseline, and weight and fuse them according to stage weights to obtain the basic comprehensive risk value. Step S4: Take the ratio of the execution time of the job to the historical average execution time as the execution progress ratio, substitute it into the segmented risk acceleration function to obtain the risk acceleration coefficient, multiply the risk acceleration coefficient by the basic comprehensive risk value to obtain the comprehensive dynamic risk value, and compare the comprehensive dynamic risk value with the warning threshold to trigger the warning.

2. The information system operation risk monitoring method based on historical behavioral baselines according to claim 1, characterized in that, Step S1 includes: Extract job type code, data processing scale, scheduling cycle code, number of dependent jobs, historical average execution time, data source type code, and historical execution success rate from the job metadata repository to construct the job feature vector; Based on the combined key of the job type code and the data source type code in the job feature vector, the corresponding set of key performance indicators is retrieved in the job type-indicator mapping rule table; When the historical execution count corresponding to the job feature vector is less than 30, calculate the Euclidean distance between the job feature vector and the job feature vectors of each established baseline in the job family library. Take the baseline parameter of the job family with the smallest distance as the initial migration baseline. Use the ratio of the historical execution count of the target job to the sum of the historical execution count of the target job and 30 as the correction coefficient. Combine the correction coefficient with the initial migration baseline to obtain the migration correction baseline.

3. The information system operation risk monitoring method based on historical behavioral baselines according to claim 1, characterized in that, Step S2 includes: Historical execution time-series data of each indicator in the set of key performance indicators are collected at a sampling interval of ten seconds. Within sixty seconds before the start of each historically executed job, the average system CPU load rate, average memory usage rate, number of concurrent jobs, average disk I / O queue depth, and the current time period code are collected and combined to form the execution context vector. Based on the time-series changes in CPU utilization in the historical execution time-series data, the sampling points are divided into the startup phase, resource loading phase, core execution phase, and termination phase, with the CPU utilization first exceeding the average value of the current execution, reaching the maximum value of 80%, and the CPU utilization being below the maximum value of 60% for ten consecutive sampling points as the phase boundaries. These phases are then labeled as the job lifecycle phases. The historical execution time sequence data, the execution context vector, and the job lifecycle stage annotations are aligned and merged according to the sampling points to construct the structured historical dataset.

4. The information system operation risk monitoring method based on historical behavioral baselines according to claim 1, characterized in that, In step S3, the structured historical dataset is grouped according to the job lifecycle stage and the execution context vector is clustered. The mean and standard deviation of each cluster subset are calculated to obtain the baseline parameter set of the context hierarchical stage. The cointegration relationship matrix is ​​obtained by calculating the historical cointegration relationship of each indicator, including: The structured historical dataset is divided into four groups according to the startup phase, resource loading phase, core execution phase, and closing phase. The execution context vectors in each group are clustered using the K-Means algorithm. The number of clusters in each group is determined by grid search within a closed interval of silhouette coefficients from 2 to 6. The center vectors of each cluster are stored, and the arithmetic mean and standard deviation of each indicator in each cluster subset are calculated to obtain the baseline parameter set for the context hierarchical stage. Based on the structured historical dataset of the core execution phase, Pearson correlation coefficients are calculated for each indicator pair. For indicator pairs with an absolute correlation coefficient of not less than 0.7, a linear regression model is established, the regression coefficients are fitted using the least squares method, and the residual standard deviation is recorded. All indicator pairs that meet the threshold, along with their regression coefficients and residual standard deviations, are stored in the cointegration matrix.

5. The information system operation risk monitoring method based on historical behavioral baselines according to claim 4, characterized in that, In step S3, the mean and standard deviation of the nearest neighbor cluster subset in the baseline parameter set of the current execution context vector matching the context hierarchical stage are used as the context adaptive baseline, including: During job execution, CPU usage is continuously collected at ten-second intervals. The current job lifecycle stage is marked in real time based on the stage boundary, and the current execution context vector is collected. Based on the current execution context vector and the cluster center vectors of each cluster in the current stage of the context hierarchical stage baseline parameter set, calculate the Euclidean distance one by one, select the cluster subset corresponding to the cluster center with the smallest distance, and use the mean and standard deviation of the cluster subset as the context adaptive baseline.

6. The information system operation risk monitoring method based on historical behavioral baselines according to claim 5, characterized in that, In step S3, the deviation of each indicator's current value relative to the context adaptive baseline and the deviation based on the cointegration matrix are calculated separately, and then weighted and fused according to stage weights to obtain the basic comprehensive risk value, including: The absolute value of the difference between the current value of each indicator and the mean of the corresponding indicator in the context adaptive baseline is divided by the corresponding standard deviation to obtain the single indicator deviation of each indicator. Based on the regression coefficients of each index pair in the cointegration relationship matrix, the current value of the index is substituted into the corresponding linear regression model to obtain the predicted value. The absolute value of the difference between the predicted value and the actual value is divided by the corresponding residual standard deviation to obtain the relationship deviation of each index pair. The stage weights are defined as follows: 0.3 for the startup stage, 0.6 for the resource loading stage, 1.0 for the core execution stage, 1.5 for the execution time indicator in the closing stage, and 0.5 for the remaining indicators. The stage weighted average of the deviation of the single indicator and the stage weighted average of the deviation of the relationship are weighted and summed with coefficients of 0.6 and 0.4 respectively to obtain the basic comprehensive risk value.

7. The information system operation risk monitoring method based on historical behavioral baselines according to claim 1, characterized in that, Step S4 includes: The execution progress ratio is obtained by dividing the execution time of the job by the historical average execution time. Substituting the execution progress ratio into the piecewise risk acceleration function yields the risk acceleration coefficient α, whereby the piecewise risk acceleration function is: Where r is the execution progress ratio; The comprehensive dynamic risk value is obtained by multiplying the risk acceleration coefficient by the basic comprehensive risk value. The comprehensive dynamic risk value R is compared with the warning threshold. When the comprehensive dynamic risk value R satisfies 1.5≤R<2.0, a level attention warning is triggered; when it satisfies 2.0≤R<3.0, a level warning is triggered and the deviation details of each indicator are output; when R≥3.0, an emergency warning is triggered and the execution progress ratio, the basic comprehensive risk value, the top three indicators in terms of single indicator deviation, and the relationship deviation of each indicator pair are output simultaneously.

8. An information system operation risk monitoring system based on historical behavioral baselines, characterized in that, For implementing the information system operation risk monitoring method based on historical behavior baselines as described in any one of claims 1-7, the information system operation risk monitoring system based on historical behavior baselines comprises: The extraction module is used to extract job feature vectors based on job metadata and associate a set of key performance indicators based on the job feature vectors. The annotation module is used to collect historical execution time-series data of the set of key performance indicators, synchronously record execution context vectors and job lifecycle stage annotations, and construct a structured historical dataset. The calculation module is used to group the structured historical dataset according to the job lifecycle stage and cluster the execution context vector. It calculates the mean and standard deviation of each cluster subset to obtain the context hierarchical stage baseline parameter set, and calculates the cointegration relationship matrix of each indicator with historical cointegration relationship. When the job is executed, the mean and standard deviation of the nearest neighbor cluster subset in the context hierarchical stage baseline parameter set matched with the current execution context vector are used as the context adaptive baseline. The current value of each indicator is calculated relative to the context adaptive baseline, and the deviation of the single indicator and the relationship based on the cointegration relationship matrix are calculated respectively. The basic comprehensive risk value is obtained by weighting and fusing according to the stage weight. The triggering module is used to take the ratio of the execution time of the job to the historical average execution time as the execution progress ratio, substitute it into the segmented risk acceleration function to obtain the risk acceleration coefficient, multiply the risk acceleration coefficient by the basic comprehensive risk value to obtain the comprehensive dynamic risk value, and compare the comprehensive dynamic risk value with the warning threshold to trigger the warning.

9. The information system operation risk monitoring system based on historical behavioral baselines according to claim 8, characterized in that, Extract job feature vectors from job metadata, and associate a set of key performance indicators based on the job feature vectors, including: Extract job type code, data processing scale, scheduling cycle code, number of dependent jobs, historical average execution time, data source type code, and historical execution success rate from the job metadata repository to construct the job feature vector; Based on the combined key of the job type code and the data source type code in the job feature vector, the corresponding set of key performance indicators is retrieved in the job type-indicator mapping rule table; When the historical execution count corresponding to the job feature vector is less than 30, calculate the Euclidean distance between the job feature vector and the job feature vectors of each established baseline in the job family library. Take the baseline parameter of the job family with the smallest distance as the initial migration baseline. Use the ratio of the historical execution count of the target job to the sum of the historical execution count of the target job and 30 as the correction coefficient. Combine the correction coefficient with the initial migration baseline to obtain the migration correction baseline.

10. The information system operation risk monitoring system based on historical behavioral baselines according to claim 9, characterized in that, Collect historical execution time-series data of the aforementioned key performance indicator set, synchronously record execution context vectors and job lifecycle stage annotations, and construct a structured historical dataset, including: Historical execution time-series data of each indicator in the set of key performance indicators are collected at a sampling interval of ten seconds. Within sixty seconds before the start of each historically executed job, the average system CPU load rate, average memory usage rate, number of concurrent jobs, average disk I / O queue depth, and the current time period code are collected and combined to form the execution context vector. Based on the time-series changes in CPU utilization in the historical execution time-series data, the sampling points are divided into the startup phase, resource loading phase, core execution phase, and termination phase, with the CPU utilization first exceeding the average value of the current execution, reaching the maximum value of 80%, and the CPU utilization being below the maximum value of 60% for ten consecutive sampling points as the phase boundaries. These phases are then labeled as the job lifecycle phases. The historical execution time sequence data, the execution context vector, and the job lifecycle stage annotations are aligned and merged according to the sampling points to construct the structured historical dataset.

Images