AI-based information system operation situation intelligent monitoring method

Abstract

This invention relates to the field of information system operation and maintenance monitoring technology, specifically disclosing an AI-based intelligent monitoring method for the operational status of information systems. First, it adaptively collects heterogeneous data from the system across all dimensions using multiple protocols, and generates a structured data stream through standardization, quality repair, and semantic annotation. Then, relying on a time-series self-learning dynamic baseline, it accurately identifies and aggregates anomalies and generates reports through a three-level cascaded anomaly detection architecture. Next, it constructs a dynamic causal graph based on the system resource model, and completes accurate diagnosis of fault root causes through causal inference and multi-dimensional verification. Subsequently, it integrates multi-dimensional data to construct a panoramic view of the situation, uses AI models to predict indicator trends and fault probabilities, and automatically generates situation briefings through a large language model. Finally, it matches knowledge base strategies or adaptively generates new solutions to complete automated operation and maintenance handling, and achieves closed-loop optimization based on the handling results. This invention can effectively improve the intelligence and automation level of information system operation and maintenance, ensuring stable system operation.

Description

Technical Field

[0001] This invention relates to the field of information system operation and maintenance monitoring technology, specifically to an AI-based intelligent monitoring method for the operational status of information systems. Background Technology

[0002] With the deepening of digital transformation, enterprise and government information systems are gradually evolving towards distributed, microservice, and cloud-native architectures. These systems are becoming increasingly complex, encompassing various resources such as hosts, containers, services, databases, middleware, and network devices, resulting in cross-coupling of business processes and intricate resource dependencies. Traditional monitoring methods for information systems often rely on fixed threshold monitoring, single-indicator detection, and manual review and analysis, which have numerous technical shortcomings.

[0003] First, traditional monitoring data collection methods are limited, supporting only a single protocol and single type of data collection. This fails to meet the unified collection needs of diverse heterogeneous devices, applications, logs, and link data. The raw data formats are messy and highly heterogeneous, lacking standardized processing and semantic association capabilities, resulting in fragmented monitoring data and low utilization. Second, traditional anomaly detection relies on manually setting fixed thresholds, which cannot adapt to scenarios with fluctuating system business and dynamic load changes. The false alarm and false negative rates are extremely high, and it can only identify anomalies in a single indicator, lacking multi-level verification and aggregation analysis mechanisms, and unable to distinguish between normal business fluctuations and real fault anomalies.

[0004] Furthermore, existing operation and maintenance monitoring systems lack intelligent root cause analysis capabilities. After a fault occurs, they can only display the abnormal symptoms and cannot accurately locate the root cause. They rely on manual troubleshooting by operation and maintenance personnel, which is inefficient and time-consuming, and cannot meet the rapid fault handling requirements of complex systems. At the same time, traditional monitoring only provides real-time status display and lacks the ability to integrate situations, predict trends, and predict fault probabilities. It cannot detect potential operational risks in advance, and the operation and maintenance mode is passive and lagging behind. Finally, existing operation and maintenance handling relies heavily on manual operation, with low levels of standardization and automation. There are no suitable handling solutions for new and unknown fault scenarios, and it is impossible to achieve closed-loop feedback of handling effects and continuous optimization of system models, which makes it difficult to meet the high reliability, high stability, and intelligent operation and maintenance requirements of modern information systems.

[0005] To address the aforementioned shortcomings of existing technologies, there is an urgent need for an intelligent monitoring method for the operational status of information systems that is fully intelligent, adaptive, and optimized in a closed loop, enabling standardized data collection, accurate anomaly detection, intelligent root cause diagnosis, panoramic situational awareness, risk prediction, and automated operation and maintenance. Summary of the Invention

[0006] This invention aims to address the problems of fragmented data, low accuracy of anomaly detection, difficulty in locating root causes of faults, weak situational awareness, low automation of operation and maintenance, and lack of closed-loop optimization mechanisms in existing information system monitoring technologies. It provides an AI-based intelligent monitoring method for the operational status of information systems, relying on multi-protocol adaptive data acquisition, three-level cascaded anomaly detection, causal inference and root cause analysis, large-scale model situational generation, and closed-loop automated handling technologies to achieve full-dimensional, intelligent, and dynamic monitoring and operation and maintenance optimization of the operational status of information systems.

[0007] To solve the above-mentioned technical problems, the technical solution provided by this invention is: an AI-based intelligent monitoring method for the operational status of an information system, comprising the following steps: S1. Deploy data acquisition components at each node of the target information system, collect full-dimensional monitoring data of the system through multi-protocol adaptive methods, perform format standardization conversion on heterogeneous raw data, complete data quality detection and repair and semantic association annotation, generate standardized structured monitoring data streams and output them externally; S2. Receive the standardized monitoring data stream, generate a dynamic baseline of indicators that adapts to the dynamic changes of the system based on the self-learning of time-series data features, complete the identification, verification and screening of anomalies through a three-level cascaded anomaly detection architecture from coarse to fine, perform multi-dimensional aggregation analysis on the abnormal events and generate a structured anomaly report. S3. Automatically triggered after detecting system anomalies, constructing a dynamic cause-effect graph based on the system's unified resource model and historical monitoring data, calculating the causal effects of each candidate variable through causal inference technology, and completing root cause verification and fine-tuning by combining time series, topology and counterfactual reasoning, and outputting a fault root cause diagnosis report. S4. By integrating real-time anomaly detection results, root cause analysis results and system health status information, a panoramic view of the system's operational status is constructed from multiple dimensions. Through multivariate time series prediction models and fault classification models, system indicator trend prediction and fault probability prediction are achieved. Natural language situation briefings are automatically generated based on large language models. S5. Based on situational awareness results and root cause diagnosis results, match the optimal handling strategy in the knowledge base, adaptively generate candidate handling solutions for unknown new scenarios, execute automated operation and maintenance handling operations through standardized interfaces, evaluate the handling effect in real time, and feed the results back to each upstream process.

[0008] Furthermore, step S1 specifically includes the following steps: S1-1. Automatically identify the data source type through the built-in protocol identification engine and match the corresponding collection strategy. Collect network device status data through SNMP protocol, Java application performance data through JMX protocol, kernel-level system call and performance event data through eBPF technology, system and application logs through log collection component, and request link data through distributed tracing protocol. S1-2: Convert all performance metrics into a four-tuple format of timestamp, metric name, metric value, and tag set. Extract and parse unstructured logs using a pre-defined log template library. Unify the link data into a standard format of TraceID, SpanID, parent SpanID, service name, operation name, duration, and status code. Write all standardized data into a distributed message queue for real-time consumption. S1-3: Detect missing values, outliers, and data delays in the raw data, and process them using interpolation, labeling, and timestamp deviation recording methods respectively, to generate data quality metadata containing scores for three dimensions: completeness, accuracy, and timeliness. S1-4: Construct a Unified Resource Model (URM) with a graph structure to depict the topological relationships and dependencies of various resource entities such as hosts, containers, services, databases, middleware, and network devices. Associate each standardized monitoring data with the corresponding resource entity to complete semantic annotation and context association.

[0009] Furthermore, step S2 specifically includes the following steps: S2-1: For each monitoring indicator, its normal behavior pattern is automatically learned based on historical data, a dynamic baseline is established, and the indicator sequence is decomposed into trend, period and residual items by time series decomposition algorithm and modeled separately. The dynamic baseline is updated online as new data is continuously input. S2-2: Based on the dynamic baseline, a three-level detection architecture from coarse to fine is adopted for anomaly identification, which includes the first level of fast filtering, the second level of fine confirmation, and the third level of context verification. S2-3: Aggregate detected abnormal events according to time window, resource entity, and abnormal type dimensions, merge multiple abnormal manifestations caused by the same root cause, and generate a structured abnormal report.

[0010] Further, in step S2-2: The first-level fast filtering is as follows: the deviation between the current indicator value and the predicted value is calculated based on the dynamic baseline. When the deviation exceeds the preset preliminary threshold, the first-level anomaly label is triggered. Real-time detection is achieved by using a statistical method with low computational complexity. The second level of fine verification is as follows: the suspected anomalies marked in the first level are finely verified. An ensemble learning method is used to integrate the judgment results of multiple anomaly detection algorithms. The multiple anomaly detection algorithms include outlier detection based on isolated forest, reconstruction error detection based on autoencoder, and probabilistic anomaly detection based on variational Bayesian inference. The detection results of each algorithm are comprehensively judged through a weighted voting mechanism. The weights are dynamically adjusted according to the performance of each algorithm on the recent validation set. The third-level context verification is as follows: the anomaly confirmed in the second level is placed in the system operation context for comprehensive verification. The system load status, business traffic characteristics and known change events at the time of the anomaly occurrence are taken into account to determine whether the anomaly is a normal fluctuation within expectations.

[0011] Furthermore, step S3 specifically includes the following steps: S3-1: Based on the unified resource model and historical monitoring data established in step S1, construct a causal graph of the information system. The nodes of the causal graph are the various observable variables of the system, and the directed edges represent the causal direction between variables. The observable variables include performance indicators, resource status, and configuration parameters. S3-2: When an anomaly occurs, use the anomaly indicator as the target variable, perform causal inference on the cause-effect graph, calculate the causal effect of each candidate cause variable on the target anomaly, use backdoor adjustment or frontdoor adjustment strategies to eliminate the interference of confounding variables, and sort the candidate causes according to the size of the causal effect. S3-3: Validate and refine the candidate root cause list obtained from the causal effect estimation, and output the final root cause diagnosis report.

[0012] Furthermore, in step S3-1, the causal graph is constructed using the following method: The system utilizes system architecture knowledge and resource dependencies to determine some causal relationships a priori; it employs constraint-based causal discovery algorithms and rating-based causal search algorithms to learn causal structures from historical data; it introduces domain knowledge rules to verify and correct the data-driven causal discovery results; and the causal graph has a dynamic update mechanism that is continuously optimized as the system architecture evolves and new data accumulates. In step S3-3, the verification method includes: The process includes: checking whether the candidate root cause occurred before the target anomaly (time priority test); checking whether the resource entity corresponding to the candidate root cause has a topological consistency with the anomaly resource entity through a dependency path test; and verifying the result through intervention simulation using counterfactual reasoning.

[0013] Furthermore, step S4 specifically includes the following steps: S4-1: Multi-dimensional situation fusion, which integrates the real-time anomaly detection results from step S2, the root cause analysis results from step S3, and the health status information extracted from the original monitoring data in multiple dimensions, and describes the system operation status from four dimensions: health, risk, redundancy and trend. S4-2: Multivariate time series forecasting. A multivariate time series forecasting model based on the Transformer architecture is used to make short-term and medium-term forecasts of key system performance indicators and resource usage. The forecast results include point forecast values ​​and forecast intervals. S4-3: Fault probability prediction. Construct a fault prediction classification model using the gradient boosting decision tree algorithm. Take the multidimensional features of the current operating state of the system as input and output the probability of a fault occurring within a specific time window in the future. S4-4: Automatic generation of situation briefings. The structured results of situation awareness and prediction are converted into natural language descriptions through a large language model to generate situation briefings.

[0014] Furthermore, step S5 specifically includes the following steps: S5-1: Disposal strategy retrieval and matching. A disposal strategy knowledge base containing disposal rules, best practices and historical success cases is pre-built and maintained. When the system detects an anomaly or predicts a potential risk, it searches and reasons in the disposal strategy knowledge base based on the current situation information and selects the optimal disposal strategy. The reasoning process comprehensively considers the matching degree between the strategy and the current scenario, the historical success rate of the strategy, the execution risk of the strategy, and the potential impact of the strategy on other parts of the system. S5-2: New scenario adaptive solution generation. For new scenarios not covered in the knowledge base, zero-shot reasoning is performed based on a large language model to generate candidate solutions for manual review. S5-3: Automated handling execution. For confirmed handling strategies, the standardized automated execution interface is used to execute them. The execution interface supports service restart, traffic switching, resource scaling, configuration adjustment and process termination operations. The execution process records a complete operation log.

[0015] Furthermore, step S5 also includes step S5-4: The evaluation of the handling effect and the full-link feedback are carried out by continuously monitoring the changes in system status after the handling strategy is implemented, evaluating the handling effect, and evaluating indicators including whether the anomaly is eliminated, whether the system health is restored, and whether new problems are generated. The evaluation results are fed back to the handling strategy knowledge base to update the success rate statistics and priority ranking of the strategy. At the same time, the evaluation results are fed back to the dynamic baseline learning process in step S2 and the causal graph construction process in step S3 to carry out synchronous and continuous optimization of the handling strategy knowledge base, dynamic baseline and causal graph.

[0016] The advantages of this invention compared to the prior art are: This invention employs multi-protocol adaptive acquisition technology, covering data from all dimensions including network devices, applications, kernels, logs, and links. Through unified format conversion, data quality repair, and semantic association annotation, it solves the problems of heterogeneous, fragmented, poor-quality, and context-independent traditional monitoring data, providing a high-quality data foundation for subsequent intelligent analysis.

[0017] This invention abandons the traditional fixed threshold detection mode and builds a dynamic baseline based on time-series self-learning to adapt to the dynamic operating characteristics of the system. Through a three-level cascaded detection architecture combined with multi-algorithm integrated learning and context verification, it filters false alarms layer by layer and accurately identifies real anomalies. At the same time, through multi-dimensional anomaly aggregation, it simplifies anomaly information and effectively reduces the workload of operation and maintenance redundancy.

[0018] This invention integrates prior knowledge of system architecture with data-driven algorithms to construct a dynamic cause-effect graph. It combines causal inference, temporal verification, topology verification, and counterfactual reasoning to finely diagnose root causes from multiple dimensions, overcoming the problems of low efficiency, strong reliance on experience, and inaccurate root cause location in traditional manual troubleshooting, and significantly shortening the fault diagnosis cycle.

[0019] This invention integrates multi-dimensional information on anomalies, root causes, and health status to depict the system's operational status from four dimensions. It relies on AI models to predict indicator trends and fault probabilities, and combines large language models to automatically generate status reports, thus upgrading the operation and maintenance mode from "passive monitoring" to "proactive prediction".

[0020] This invention takes into account both precise handling of conventional scenarios and adaptive generation of solutions for unknown scenarios, supports automated execution of various operation and maintenance operations, and continuously optimizes the baseline model, cause-effect graph, and strategy knowledge base through full-link feedback of handling effects. This achieves closed-loop iteration of system monitoring, analysis, handling, and optimization, significantly improving the intelligence and automation level of information system operation and maintenance, and ensuring the long-term stable and reliable operation of the system. Attached Figure Description

[0021] Figure 1 This is a flowchart of the AI-based intelligent monitoring method for the operational status of an information system, as described in this invention.

[0022] Figure 2 This is the execution flowchart for step S1.

[0023] Figure 3 This is the execution flowchart for step S2.

[0024] Figure 4 This is the execution flowchart for step S3.

[0025] Figure 5 This is the execution flowchart for step S4.

[0026] Figure 6 This is the execution flowchart for step S5. Detailed Implementation

[0027] Various exemplary embodiments of the present invention will now be described in detail with reference to the accompanying drawings. It should be noted that, unless otherwise specifically stated, the relative arrangement, numerical expressions, and values ​​of the components and steps set forth in these embodiments do not limit the scope of the present invention.

[0028] The following description of at least one exemplary embodiment is merely illustrative and is in no way intended to limit the invention or its application or use.

[0029] Techniques, methods, and equipment known to those skilled in the art may not be discussed in detail, but where appropriate, such techniques, methods, and equipment should be considered part of the specification.

[0030] In all examples shown and discussed herein, any specific values ​​should be interpreted as merely exemplary and not as limitations. Therefore, other examples of exemplary embodiments may have different values.

[0031] The following detailed description of the AI-based intelligent monitoring method for the operational status of information systems according to the present invention, with reference to the accompanying drawings, will be provided in further detail.

[0032] Combined with appendix Figure 1-6 The specific implementation process of the AI-based intelligent monitoring method for the operational status of information systems in this invention is as follows: The AI-based intelligent monitoring method for the operational status of information systems provided by this invention includes five main steps: S1 data acquisition and standardization, S2 anomaly detection and aggregation analysis, S3 root cause analysis and fine-tuning, S4 status fusion and intelligent prediction, and S5 intelligent handling and end-to-end feedback. These five steps are executed sequentially, forming a complete closed loop from data acquisition to operational handling.

[0033] Step S1 is implemented as follows: S1-1, Multi-protocol Adaptive Data Acquisition. Acquisition components are deployed at various nodes of the target information system, including physical hosts, virtual machines, container nodes, and network devices. Each acquisition component has a built-in protocol recognition engine. When the acquisition component starts or detects a new data source, the protocol recognition engine automatically sends probe packets or analyzes data packet characteristics to identify the data source type. After identification, the corresponding acquisition strategy is matched. For network devices such as switches, routers, and firewalls, their status data, including interface traffic, CPU utilization, memory utilization, and error packet count, are collected via the SNMP protocol. For Java application services, performance data is collected via the JMX protocol, including JVM memory usage, GC frequency, number of threads, number of class loads, etc. At the operating system level, kernel-level system call and performance event data are collected through eBPF (Extended Berkeley Packet Filter) technology, including system call frequency, file read / write, network transmission and reception, process scheduling, etc. For system and application logs, log collection components such as Filebeat and Fluentd are used for collection. For distributed microservice architectures, request chain data is collected through distributed tracing protocols, such as the OpenTracing protocol used by Jaeger and Zipkin.

[0034] S1-2, Data Standardization and Transformation. The various heterogeneous raw data collected need to undergo a unified standardization and transformation: Performance metric data is uniformly converted into a four-tuple format: (timestamp, metric_name, value, labels), where timestamp is the Unix timestamp, metric_name is the metric name (e.g., "cpu.usage"), value is the metric value, and labels is a set of labels containing dimensional information such as hostname, service name, and instance ID.

[0035] Unstructured log data undergoes field extraction and structured parsing using a pre-defined log template library. This library contains regular expression templates and parsing rules for various common log formats. For logs that cannot be matched, a clustering-based method is used to automatically discover new log templates. The parsed structured log fields include timestamp, log level, source module, and log content.

[0036] Link data is uniformly converted into a standard format: (TraceID, SpanID, ParentSpanID, ServiceName, OperationName, Duration, StatusCode) to ensure that cross-service call chains can be completely connected.

[0037] All standardized data is written to a distributed message queue (such as Kafka) for real-time consumption by subsequent steps.

[0038] S1-3, Data Quality Inspection and Repair. Perform quality inspection on the raw data: Missing value detection: Checking for missing values ​​in the time series data. For missing values, linear interpolation or spline interpolation methods are used to impute them, and the imputation markers are recorded; Outlier detection: Identify data points that deviate significantly from the normal range, such as negative traffic counts or CPU utilization exceeding 100%. Instead of deleting outliers directly, the original data is preserved for subsequent analysis. Data delay detection: Check the timestamp deviation between the data arrival time and the data generation time. When the deviation exceeds a preset threshold, record the timestamp deviation information.

[0039] Generate data quality metadata, which includes scores in three dimensions: completeness score (reflecting the degree of missing data), accuracy score (reflecting the proportion of outliers), and timeliness score (reflecting the degree of data delay).

[0040] S1-4. Semantic Association Annotation. Construct a Unified Resource Model (URM) with a graph structure. The URM uses a graph database (such as Neo4j) as its storage engine. Nodes represent various resource entities, including but not limited to: hosts, containers, services, databases, middleware, and network devices. Edges represent the topological relationships and dependencies between resource entities, such as relationship types like "deployed on," "running on," "invoking," and "depending on."

[0041] Each standardized monitoring data point is associated with its corresponding resource entity node through label matching, thus completing semantic annotation. For example, a CPU utilization metric data point is associated with its corresponding host node through the "host" label in its labels, thereby obtaining the context information to which the data belongs, such as which services are running on the host and which business system it belongs to.

[0042] Step S2 is implemented as follows: S2-1, Dynamic Baseline Generation. For each monitoring indicator, normal behavior patterns are automatically learned based on its historical data. Specifically, a time series decomposition algorithm (such as STL decomposition, Seasonal-Trend decomposition using LOESS) is used to decompose the indicator sequence into three components: Trend: Reflects the long-term trend of the indicator, and is fitted using locally weighted regression. Seasonal: Reflects the periodic fluctuations of the indicator, such as daily cycle, weekly cycle, etc. Residual: Reflects random fluctuations after removing trends and periods.

[0043] Statistical analysis is performed on the residuals to calculate their mean and standard deviation, which serve as the basis for judging the normal fluctuation range. The dynamic baseline expression is: Baseline(t) = Trend(t) + Seasonal(t) ± k × σ_residual, where k is an adjustable coefficient (default is 3), and σ_residual is the standard deviation of the residuals.

[0044] The dynamic baseline is updated online as new data is continuously input. It adopts a sliding window mechanism and uses only historical data from the most recent N days (e.g., 30 days) for baseline calculation to ensure that the baseline can reflect the dynamic changes of the system in a timely manner.

[0045] S2-2, Three-level Cascaded Anomaly Detection. A three-level detection architecture, from coarse to fine, is adopted: Level 1: Fast Filtering. Calculates the deviation between the current indicator value and the predicted value based on a dynamic baseline. Deviation=|Value(t)-Baseline(t)| / σ_residual.

[0046] When the deviation exceeds a preset initial threshold (e.g., 3), the first-level anomaly flag is triggered. This level uses a statistical method with low computational complexity to achieve real-time and rapid screening of massive amounts of monitoring data, filtering out the vast majority of normal data points.

[0047] Level 2: Refined Verification. This involves refining the verification of suspected anomalies identified in Level 1 by employing an ensemble learning approach that integrates multiple anomaly detection algorithms. Isolation Forest: Constructs isolated trees by randomly selecting features and split points, and calculates anomaly scores for data points; Autoencoder: Train an autoencoder to reconstruct normal data and calculate the reconstruction error as an anomaly score; Variational Bayesian inference: Construct a probabilistic graphical model to calculate the posterior probability that a data point belongs to an outlier distribution.

[0048] The detection results of each algorithm are comprehensively judged through a weighted voting mechanism, with the weights dynamically adjusted based on the performance of each algorithm on the recent validation set (the better-performing algorithm has a higher weight). Algorithms with a comprehensive score exceeding a preset threshold are identified as anomalies.

[0049] Level 3: Contextual Verification. The exceptions identified in Level 2 are then subjected to comprehensive verification within the system's runtime context. Check the system load status at the time the anomaly occurred (whether it was during peak business hours). Check the characteristics of the business traffic at the time the anomaly occurred (whether there was a sudden surge in traffic). Queries known change events (whether there are planned system changes, releases, scaling up or down, etc.).

[0050] If the anomaly occurs in a normal, expected fluctuation scenario, such as a normal increase in load during peak business periods, it will be downgraded to the "Watch" level instead of the "Alarm" level.

[0051] S2-3, Abnormal Event Aggregation. Detected abnormal events are aggregated according to three dimensions: Time window aggregation: Merges multiple abnormal events that occur within the same time window (e.g., within 5 minutes); Resource entity aggregation: Merges multiple exception events on the same resource entity; Exception type aggregation: Merge exception events of the same type (such as multiple CPU usage exceptions).

[0052] Aggregation combines multiple anomalies that may be caused by the same underlying reason into a single anomaly event group, reducing alarm noise. The aggregated report generates a structured anomaly report containing information such as the anomaly event group ID, occurrence time, involved resource entities, anomaly type list, and severity score.

[0053] Step S3 is implemented as follows: S3-1. Cause-effect graph construction. A cause-effect graph is constructed based on the unified resource model and historical monitoring data. The cause-effect graph G=(V, E), where V is the set of nodes representing the various observable variables of the system, including performance indicators, resource status, configuration parameters, etc., and E is the set of directed edges representing the causal directions between variables.

[0054] Cause-effect graphs are constructed using a combination of three methods: Based on prior knowledge: This involves using system architecture knowledge and resource dependencies to determine partial causal relationships a priori. For example, if service A calls service B, then the response time of service A causally affects the request volume of service B. Data-driven approach: Constraint-based causal discovery algorithms (such as PC algorithm) and rating-based causal search algorithms (such as GES algorithm) are used to learn causal structures from historical data; Domain knowledge-based verification: Domain knowledge rules are introduced to verify and correct data-driven causal discovery results, eliminating causal edges that are obviously inconsistent with common sense in the domain.

[0055] Cause-effect graphs have a dynamic update mechanism, which is continuously optimized as the system architecture evolves and new data is accumulated.

[0056] S3-2, Causal Effect Estimation. When an anomaly occurs, causal inference is performed on the causal graph using the anomaly index as the target variable Y. For each candidate causal variable X, its causal effect on the target anomaly Y is calculated: Using a back-door adjustment strategy, identify and control the set of confounding variables Z between X and Y, and calculate: P(Y|do(X=x))=Σ_zP(Y|X=x, Z=z)P(Z=z); For cases involving mediating variables, a front-door adjustment strategy is employed.

[0057] The causal effect values ​​of each candidate causal variable on the target abnormality are calculated and arranged in descending order of effect size to form a candidate root cause list.

[0058] S3-3, Root Cause Validation and Refinement. The candidate root cause list is validated from multiple dimensions: Time priority check: Check whether the occurrence time of the candidate root cause precedes the occurrence time of the target anomaly to ensure that the time sequence of cause and effect is correct; Topology consistency check: Check whether the resource entity corresponding to the candidate root cause has a dependency path with the abnormal resource entity to ensure that it is related in the system topology; Counterfactual reasoning verification: Counterfactual reasoning is performed through intervention simulation—assuming that the candidate root cause does not exist, will the target anomaly still occur? If the counterfactual inference indicates that the target anomaly will not occur, then the candidate root cause is verified as the true root cause.

[0059] Based on the above validation results, the candidate root causes are refined, and a final root cause diagnosis report is generated. The report includes the root cause entity, root cause type, causal effect value, confidence score, reasoning path, and recommended treatment directions.

[0060] Step S4 is implemented as follows: S4-1, Multi-dimensional Situational Fusion. This method integrates real-time anomaly detection results, root cause analysis results, and health status information extracted from raw monitoring data to depict the system's operational status from the following four dimensions: Health dimension: Reflects the basic operating status of each component of the system at present, and the comprehensive indicators include service availability, error rate, response time, etc. Risk level dimension: Reflects the current risk level faced by the system, and comprehensive indicators include the number and severity of abnormal events, failure probability prediction results, etc. Redundancy dimension: reflects the system's fault tolerance capability, and comprehensive indicators include resource reserves, number of replicas, backup status, etc. Trend dimension: reflects the changing trend of the system's operating status, and the comprehensive indicators include the short-term and medium-term forecast results of each key indicator.

[0061] The system presents a four-dimensional situation through visualization methods such as radar charts and heat maps, forming a panoramic view of the system's operational status.

[0062] S4-2, Multivariate Time Series Forecasting. A multivariate time series forecasting model based on the Transformer architecture is adopted. The model input is historical series data of multiple related indicators, such as data of the past 24 hours. The encoder-decoder structure of the Transformer captures the long-range dependencies and mutual influences between indicators, and outputs the predicted values ​​for the next 1-6 hours (short-term) and the next 6-24 hours (medium-term), including point prediction values ​​and 95% confidence intervals.

[0063] S4-3. Fault Probability Prediction. A fault prediction classification model is constructed using a gradient boosting decision tree algorithm (such as XGBoost or LightGBM). The model takes the multidimensional features of the system's current operating state (including current indicator values, historical statistical features, rate of change features, etc.) as input and outputs the probability of a fault occurring within a specific future time window (such as the next 1 hour or the next 6 hours). The model is trained using historical fault data; positive samples represent the system state before the fault occurred, and negative samples represent the normal operating state.

[0064] S4-4. Automatic Generation of Situation Briefings. The structured results of situational awareness and prediction are input into a large language model, such as GPT, Claude, or an open-source large model. By designing specialized prompt word templates, the large language model is guided to convert the structured data into natural language descriptions. The generated situation briefing includes: an overview of the current overall system operation status, summaries of existing anomalies and their root causes, future trend predictions and risk warnings, suggested areas of concern, and appropriate remedial measures. The briefing supports both text and audio output formats.

[0065] Step S5 is implemented as follows: S5-1, Disposal Strategy Retrieval and Matching. A disposal strategy knowledge base is pre-built and maintained, containing three types of knowledge: Handling rules: "Condition-action" rules based on expert experience, such as "when the service response time exceeds the threshold and the root cause is insufficient database connection pool, perform connection pool expansion"; Best practices: Validated standard operation and maintenance procedures, such as service restart procedures and traffic switching procedures; Historical success cases: Record the handling process, actions, and effects of historical anomalies.

[0066] When the system detects an anomaly or predicts a potential risk, it performs retrieval and reasoning in the knowledge base based on current situational information. The reasoning process comprehensively considers four factors: the matching degree between the strategy and the current scenario (calculated through vector similarity), the historical success rate of the strategy, the execution risk score of the strategy, and the potential impact of the strategy on other parts of the system. The strategy with the highest comprehensive score is selected as the optimal handling strategy.

[0067] S5-2. New Scenario Adaptive Solution Generation. For new scenarios not covered in the knowledge base (i.e., where the retrieval matching degree is below a threshold), zero-shot inference is performed based on a large language model. Contextual information such as the current anomaly description, root cause analysis results, system topology information, and a list of available actions is input into the large language model to guide it in generating candidate solutions. The generated candidate solutions must be manually reviewed and confirmed before execution. Once approved, the solution can be added to the knowledge base for future reuse.

[0068] S5-3. Automated Execution. For confirmed action strategies, execution is performed through a standardized automated execution interface. The execution interface supports the following operation types: Service restart: Restart the specified service instance via the API of a container orchestration platform (such as Kubernetes); Traffic switching: Traffic is scheduled via the API of the load balancer or service mesh; Resource scaling: Adjust resource quotas or the number of instances via cloud platform APIs or container orchestration APIs; Configuration adjustment: Dynamically adjust runtime parameters via the configuration center API; Process termination: Terminate abnormal processes using operating system signals or process management tools.

[0069] The execution process records a complete operation log, including execution time, execution actions, execution parameters, and execution results.

[0070] S5-4. Effectiveness Evaluation and End-to-End Feedback. After the implementation of the response strategy, continuously monitor changes in system status. Evaluation indicators include: Has the anomaly been eliminated (has the target indicator returned to the normal range)? Has the system health recovered (has the overall health score rebounded)? Have any new problems arise (have any new anomalies occurred)?

[0071] The evaluation results are fed back to three stages: Feedback to the knowledge base: Update the success rate statistics and priority ranking of the strategy, increase the weight of successful cases and decrease the weight of failed cases; Feedback to dynamic baseline: Incorporate the processed system status data into the baseline learning process to help the baseline adapt to system changes more quickly; Feedback to the cause-effect graph: Use the data on the effects of the treatment to verify and optimize the causal relationships in the cause-effect graph, thereby improving the accuracy of subsequent root cause analysis.

[0072] Through the aforementioned end-to-end feedback mechanism, the knowledge base of handling strategies, dynamic baselines, and cause-effect graphs are continuously optimized in sync, forming a complete intelligent operation and maintenance closed loop of "perception-decision-execution-feedback".

[0073] The present invention and its embodiments have been described above. This description is not restrictive, and the accompanying drawings are only one embodiment of the present invention; the actual structure is not limited thereto. In conclusion, if those skilled in the art are inspired by this description and design similar structures and embodiments without departing from the spirit of the invention, such designs should fall within the protection scope of the present invention.

Claims

1. A method for intelligent monitoring of the operational status of an information system based on AI, characterized in that, Includes the following steps: S1. Deploy data acquisition components at each node of the target information system, collect full-dimensional monitoring data of the system through multi-protocol adaptive methods, perform format standardization conversion on heterogeneous raw data, complete data quality detection and repair and semantic association annotation, generate standardized structured monitoring data streams and output them externally; S2. Receive the standardized monitoring data stream, generate a dynamic baseline of indicators that adapts to the dynamic changes of the system based on the self-learning of time-series data features, complete the identification, verification and screening of anomalies through a three-level cascaded anomaly detection architecture from coarse to fine, perform multi-dimensional aggregation analysis on the abnormal events and generate a structured anomaly report. S3. Automatically triggered after detecting system anomalies, constructing a dynamic cause-effect graph based on the system's unified resource model and historical monitoring data, calculating the causal effects of each candidate variable through causal inference technology, and completing root cause verification and fine-tuning by combining time series, topology and counterfactual reasoning, and outputting a fault root cause diagnosis report. S4. By integrating real-time anomaly detection results, root cause analysis results and system health status information, a panoramic view of the system's operational status is constructed from multiple dimensions. Through multivariate time series prediction models and fault classification models, system indicator trend prediction and fault probability prediction are achieved. Natural language situation briefings are automatically generated based on large language models. S5. Based on situational awareness results and root cause diagnosis results, match the optimal handling strategy in the knowledge base, adaptively generate candidate handling solutions for unknown new scenarios, execute automated operation and maintenance handling operations through standardized interfaces, evaluate the handling effect in real time, and feed the results back to each upstream process.

2. The AI-based intelligent monitoring method for the operational status of an information system according to claim 1, characterized in that: Step S1 specifically includes the following steps: S1-1. Automatically identify the data source type through the built-in protocol identification engine and match the corresponding collection strategy. Collect network device status data through SNMP protocol, Java application performance data through JMX protocol, kernel-level system call and performance event data through eBPF technology, system and application logs through log collection component, and request link data through distributed tracing protocol. S1-2. All performance metrics are uniformly converted into a four-tuple format of timestamp, metric name, metric value, and tag set. Unstructured logs are extracted and structured by a preset log template library. Link data is unified into a standard format of TraceID, SpanID, parent SpanID, service name, operation name, duration, and status code. All standardized data is written to a distributed message queue for real-time consumption. S1-3. Detect missing values, outliers, and data delays in the original data, and process them using interpolation, labeling, and timestamp deviation recording methods respectively, to generate data quality metadata containing scores for three dimensions: completeness, accuracy, and timeliness. S1-4. Construct a Unified Resource Model (URM) with a graph structure to depict the topological relationships and dependencies of various resource entities such as hosts, containers, services, databases, middleware, and network devices. Associate each standardized monitoring data with the corresponding resource entity to complete semantic annotation and context association.

3. The AI-based intelligent monitoring method for the operational status of an information system according to claim 1, characterized in that: Step S2 specifically includes the following steps: S2-1. For each monitoring indicator, its normal behavior pattern is automatically learned based on historical data, a dynamic baseline is established, and the indicator sequence is decomposed into trend item, period item and residual item by time series decomposition algorithm and modeled separately. The dynamic baseline is updated online as new data is continuously input. S2-2. Based on the dynamic baseline, an anomaly identification is performed using a three-level detection architecture from coarse to fine, which includes the first level of rapid filtering, the second level of fine confirmation, and the third level of contextual verification. S2-3. Aggregate the detected abnormal events according to the dimensions of time window, resource entity, and abnormal type, merge multiple abnormal manifestations caused by the same root cause, and generate a structured abnormal report.

4. The AI-based intelligent monitoring method for the operational status of an information system according to claim 3, characterized in that: In step S2-2: The first-level fast filtering is as follows: the deviation between the current indicator value and the predicted value is calculated based on the dynamic baseline. When the deviation exceeds the preset preliminary threshold, the first-level anomaly label is triggered. Real-time detection is achieved by using a statistical method with low computational complexity. The second level of fine verification is as follows: the suspected anomalies marked in the first level are finely verified. An ensemble learning method is used to integrate the judgment results of multiple anomaly detection algorithms. The multiple anomaly detection algorithms include outlier detection based on isolated forest, reconstruction error detection based on autoencoder, and probabilistic anomaly detection based on variational Bayesian inference. The detection results of each algorithm are comprehensively judged through a weighted voting mechanism. The weights are dynamically adjusted according to the performance of each algorithm on the recent validation set. The third-level context verification is as follows: the anomaly confirmed in the second level is placed in the system operation context for comprehensive verification. The system load status, business traffic characteristics and known change events at the time of the anomaly occurrence are taken into account to determine whether the anomaly is a normal fluctuation within expectations.

5. The AI-based intelligent monitoring method for the operational status of an information system according to claim 1, characterized in that: Step S3 specifically includes the following steps: S3-1. Based on the unified resource model and historical monitoring data established in step S1, construct a causal graph of the information system. The nodes of the causal graph are the various observable variables of the system, and the directed edges represent the causal direction between variables. The observable variables include performance indicators, resource status, and configuration parameters. S3-2. When an anomaly occurs, use the anomaly indicator as the target variable, perform causal inference on the cause-effect diagram, calculate the causal effect of each candidate cause variable on the target anomaly, use backdoor adjustment or frontdoor adjustment strategies to eliminate the interference of confounding variables, and sort the candidate causes according to the size of the causal effect. S3-3. Validate and refine the candidate root cause list obtained from the causal effect estimation, and output the final root cause diagnosis report.

6. The AI-based intelligent monitoring method for the operational status of an information system according to claim 5, characterized in that: In step S3-1, the cause-effect graph is constructed using the following method: The system utilizes system architecture knowledge and resource dependencies to determine some causal relationships a priori; it employs constraint-based causal discovery algorithms and rating-based causal search algorithms to learn causal structures from historical data; it introduces domain knowledge rules to verify and correct the data-driven causal discovery results; and the causal graph has a dynamic update mechanism that is continuously optimized as the system architecture evolves and new data accumulates. In step S3-3, the verification method includes: The process includes: checking whether the candidate root cause occurred before the target anomaly (time priority test); checking whether the resource entity corresponding to the candidate root cause has a topological consistency with the anomaly resource entity through a dependency path test; and verifying the result through intervention simulation using counterfactual reasoning.

7. The AI-based intelligent monitoring method for the operational status of an information system according to claim 1, characterized in that: Step S4 specifically includes the following steps: S4-1, Multi-dimensional situation fusion, integrates the real-time anomaly detection results from step S2, the root cause analysis results from step S3, and the health status information extracted from the original monitoring data in multiple dimensions, and describes the system operation status from four dimensions: health, risk, redundancy, and trend. S4-2, Multivariate Time Series Forecasting: A multivariate time series forecasting model based on the Transformer architecture is used to make short-term and medium-term forecasts of key system performance indicators and resource usage. The forecast results include point forecast values ​​and forecast intervals. S4-3 Fault probability prediction: Construct a fault prediction classification model using the gradient boosting decision tree algorithm. The model takes the multi-dimensional features of the current operating state of the system as input and outputs the probability of a fault occurring within a specific time window in the future. S4-4 Automatic generation of situation briefings: The structured results of situational awareness and prediction are converted into natural language descriptions through a large language model to generate situation briefings.

8. The AI-based intelligent monitoring method for the operational status of an information system according to claim 1, characterized in that: Step S5 specifically includes the following steps: S5-1, Disposal Strategy Retrieval and Matching: A disposal strategy knowledge base containing disposal rules, best practices and historical success cases is pre-built and maintained. When the system detects an anomaly or predicts a potential risk, it retrieves and infers from the disposal strategy knowledge base based on the current situation information and selects the optimal disposal strategy. The inference process comprehensively considers the matching degree between the strategy and the current scenario, the historical success rate of the strategy, the execution risk of the strategy, and the potential impact of the strategy on other parts of the system. S5-2, New Scenario Adaptive Solution Generation: For new scenarios not covered in the knowledge base, zero-shot reasoning is performed based on a large language model to generate candidate solutions for manual review. S5-3. Automated handling execution: For confirmed handling strategies, the standardized automated execution interface is used for execution. The execution interface supports service restart, traffic switching, resource scaling, configuration adjustment and process termination operations, and records a complete operation log during the execution process.

9. The AI-based intelligent monitoring method for the operational status of an information system according to claim 8, characterized in that: Step S5 further includes step S5-4: The evaluation of the handling effect and the full-link feedback are carried out by continuously monitoring the changes in system status after the handling strategy is implemented, evaluating the handling effect, and evaluating indicators including whether the anomaly is eliminated, whether the system health is restored, and whether new problems are generated. The evaluation results are fed back to the handling strategy knowledge base to update the success rate statistics and priority ranking of the strategy. At the same time, the evaluation results are fed back to the dynamic baseline learning process in step S2 and the causal graph construction process in step S3 to carry out synchronous and continuous optimization of the handling strategy knowledge base, dynamic baseline and causal graph.

Images