An adaptive data probe-based whole-process intelligent supervision method and system

Abstract

The application provides a full-process intelligent supervision method and system based on an adaptive data probe, the method comprising deploying an adaptive data probe driven by an AI large model and having plug-in type extension capability, adapting multiple scenes of physical machines, virtual machines, containers, microservices and Java application clusters in combination with Java agent technology; realizing non-invasive access through the Java agent technology, dynamically adjusting a collection strategy by the AI large model, completing full-link data collection of hosts, applications and networks; after pre-processing the collected data, intelligently analyzing the data by the AI large model, identifying system faults, performance bottlenecks and network security risks, generating early warning information and executing disposal operations, feeding back the results to a terminal platform and forming a full-process intelligent supervision closed loop. The application realizes non-invasive adaptive supervision in multiple scenes, has plug-in type hot plug extension capability, significantly improves supervision efficiency, flexibility and data integrity and reduces development and maintenance costs.

Description

Technical Field

[0001] This invention belongs to the technical field of network security supervision, specifically relating to a full-process intelligent supervision method and system based on adaptive data probes. Background Technology

[0002] With the rapid development of information technology, IT architecture is becoming increasingly diversified and complex. The coexistence of multiple scenarios, including physical machines, virtual machines, containers, microservices, and Java application clusters, has become the norm, making the need for oversight of hosts, applications, and networks increasingly urgent. Currently, existing oversight technologies generally have many limitations and are insufficient to meet the requirements for comprehensive, non-intrusive, and adaptive oversight.

[0003] For example, traditional monitoring systems use fixed-configuration data collection tools that lack adaptability and cannot dynamically adjust collection strategies based on different scenarios (such as resource differences between physical machines and containers, and the operational characteristics of Java applications and microservices). This results in low collection efficiency, data redundancy, or missing critical data. Most data collection tools require the deployment of intrusive plugins on the monitored objects, which not only consumes system resources and affects the performance of the monitored system but may also introduce security risks. At the same time, existing monitoring tools lack plug-in extensibility. When new monitoring dimensions (such as new network security indicators or application performance indicators) are needed, the entire system must be reconstructed, resulting in high development costs and long development cycles.

[0004] Furthermore, existing regulatory technologies largely rely on manual configuration and analysis, lacking AI-driven automation capabilities. This prevents the realization of intelligent data collection, analysis, early warning, and handling throughout the entire process, resulting in delayed regulatory responses and difficulty in quickly identifying potential system failures, performance bottlenecks, and security risks. Simultaneously, for end-to-end data collection from hosts and applications, existing technologies have failed to effectively integrate Java proxy technology, hindering non-intrusive end-to-end data capture and leading to incomplete regulatory data that is insufficient to support end-to-end regulatory decision-making.

[0005] Therefore, how to provide a non-intrusive, adaptive, and intelligent monitoring system and method applicable to multiple scenarios and the entire process, and solve the problems of low collection efficiency, high intrusiveness, poor scalability, insufficient intelligence and incomplete data collection in the existing technology, has become an urgent technical challenge to be solved. Summary of the Invention

[0006] To address the aforementioned technical challenges, this invention proposes a full-process intelligent supervision method and system based on adaptive data probes. This method can significantly improve the scenario adaptability of the supervision system, reduce invasiveness, enhance scalability, and achieve intelligent supervision throughout the entire process.

[0007] In a first aspect, the present invention provides the following technical solution: a full-process intelligent monitoring method based on adaptive data probes, comprising: Deploy an adaptive data probe with pluggable extensibility. The adaptive data probe is driven by a large AI model and combined with Java proxy technology to adapt to multiple scenarios such as physical machines, virtual machines, containers, microservices, and Java application clusters. The Java proxy technology enables non-intrusive access to the monitored object. The AI ​​big model drives the adaptive data probe to dynamically adjust the collection strategy, which includes collection frequency, collection indicators and collection range, to complete the full-link data collection of the host, application and network. The collected end-to-end data is preprocessed, and the preprocessed data is intelligently analyzed using an AI big data model to identify system faults, performance bottlenecks and network security risks, and generate analysis results and early warning information. Based on the analysis results and early warning information, corresponding regulatory actions are taken, and the regulatory results are fed back to the terminal regulatory platform to achieve a closed-loop intelligent regulatory process.

[0008] Compared with existing technologies, the beneficial effects of this invention are as follows: By deploying an adaptive data probe driven by an AI large model and possessing pluggable extensibility, combined with Java proxy technology, this invention achieves non-intrusive end-to-end data collection of hosts, applications, and networks in multiple scenarios; by dynamically adjusting the collection strategy through the AI ​​large model, it improves collection efficiency and data accuracy; by leveraging the pluggable architecture, it reduces system expansion costs and enables flexible expansion of regulatory dimensions; through intelligent analysis, early warning, and handling throughout the entire process, it forms a regulatory closed loop, solving the problems of poor adaptability, strong intrusiveness, insufficient extensibility, and low intelligence level of existing regulatory technologies, and significantly improving regulatory efficiency and reliability.

[0009] Preferably, the step of deploying the adaptive data probe with pluggable scalability includes: An adaptive data probe with a plug-in architecture is constructed. The adaptive data probe includes a core driver module and an extensible plug-in module. The extensible plug-in module supports the addition of new acquisition plug-ins, analysis plug-ins and processing plug-ins. The plug-ins are deployed in a hot-swappable manner. Based on the type of the regulated scenario, configure corresponding basic plugins for the adaptive data probe. The basic plugins include host data acquisition plugin, application data acquisition plugin, and network data acquisition plugin. The adaptive data probe is integrated with a Java agent module that uses bytecode enhancement technology to achieve non-intrusive interception of the monitored Java application and capture full-link data during application runtime.

[0010] Preferably, the step of dynamically adjusting the acquisition strategy of the adaptive data probe driven by the AI ​​large model includes: By analyzing historical regulatory data, operational status data of regulated entities, and current regulatory needs through AI big data models, the optimal data collection strategy for the current scenario can be determined. When the operational status of the monitored object changes, the AI ​​big data model adjusts the collection frequency and collection indicators in real time to collect abnormal data. When new regulatory requirements arise, the AI ​​big model can automatically adapt to the new collection indicators and analysis logic by deploying corresponding extension plugins, without requiring modifications to the core probe architecture.

[0011] Preferably, the step of achieving non-intrusive access to the monitored object through the Java proxy technology includes: Injecting a Java proxy module into the runtime environment of the monitored Java application allows for the interception of the application's method calls, data transfers, and resource access behaviors through bytecode enhancement technology, without modifying the application's source code. The Java proxy module captures end-to-end data during application runtime, including method call chain, parameter passing, return results, exception information, and resource usage. The captured data is then transmitted to the adaptive data probe in real time. For non-Java class monitored objects, adaptive data probes access the system via a non-intrusive protocol to collect corresponding host resource data and runtime status data.

[0012] Preferably, the step of preprocessing the collected end-to-end data includes: The collected end-to-end data is then cleaned, deduplicated, standardized, and anonymized.

[0013] Preferably, the step of intelligently analyzing the preprocessed data using a large AI model includes: The AI ​​large model is based on a trained algorithm model and performs real-time analysis on pre-processed data. The analysis process includes performance anomaly identification, fault diagnosis, and security risk detection. When an anomaly is detected, the AI ​​big data model automatically generates corresponding early warning information based on the anomaly level, clarifying the anomaly type, location, and scope of impact. By combining historical data with trend analysis, potential system failures and performance bottlenecks can be predicted and early warnings can be issued.

[0014] Preferably, the steps for performing the corresponding regulatory action include: Based on the level of the warning information, the preset handling strategy is automatically executed. The handling strategy includes alarm notification, resource scheduling, fault recovery, and risk isolation. It supports manual intervention. After receiving the early warning information and analysis results, the terminal monitoring platform allows managers to manually issue disposal instructions and carry out corresponding processing operations.

[0015] Secondly, the present invention provides the following technical solution: a full-process intelligent monitoring system based on adaptive data probes, the system comprising: The deployment module is used to deploy adaptive data probes with pluggable extensibility. The adaptive data probes are driven by a large AI model and combined with Java proxy technology to adapt to multiple scenarios such as physical machines, virtual machines, containers, microservices, and Java application clusters. The access module is used to achieve non-intrusive access to the monitored object through the Java proxy technology. The AI ​​big model drives the adaptive data probe to dynamically adjust the collection strategy. The collection strategy includes collection frequency, collection indicators and collection range, and completes the full-link data collection of the host, application and network. The analysis module is used to preprocess the collected end-to-end data, and to perform intelligent analysis on the preprocessed data through a large AI model to identify system faults, performance bottlenecks and network security risks, and generate analysis results and early warning information. The monitoring module is used to execute corresponding monitoring and handling operations based on the analysis results and early warning information, and to feed the monitoring results back to the terminal monitoring platform to achieve a closed-loop intelligent monitoring process.

[0016] Thirdly, the present invention provides the following technical solution: a computer, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the above-described intelligent monitoring method for the entire process based on adaptive data probes.

[0017] Fourthly, the present invention provides the following technical solution: a storage medium storing a computer program, wherein when the computer program is executed by a processor, it implements the above-described intelligent monitoring method for the entire process based on adaptive data probes. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 A flowchart of the end-to-end intelligent monitoring method based on adaptive data probes provided in Embodiment 1 of the present invention; Figure 2This is a schematic diagram of the tunnel entrance simulation data acquisition system provided in Embodiment 1 of the present invention; Figure 3 This is a schematic diagram of the hardware structure of a computer provided for another embodiment of the present invention.

[0020] The embodiments of the present invention will be further described below with reference to the accompanying drawings. Detailed Implementation

[0021] Embodiments of the present invention are described in detail below, examples of which are illustrated in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain embodiments of the present invention, and should not be construed as limiting the present invention.

[0022] Example 1 In Embodiment 1 of the present invention, as Figure 1 As shown, a full-process intelligent monitoring method based on adaptive data probes includes: S1. Deploy an adaptive data probe with pluggable extensibility. The adaptive data probe is driven by an AI large model and combined with Java proxy technology to adapt to multiple scenarios such as physical machines, virtual machines, containers, microservices, and Java application clusters. The step of deploying the adaptive data probe with pluggable scalability includes: An adaptive data probe with a plug-in architecture is constructed. The adaptive data probe includes a core driver module and an extensible plug-in module. The extensible plug-in module supports the addition of new acquisition plug-ins, analysis plug-ins and processing plug-ins. The plug-ins are deployed in a hot-swappable manner. Based on the type of the regulated scenario, configure corresponding basic plugins for the adaptive data probe. The basic plugins include host data acquisition plugin, application data acquisition plugin, and network data acquisition plugin. The adaptive data probe is integrated with a Java agent module that uses bytecode enhancement technology to achieve non-intrusive interception of the monitored Java application and capture full-link data during application runtime.

[0023] Specifically, this embodiment is mainly used for intelligent monitoring of the entire process of diversified IT architectures, covering various scenarios such as physical machines, virtual machines, containers, microservices, and Java application clusters, to achieve non-intrusive and adaptive monitoring of hosts, applications, and networks. In existing technologies, monitoring tools are mostly designed for single scenarios, have poor adaptability, and lack flexible scalability, failing to meet the monitoring needs of complex IT architectures. This embodiment effectively solves this problem through a plug-in architecture and multi-scenario adaptability design.

[0024] In this embodiment, an adaptive data probe with a plug-in architecture is first constructed. This probe includes a core driver module and an extensible plug-in module. The core driver module is responsible for coordinating the operation of each plug-in, while the extensible plug-in module supports hot-swapping deployment of collection plug-ins, analysis plug-ins, and disposal plug-ins, allowing plug-ins to be added, upgraded, and uninstalled without stopping the probe. Based on the type of monitored scenario, corresponding basic plug-ins are configured for the probe. For example, for physical machines and virtual machines, a host data collection plug-in (for collecting resource data such as CPU, memory, disk, and network) is configured; for Java applications and microservices, an application data collection plug-in (for collecting application running status, method calls, and exception information) is configured; and for the network layer, a network data collection plug-in (for collecting network bandwidth, latency, and packet loss rate) is configured. This probe adopts a unified interface specification, including plug-in identifier, applicable scenarios, input parameters, output data structure, resource consumption limit, start method, stop method, and exception callback method.

[0025] Simultaneously, the adaptive data probe is integrated with the Java agent module. The Java agent module employs bytecode enhancement technology, allowing it to be injected into the application's runtime environment without modifying the source code of the monitored Java application. This enables non-intrusive interception of the application, laying the foundation for subsequent end-to-end data collection. For non-Java monitored objects (such as physical machines, virtual machines, and containers), the probe accesses via non-intrusive protocols such as SSH, SNMP, and Docker API, avoiding the performance impact and security risks associated with intrusive deployment.

[0026] S2. Non-intrusive access to the monitored object is achieved through the Java proxy technology. The AI ​​big model drives the adaptive data probe to dynamically adjust the collection strategy. The collection strategy includes collection frequency, collection indicators and collection range, to complete the full-link data collection of the host, application and network. Specifically, after the adaptive data probe is deployed, it collects basic environmental information of the monitored object, such as operating system type, runtime type, container identifier, application port, Java Virtual Machine parameters, service registration information, and network connection characteristics. The AI ​​large model driving module calls a meta-learning-based cross-scenario probe plugin automatic adaptation algorithm to identify whether the current object belongs to one or more combinations of physical machines, virtual machines, containers, microservices, or Java application clusters, and automatically selects the corresponding plugin combination and initialization parameters.

[0027] The step of achieving non-intrusive access to the monitored object through the Java proxy technology includes: Injecting a Java proxy module into the runtime environment of the monitored Java application allows for the interception of the application's method calls, data transfers, and resource access behaviors through bytecode enhancement technology, without modifying the application's source code. The Java proxy module captures end-to-end data during application runtime, including method call chain, parameter passing, return results, exception information, and resource usage. The captured data is then transmitted to the adaptive data probe in real time. For non-Java class monitored objects, adaptive data probes access the system via a non-intrusive protocol to collect corresponding host resource data and runtime status data.

[0028] The step of dynamically adjusting the acquisition strategy of the adaptive data probe driven by the AI ​​large model includes: By analyzing historical regulatory data, operational status data of regulated entities, and current regulatory needs through AI big data models, the optimal data collection strategy for the current scenario can be determined. When the operational status of the monitored object changes, the AI ​​big data model adjusts the collection frequency and collection indicators in real time to collect abnormal data. When new regulatory requirements arise, the AI ​​big model can automatically adapt to the new collection indicators and analysis logic by deploying corresponding extension plugins, without requiring modifications to the core probe architecture.

[0029] For Java applications and microservices, after the Java proxy module is injected into the application runtime environment, it intercepts the application's method calls, data transmission, resource access, and other behaviors through bytecode enhancement technology. This captures end-to-end data during application runtime, including method call chains, parameter passing, return results, exception information, and resource usage, and transmits this data in real time to the adaptive data probe. For non-Java objects such as physical machines, virtual machines, and containers, the probe accesses via a non-intrusive protocol to collect host resource data (CPU utilization, memory usage, disk space, process information, etc.), container runtime data (container status, resource allocation, image information, etc.), and network data (bandwidth usage, network latency, packet loss rate, number of connections, etc.). In other words, for Java applications, the Java proxy module is loaded with application startup parameters or by attaching at runtime. It intercepts target classes and methods through bytecode enhancement, collecting method call chains, input parameter summaries, return status, exception stacks, interface execution time, thread status, and resource access behavior. For non-Java objects, a non-intrusive collection channel is established through SSH, SNMP, Docker API, Kubernetes API, or log interfaces to collect data such as host resources, container status, process status, network connectivity, bandwidth, latency, and packet loss rate.

[0030] As the core driver of the adaptive data probe, the AI ​​big data model dynamically adjusts its data collection strategy by analyzing historical regulatory data, real-time operational status data of regulated entities, and current regulatory needs. For example, when the regulated entity is operating normally, a lower collection frequency is used to collect core indicators, reducing resource consumption. When the regulated entity exhibits anomalies (such as a sudden increase in CPU utilization, excessive memory usage, or increased network latency), the AI ​​big data model automatically increases the collection frequency and expands the collection scope, focusing on collecting indicator data related to the anomaly to provide sufficient data support for subsequent analysis. When new regulatory needs are added (such as new cybersecurity vulnerability detection indicators), the AI ​​big data model automatically adapts to the new collection indicators and logic by deploying corresponding extension plugins, without requiring modifications to the probe's core architecture, thus achieving flexible expansion of regulatory dimensions.

[0031] Meanwhile, the AI-driven large-scale model module receives real-time operational data, historical regulatory data, and current regulatory requirements from the regulated entities. It then invokes a multi-dimensional load-aware dynamic data collection strategy and adaptive scheduling algorithm to calculate the optimal collection frequency, indicator granularity, and sampling rate. For example, when business operations are stable, core indicators are collected at a lower frequency; when the probability of anomalies increases, the collection frequency of related links, hosts, and network indicators is increased; and when business resources are strained, the collection frequency of low-value indicators is reduced to ensure priority business operations.

[0032] S3. Preprocess the collected end-to-end data, and use AI big data models to intelligently analyze the preprocessed data to identify system faults, performance bottlenecks and network security risks, and generate analysis results and early warning information. The preprocessing process includes: The collected end-to-end data is then cleaned, deduplicated, standardized, and anonymized.

[0033] The step of intelligently analyzing the preprocessed data using a large AI model includes: The AI ​​large model is based on a trained algorithm model and performs real-time analysis on pre-processed data. The analysis process includes performance anomaly identification, fault diagnosis, and security risk detection. When an anomaly is detected, the AI ​​big data model automatically generates corresponding early warning information based on the anomaly level, clarifying the anomaly type, location, and scope of impact. By combining historical data with trend analysis, potential system failures and performance bottlenecks can be predicted and early warnings can be issued.

[0034] Because the collected end-to-end data comes from different types of regulated entities, the data formats are inconsistent (such as JSON, XML, log formats, etc.), and there may be redundant and abnormal data (such as missing or erroneous values). Therefore, data preprocessing is necessary. Specifically, the collected data is first cleaned to remove invalid, erroneous, and missing data, and abnormal data is repaired. Then, deduplication is performed to delete duplicate data and avoid data redundancy. Finally, the data in different formats is standardized into a unified data format to facilitate subsequent intelligent analysis and processing. Simultaneously, the standardized data undergoes anonymization to hide sensitive information (such as account passwords and private data) to ensure data security and comply with cybersecurity regulatory requirements.

[0035] The AI ​​big data model, based on pre-trained algorithm models (such as deep learning models and machine learning models), performs real-time analysis on pre-processed end-to-end data. On one hand, it monitors the operational status of hosts, applications, and networks, identifying performance anomalies (such as high CPU utilization, memory leaks, and network bandwidth saturation) and system failures (such as application crashes, service outages, and network interruptions), and diagnoses the causes and scope of impact of these failures. On the other hand, it detects network security risks, identifying security vulnerabilities such as malicious attacks, abnormal access, and data leaks.

[0036] When the AI ​​big data model identifies anomalies, it automatically generates corresponding early warning information based on the severity of the anomaly (e.g., general anomaly, severe anomaly, emergency anomaly), clearly identifying the anomaly type, location, scope of impact, and handling suggestions, and transmits the early warning information to the regulatory response module in real time. Simultaneously, the AI ​​big data model combines historical regulatory data to perform trend analysis, predicting potential system failures and performance bottlenecks, issuing early warnings, and achieving early risk assessment.

[0037] S4. Based on the analysis results and early warning information, execute the corresponding regulatory actions and feed the regulatory results back to the terminal regulatory platform to achieve a closed-loop intelligent regulatory process.

[0038] The steps for performing the corresponding regulatory actions include: Based on the level of the warning information, the preset handling strategy is automatically executed. The handling strategy includes alarm notification, resource scheduling, fault recovery, and risk isolation. It also supports manual intervention. After receiving the early warning information and analysis results, the terminal monitoring platform allows managers to manually issue disposal instructions and carry out corresponding processing operations.

[0039] After receiving the analysis results and early warning information generated by the AI ​​big data model, the monitoring and handling module automatically executes preset handling strategies based on the early warning level. For example, for general anomalies, an alarm notification is sent to administrators; for severe anomalies, resource scheduling is automatically performed (such as increasing server resources and adjusting load balancing); for emergency anomalies, fault recovery (such as restarting the application and isolating risky nodes) or risk isolation operations are performed to prevent the risk from spreading. Simultaneously, manual intervention is supported. The terminal monitoring platform displays the analysis results, early warning information, and handling status in real time, and administrators can manually issue handling instructions, achieving a combination of automated handling and manual intervention.

[0040] After the disposal is completed, the regulatory disposal module will feed back the regulatory results (such as disposal method, disposal effect, and whether the anomaly has been resolved) to the terminal regulatory platform, forming a closed loop of intelligent supervision throughout the entire process of "collection-preprocessing-analysis-early warning-disposal-feedback" to ensure the continuity and effectiveness of regulatory work.

[0041] Meanwhile, the regulatory handling module feeds back the handling method, handling time, handling effect, manual confirmation result, and anomaly resolution status to the continuous learning module. The continuous learning module accumulates samples of "operational data - collection strategy - anomaly characteristics - root cause judgment - handling result" to optimize dynamic collection strategies, resource quota models, root cause detection models, and plug-in adaptation models. The system ultimately outputs operation reports, anomaly alarm records, handling logs, performance trend curves, security risk ledgers, and audit reports, forming standardized regulatory assets.

[0042] The first embodiment of this invention provides a full-process intelligent supervision method based on adaptive data probes. This invention deploys adaptive data probes driven by a large AI model and possessing pluggable extensibility, combined with Java proxy technology, to achieve non-intrusive, end-to-end data collection from hosts, applications, and networks across multiple scenarios. By dynamically adjusting the collection strategy through the large AI model, collection efficiency and data accuracy are improved. The pluggable architecture reduces system expansion costs and enables flexible expansion of regulatory dimensions. Through intelligent analysis, early warning, and handling throughout the entire process, a regulatory closed loop is formed, solving the problems of poor adaptability, high invasiveness, insufficient extensibility, and low intelligence in existing regulatory technologies, significantly improving regulatory efficiency and reliability.

[0043] Example 2 like Figure 2 As shown, in Embodiment 2 of the present invention, a full-process intelligent monitoring system based on adaptive data probes is provided, the system comprising: Deployment module 1 is used to deploy an adaptive data probe with pluggable extensibility. The adaptive data probe is driven by an AI large model and combined with Java proxy technology to adapt to multiple scenarios such as physical machines, virtual machines, containers, microservices, and Java application clusters. Access module 2 is used to achieve non-intrusive access to the monitored object through the Java proxy technology. The AI ​​big model drives the adaptive data probe to dynamically adjust the collection strategy. The collection strategy includes collection frequency, collection indicators and collection range, to complete the full-link data collection of host, application and network. Analysis module 3 is used to preprocess the collected end-to-end data, and to perform intelligent analysis on the preprocessed data through an AI big model to identify system faults, performance bottlenecks and network security risks, and generate analysis results and early warning information. The supervision module 4 is used to execute corresponding supervision and disposal operations based on the analysis results and early warning information, and to feed back the supervision results to the terminal supervision platform to realize a closed loop of intelligent supervision throughout the entire process.

[0044] The deployment module 1 is used for: An adaptive data probe with a plug-in architecture is constructed. The adaptive data probe includes a core driver module and an extensible plug-in module. The extensible plug-in module supports the addition of new acquisition plug-ins, analysis plug-ins and processing plug-ins. The plug-ins are deployed in a hot-swappable manner. Based on the type of the regulated scenario, configure corresponding basic plugins for the adaptive data probe. The basic plugins include host data acquisition plugin, application data acquisition plugin, and network data acquisition plugin. The adaptive data probe is integrated with a Java agent module that uses bytecode enhancement technology to achieve non-intrusive interception of the monitored Java application and capture full-link data during application runtime.

[0045] The access module 2 is used for: By analyzing historical regulatory data, operational status data of regulated entities, and current regulatory needs through AI big data models, the optimal data collection strategy for the current scenario can be determined. When the operational status of the monitored object changes, the AI ​​big data model adjusts the collection frequency and collection indicators in real time to collect abnormal data. When new regulatory requirements arise, the AI ​​big model can automatically adapt to the new collection indicators and analysis logic by deploying corresponding extension plugins, without requiring modifications to the core probe architecture.

[0046] The access module 2 is further configured to: Injecting a Java proxy module into the runtime environment of the monitored Java application allows for the interception of the application's method calls, data transfers, and resource access behaviors through bytecode enhancement technology, without modifying the application's source code. The Java proxy module captures end-to-end data during application runtime, including method call chain, parameter passing, return results, exception information, and resource usage. The captured data is then transmitted to the adaptive data probe in real time. For non-Java class monitored objects, adaptive data probes access the system via a non-intrusive protocol to collect corresponding host resource data and runtime status data.

[0047] The analysis module 3 is used for: The collected end-to-end data is then cleaned, deduplicated, standardized, and anonymized.

[0048] The analysis module 3 is further used for: The AI ​​large model is based on a trained algorithm model and performs real-time analysis on pre-processed data. The analysis process includes performance anomaly identification, fault diagnosis, and security risk detection. When an anomaly is detected, the AI ​​big data model automatically generates corresponding early warning information based on the anomaly level, clarifying the anomaly type, location, and scope of impact. By combining historical data with trend analysis, potential system failures and performance bottlenecks can be predicted and early warnings can be issued.

[0049] The monitoring module 4 is used for: Based on the level of the warning information, the preset handling strategy is automatically executed. The handling strategy includes alarm notification, resource scheduling, fault recovery, and risk isolation. It supports manual intervention. After receiving the early warning information and analysis results, the terminal monitoring platform allows managers to manually issue disposal instructions and carry out corresponding processing operations.

[0050] In other embodiments of the present invention, the present invention provides the following technical solution: a computer, including a memory 102, a processor 101, and a computer program stored in the memory 102 and executable on the processor 101, wherein the processor 101 executes the computer program to implement the full-process intelligent monitoring method based on adaptive data probes as described above.

[0051] Specifically, the processor 101 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or one or more integrated circuits that can be configured to implement the embodiments of the present invention.

[0052] The memory 102 may include a large-capacity memory for data or instructions. For example, and not limitingly, the memory 102 may include a hard disk drive (HDD), a floppy disk drive, a solid-state drive (SSD), flash memory, an optical disk drive, a magneto-optical disk drive, magnetic tape, or a Universal Serial Bus (USB) drive, or a combination of two or more of these. Where appropriate, the memory 102 may include removable or non-removable (or fixed) media. Where appropriate, the memory 102 may be internal or external to a data processing device. In a particular embodiment, the memory 102 is non-volatile memory. In a particular embodiment, the memory 102 includes read-only memory (ROM) and random access memory (RAM). Where appropriate, the ROM may be a mask-programmed ROM, a programmable read-only memory (PROM), an erasable read-only memory (EPROM), an electrically erasable read-only memory (EEPROM), an electrically alterable read-only memory (EAROM), or flash memory, or a combination of two or more of these. Where appropriate, the RAM can be Static Random-Access Memory (SRAM) or Dynamic Random-Access Memory (DRAM). DRAM can be Fast Page Mode Dynamic Random Access Memory (FPMDRAM), Extended Data Out Dynamic Random Access Memory (EDODRAM), Synchronous Dynamic Random-Access Memory (SDRAM), etc.

[0053] The memory 102 can be used to store or cache various data files that need to be processed and / or used for communication, as well as possible computer program instructions executed by the processor 101.

[0054] The processor 101 reads and executes the computer program instructions stored in the memory 102 to implement the above-mentioned intelligent monitoring method based on adaptive data probes throughout the entire process.

[0055] In some embodiments, the computer may further include a communication interface 103 and a bus 100. For example, Figure 3 As shown, the processor 101, memory 102, and communication interface 103 are connected through bus 100 and communicate with each other.

[0056] The communication interface 103 is used to enable communication between the various modules, devices, units, and / or equipment in the embodiments of the present invention. The communication interface 103 can also enable data communication with other components such as external devices, image / data acquisition devices, databases, external storage, and image / data processing workstations.

[0057] Bus 100 includes hardware, software, or both, that couples components of a computer device together. Bus 100 includes, but is not limited to, at least one of the following: data bus, address bus, control bus, expansion bus, and local bus. For example, and not as a limitation, bus 100 may include an Accelerated Graphics Port (AGP) or other graphics bus, an Extended Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), a Hyper Transport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an InfiniBand interconnect, a Low Pin Count (LPC) bus, a memory bus, a Micro Channel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local Bus (VLB) bus, or other suitable buses, or a combination of two or more of these. Where appropriate, bus 100 may include one or more buses. Although specific buses are described and illustrated in the embodiments of the present invention, the present invention is contemplated by any suitable bus or interconnect.

[0058] The computer can acquire a full-process intelligent monitoring system based on adaptive data probes and execute the full-process intelligent monitoring method based on adaptive data probes of this invention, thereby realizing full-process intelligent monitoring based on adaptive data probes.

[0059] In some further embodiments of the present invention, in conjunction with the above-described intelligent monitoring method for the entire process based on adaptive data probes, the present invention provides the following technical solution: a storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the above-described intelligent monitoring method for the entire process based on adaptive data probes.

[0060] Those skilled in the art will understand that the logic and / or steps represented in the flowcharts or otherwise described herein, for example, can be considered as a ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can mean any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device.

[0061] More specific examples of readable media (a non-exhaustive list) include: electrical connections (electronic devices) with one or more wires, portable computer disk drives (magnetic devices), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Furthermore, computer-readable media can even be paper or other suitable media on which the program can be printed, since the program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in computer memory.

[0062] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0063] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0064] The embodiments described above are merely illustrative of several implementations of the present invention, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these all fall within the protection scope of the present invention. Therefore, the protection scope of this invention patent should be determined by the appended claims.

Claims

1. A full-process intelligent monitoring method based on adaptive data probes, characterized in that, include: Deploy an adaptive data probe with pluggable extensibility. The adaptive data probe is driven by a large AI model and combined with Java proxy technology to adapt to multiple scenarios such as physical machines, virtual machines, containers, microservices, and Java application clusters. The Java proxy technology enables non-intrusive access to the monitored object. The AI ​​big model drives the adaptive data probe to dynamically adjust the collection strategy, which includes collection frequency, collection indicators and collection range, to complete the full-link data collection of the host, application and network. The collected end-to-end data is preprocessed, and the preprocessed data is intelligently analyzed using an AI big data model to identify system faults, performance bottlenecks and network security risks, and generate analysis results and early warning information. Based on the analysis results and early warning information, corresponding regulatory actions are taken, and the regulatory results are fed back to the terminal regulatory platform to achieve a closed-loop intelligent regulatory process.

2. The end-to-end intelligent monitoring method based on adaptive data probes according to claim 1, characterized in that, The steps for deploying an adaptive data probe with pluggable scalability include: An adaptive data probe with a plug-in architecture is constructed. The adaptive data probe includes a core driver module and an extensible plug-in module. The extensible plug-in module supports the addition of new acquisition plug-ins, analysis plug-ins and processing plug-ins. The plug-ins are deployed in a hot-swappable manner. Based on the type of the regulated scenario, configure corresponding basic plugins for the adaptive data probe. The basic plugins include host data acquisition plugin, application data acquisition plugin, and network data acquisition plugin. The adaptive data probe is integrated with a Java agent module that uses bytecode enhancement technology to achieve non-intrusive interception of the monitored Java application and capture full-link data during application runtime.

3. The end-to-end intelligent monitoring method based on adaptive data probes according to claim 1, characterized in that, The steps of dynamically adjusting the acquisition strategy of the adaptive data probe driven by the AI ​​large model include: By analyzing historical regulatory data, operational status data of regulated entities, and current regulatory needs through AI big data models, the optimal data collection strategy for the current scenario can be determined. When the operational status of the monitored object changes, the AI ​​big data model adjusts the collection frequency and collection indicators in real time to collect abnormal data. When new regulatory requirements arise, the AI ​​big model can automatically adapt to the new collection indicators and analysis logic by deploying corresponding extension plugins, without requiring modifications to the core probe architecture.

4. The end-to-end intelligent monitoring method based on adaptive data probes according to claim 1, characterized in that, The steps for achieving non-intrusive access to the monitored object through the Java proxy technology include: Injecting a Java proxy module into the runtime environment of the monitored Java application allows for the interception of the application's method calls, data transfers, and resource access behaviors through bytecode enhancement technology, without modifying the application's source code. The Java proxy module captures end-to-end data during application runtime, including method call chain, parameter passing, return results, exception information, and resource usage. The captured data is then transmitted to the adaptive data probe in real time. For non-Java class monitored objects, adaptive data probes access the system via a non-intrusive protocol to collect corresponding host resource data and runtime status data.

5. The end-to-end intelligent monitoring method based on adaptive data probes according to claim 1, characterized in that, The steps for preprocessing the collected end-to-end data include: The collected end-to-end data is then cleaned, deduplicated, standardized, and anonymized.

6. The end-to-end intelligent monitoring method based on adaptive data probes according to claim 1, characterized in that, The steps for intelligent analysis of the preprocessed data using a large AI model include: The AI ​​large model is based on a trained algorithm model and performs real-time analysis on pre-processed data. The analysis process includes performance anomaly identification, fault diagnosis, and security risk detection. When an anomaly is detected, the AI ​​big data model automatically generates corresponding early warning information based on the anomaly level, clarifying the anomaly type, location, and scope of impact. By combining historical data with trend analysis, potential system failures and performance bottlenecks can be predicted and early warnings can be issued.

7. The end-to-end intelligent monitoring method based on adaptive data probes according to claim 1, characterized in that, The steps for performing the corresponding regulatory action include: Based on the level of the warning information, the preset handling strategy is automatically executed. The handling strategy includes alarm notification, resource scheduling, fault recovery, and risk isolation. It supports manual intervention. After receiving the early warning information and analysis results, the terminal monitoring platform allows managers to manually issue disposal instructions and carry out corresponding processing operations.

8. A full-process intelligent monitoring system based on adaptive data probes, characterized in that, The system includes: The deployment module is used to deploy adaptive data probes with pluggable extensibility. The adaptive data probes are driven by a large AI model and combined with Java proxy technology to adapt to multiple scenarios such as physical machines, virtual machines, containers, microservices, and Java application clusters. The access module is used to achieve non-intrusive access to the monitored object through the Java proxy technology. The AI ​​big model drives the adaptive data probe to dynamically adjust the collection strategy. The collection strategy includes collection frequency, collection indicators and collection range, and completes the full-link data collection of the host, application and network. The analysis module is used to preprocess the collected end-to-end data, and to perform intelligent analysis on the preprocessed data through a large AI model to identify system faults, performance bottlenecks and network security risks, and generate analysis results and early warning information. The monitoring module is used to execute corresponding monitoring and handling operations based on the analysis results and early warning information, and to feed the monitoring results back to the terminal monitoring platform to achieve a closed-loop intelligent monitoring process.

9. A computer comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the end-to-end intelligent monitoring method based on adaptive data probes as described in any one of claims 1 to 7.

10. A storage medium, characterized in that, The storage medium stores a computer program, which, when executed by a processor, implements the end-to-end intelligent monitoring method based on adaptive data probes as described in any one of claims 1 to 7.

Images