A deep learning-based system background monitoring method and system

Abstract

The application discloses a kind of based on deep learning's system background monitoring method and system, it is related to computer technology field, comprising: acquisition multi-source heterogeneous monitoring data, obtain standardized multi-source monitoring data;Optimal monitoring feature set after dimension reduction is obtained by preprocessing;Multi-time scale local feature extraction is carried out, and multi-scale fusion feature map is obtained;Depth feature refining is carried out, and the deep-level feature sequence after refining is obtained;Time series dependence modeling is carried out, and abnormal detection result and abnormal confidence are output;The prediction model that training is single-step prediction is used to the deep-level feature sequence after refining, and iterative generation trend prediction result;Determine whether exceed preset threshold, if exceed, generate geographic reference alarm event, trigger automatic response chain.The application uses above-mentioned one kind based on deep learning's system background monitoring method and system, significantly improve the feature expression ability and abnormal detection accuracy of model to complex time series mode.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a system background monitoring method and system based on deep learning. Background Technology

[0002] With the rapid development of the Internet, big data, cloud computing and Internet of Things technologies, the scale of the back-end systems of various information systems and network platforms is constantly expanding and the system architecture is becoming increasingly complex. Back-end monitoring technology is of great significance for ensuring the safe and stable operation of the system.

[0003] Currently, system backend monitoring mainly relies on the following three types of technical methods: The first type is threshold-based monitoring methods, which manually set upper limits for various performance indicators and trigger alarms when monitoring data exceeds these limits. This method is simple to implement but struggles to cope with the dynamic and complex changes in the system backend environment. Fixed thresholds cannot be adaptively adjusted, leading to high false alarm and false negative rates. The second type is monitoring methods based on traditional machine learning, which extract manually generated features from monitoring data and train classification models for anomaly identification. This method heavily relies on manual feature engineering; the quality of feature extraction is limited by expert experience, making it difficult to capture deep nonlinear patterns and long-term temporal dependencies in the monitoring data, and the model's generalization ability is limited. The third type is deep learning-based monitoring methods, which use neural networks to automatically extract features from monitoring data for anomaly detection. This method improves feature learning capabilities compared to traditional methods, but still has the following shortcomings: First, existing methods mostly employ single-scale convolutional kernels for feature extraction, making it difficult to simultaneously capture local feature patterns at different time scales (second-level sudden fluctuations, minute-level trend changes, and hourly periodic patterns) in the system's backend monitoring data, thus limiting feature representation capabilities. Second, existing deep learning monitoring models mostly use shallow network structures, which are prone to gradient vanishing and optimization degradation problems as the number of network layers increases, making it difficult to improve feature extraction accuracy by deepening the network. Third, existing methods rely heavily on recurrent neural networks such as LSTM for time series modeling, whose serial computation mechanism leads to low training efficiency, and gradient decay still exists when modeling long sequences. Fourth, existing systems are mostly isolated systems with single monitoring functions, lacking the ability to uniformly collect, fuse, analyze, and collaboratively monitor multi-source heterogeneous data (performance indicators, system logs, network traffic, hardware status), with each monitoring system isolated from each other, and data cannot be effectively integrated. Fifth, existing systems lack adaptive feature selection mechanisms and class imbalance handling strategies, resulting in low model training efficiency and insufficient anomaly detection recall when facing the high-dimensional redundancy characteristics of the system's backend monitoring data and the scarcity of abnormal samples. Sixth, existing systems mostly adopt monolithic architecture deployment, lacking support from cloud-native technologies such as microservices and containerization. As a result, the systems have low scalability, maintainability, and resource scheduling efficiency, making it difficult to meet the deployment needs of large-scale cluster scenarios. Summary of the Invention

[0004] The purpose of this invention is to provide a system background monitoring method and system based on deep learning, thereby solving the problems mentioned in the background art.

[0005] To achieve the above objectives, this invention provides a system background monitoring method based on deep learning, comprising the following steps: S1. Multiple data acquisition agents deployed at each monitoring node in the system backend collect multi-source heterogeneous monitoring data in parallel, and transform and process the data to obtain standardized multi-source monitoring data. ; S2. Preprocess the standardized multi-source monitoring data and search for the optimal feature subset from the preprocessed high-dimensional feature space to obtain the optimal monitoring feature set after dimensionality reduction. S3. Extract local features at multiple time scales from the optimal monitoring feature set to obtain a multi-scale fused feature map; S4. Perform deep feature refinement on the multi-scale fused feature map to obtain the refined deep feature sequence. S5. Perform time-dependent modeling on the refined deep feature sequence, and input the modeled deep feature sequence into the fully connected classification layer after global average pooling, and output the anomaly detection result and anomaly confidence. S6. The refined deep feature sequence is trained using a prediction model for single-step prediction, and then recursively applied during inference. Next, the input window is updated iteratively by combining the current predicted value with known future exogenous features, and the process is repeated. Step trend prediction results; S7. Determine whether the anomaly detection results and trend prediction results exceed the preset thresholds. If they do, generate a geographic reference alarm event and trigger an automatic response chain. Display the real-time monitoring status, historical trends, and prediction curves through a visual interface.

[0006] Preferably, S2 includes: S21, Standardized multi-source monitoring data output by S1 Perform timestamp alignment; the data records after timestamp alignment are as follows: ; S22, output to S21 Handling missing values ​​in the data: If the proportion of missing values ​​is less than 5%, linear interpolation should be used to fill in the missing values. If the proportion of missing values ​​reaches 5% to 20%, the KNN imputation method is used to find the sample with the closest Euclidean distance to the missing sample. The weighted average of each complete sample is used as the imputed value; if the proportion of missing values ​​exceeds 20%, the corresponding feature dimension is discarded and marked as an invalid feature, not participating in subsequent modeling; the imputed data is denoted as... ; S23, the output of S22 Min-Max normalization is performed, mapping all feature values ​​to the interval [0,1]. The normalized data is denoted as... ; S24, Normalized data output from S23 As input, the BPSO algorithm is used from Searching for the optimal subset of features in the dimensional feature space, including: S241, Initialization One particle, =20, each particle represents a subset of candidate features; the first The position vectors of the particles are ,in, , =1 indicates selecting the first... One characteristic, =0 indicates that the first [item] is excluded. The first feature; the second The velocity vector of each particle is Set the maximum number of iterations. =50; S242, For each particle Based on its selected feature subset from Extract the corresponding feature subset data, and use a support vector machine classifier to calculate the classification accuracy on the validation set as the fitness value of the particle. ; S243. Record the individual optimal point of each particle. and global optimum ; S244. Update the velocity of each particle in each dimension according to the following formula: ; In the formula, For the first During the nth iteration The first particle Dimensional speed, For the first During the nth iteration The first particle The position of the dimension For the first The first particle The individual optimal point of dimensionality. The position of the global optimum dimension, For inertial weights, take =0.7, and Let be the acceleration constant, and take . =2, and for Random numbers within the interval; Position updates use binary update rules: ; ; In the formula, for Random numbers within the interval; S245. Repeat S242 to S244 until the maximum number of iterations is reached. Terminate when the fitness value reaches 50 or no longer improves after 10 consecutive iterations; output the global optimal position. As the optimal feature selection mask; S246, according to Extracting the final optimal monitoring feature set from the original features. ,in, The number of selected features.

[0007] Preferably, S3 includes: S31. The optimal monitoring feature set output by S246 As input, MSCNN is used for multi-scale parallel convolution processing. The convolution operation makes the dimensions of the output feature maps of each branch consistent so as to facilitate subsequent stitching. S32. The feature maps output from each branch of S31. , , By stitching along the channel dimension, a fused multi-scale feature map is obtained. ; S33, output to S32 A fusion convolution operation is performed to aggregate multi-scale information through 1D convolution, resulting in the final fused feature map. .

[0008] Preferably, S4 includes: S41, Fusion feature map based on S33 output Deep feature refinement is performed through multiple cascaded residual blocks. Each residual block is structured according to a given method. The input is denoted as... ; S42, Settings Several residual blocks are cascaded and stacked, with the first residual block outputting S33. As input, each subsequent residual block takes the output of the previous residual block as input and processes it sequentially, as shown in the following equation: ; ; ; In the formula, This represents the forward propagation calculation of a single residual block, with the third residual block output. The refined deep feature sequence .

[0009] Preferably, S41 includes: S411, Main branch input Perform the following operations in sequence: ; In the formula, and Here are the weight matrix and bias of the first convolutional layer. This indicates a convolution operation with a kernel size of 3. This indicates a batch normalization operation. It is the ReLU activation function. This is the intermediate feature tensor output by the first convolutional layer of the main branch of the residual block; ; In the formula, and The weight matrix and bias of the second convolutional layer are given. For random deactivation operation, deactivation rate =0.2, This is the deep feature tensor output by the second convolutional layer of the main branch of the residual block after random deactivation. S412, Shortcut Branch Input Perform the following processing: If the number of input channels is the same as the number of output channels, then the identity mapping is directly passed, and the output branch tensor is: ; If the number of input channels and the number of output channels are not the same, then... Convolution performs dimension alignment and outputs branch tensors: ; In the formula, and for The weight matrix and bias of the convolution; S413, The main branch feature output by S411 Shortcut branching feature of S412 output After element-wise addition, the output is activated by the following function: ; In the formula, This is the output for the residual block.

[0010] Preferably, S5 includes: S51, the refined deep feature sequence output by S42 Using TCN as input, time-series dependency modeling is performed, and TCN time-series features are output. ; S52. The TCN timing features output from S51 Inputting a global average pooling layer and a fully connected layer yields the anomaly confidence score: ; In the formula, For globally compressed feature vectors, This refers to the anomaly confidence score. This is the classification layer weight matrix. For bias terms, The Sigmoid activation function maps the output to... The interval is used as the anomaly confidence score; when When it is judged as abnormal, among which, The preset anomaly threshold is used; the anomaly detection output is a binary label. ,in, Indicates an anomaly. This indicates normality, and the corresponding anomaly confidence score. ; S53, as an equivalent replacement for the TCN architecture in S51, adopts a stacked GRU and multi-head attention combined architecture for timing modeling.

[0011] Preferably, the TCN network in S51 includes multiple stacked temporal convolutional blocks, each temporal convolutional block containing causal convolutions and dilated convolutions, specifically including: S511, Causal Convolution: The output of causal convolution At any moment From input The calculation shows that, The kernel size is the kernel size of the TCN. This ensures that convolution operations do not leak future information; S512, Dentular Convolution: The void ratio is progressively increased in each TCN block, exponentially expanding the receptive field as the number of layers increases. The receptive field of the layer TCN block is: ; In the formula, For the first The receptive field of the layered TCN block, The kernel size is [size]. For the first The void ratio of the TCN block; TCN block output The calculation is as follows: ; S513. Each TCN block uses a residual connection method, adding the input and output and then normalizing: ; In the formula, , Presentation layer normalization operation, For the first TCN block transformation of the layer.

[0012] Preferably, S53 includes: S531. The refined deep feature sequence output by S42 Input the stacked GRU layers, and set the number of LSTM layers. =2, output the first hidden state sequence. Second hidden state sequence : ; ; S532, The second hidden state sequence output by S531 Input multi-head attention layer, from Attention weights are computed in parallel across different subspaces. Each attention head independently learns feature relationships in different representation subspaces. After parallel computation by each head, the values ​​are concatenated and fused to output: ; in, ; In the formula, For the first The output features of an attention head , , The first The size of the word lookup, key, and value projection matrix. The dimension of the key vector; Obtain multi-head attention output: ; In the formula, To output the projection matrix, For multi-head attention output; S533. Add residual connections and layer normalization after the multi-head attention layer to obtain the temporal features after attention enhancement: ; In the formula, For the attention-enhanced temporal features, residual connections are used to preserve the original GRU output information, and layer normalization is used to stabilize the training process. S534, output from S533 After global average pooling, the data is input into a fully connected classification layer to obtain anomaly confidence scores. The method for determining anomalies is the same as that for S52.

[0013] Preferably, S6 includes: S61. Employs the same temporal modeling architecture as S5, setting the training objective as single-step prediction; uses the refined deep feature sequence output by S42. As input, the monitored value at a future time step. To predict the target, train a single-step prediction model. : ; In the formula, For the historical monitoring window at time t, This is the predicted value for the next moment. This is the set of trainable parameters for the model, including convolutional layer weights, GRU layer weights, attention layer parameters, and fully connected layer weights. S62. In the inference phase, the single-step prediction model trained in S61 is... Recursive application Next, generate Step trend prediction results; assuming the initial input window is... ,in, The length of the history window; for the first Step prediction The model uses the current input window. Given the input, output the next predicted value: ; In the formula, For the first The predicted value of the step, For the first The input window after one recursive step; S63. The predicted value output by S62 With known future exogenous characteristics Combine them to form a new row of data: ; In the formula, For the first The known future exogenous characteristics at a given time. For splicing operations; Will Append to the end of the current input window and remove the oldest data row from the front of the window, maintaining the window length. constant: ; In the formula, This is a rolling update operation, specifically a deletion. The first line, append For the last line; S64. Repeat steps S62 and S63 until all are generated. Step-by-step predicted values, output trend prediction sequence: ; In the formula, From The future begins at any moment The sequence of trend prediction results for each step.

[0014] A system for system background monitoring based on deep learning includes: a multi-agent data acquisition layer, a data preprocessing and feature optimization layer, a multi-scale feature extraction layer, a residual feature refinement layer, a time series modeling and anomaly detection layer, a recursive trend prediction layer, an early warning and visualization layer, a system security management layer, and a microservice architecture and containerized deployment layer.

[0015] Therefore, the present invention employs the above-mentioned deep learning-based system background monitoring method and system, which has the following beneficial effects: (1) This invention adopts a multi-branch parallel convolution structure in multi-scale feature extraction, with each branch using a convolution kernel of a different size. This enables the simultaneous capture of local features at multiple time scales, such as second-level sudden fluctuations, minute-level trend changes, and hour-level periodic patterns, in the system's background monitoring data. This significantly improves the model's feature expression capability for complex time-series patterns and the accuracy of anomaly detection.

[0016] (2) This invention establishes a gradient highway by cascading residual blocks after multi-scale convolution and using the identity mapping of shortcut branches, so that the gradient can be directly propagated from the back layer to the front layer, which effectively alleviates the gradient vanishing and optimization degradation problems of deep networks, supports the construction of deeper monitoring models to extract higher-level abstract semantic features, and improves the model's representation ability.

[0017] (3) In the temporal modeling, the present invention uses dilated convolution to expand the receptive field exponentially layer by layer, so that the model can effectively capture long-range temporal dependencies while maintaining computational efficiency. Compared with recurrent neural networks, it has a faster training speed and no risk of gradient vanishing. The multi-head attention mechanism calculates attention weights in parallel from multiple subspaces, which can simultaneously capture different types of temporal dependency patterns in the monitoring data and dynamically focus on the key time step that contributes the most to the anomaly judgment.

[0018] (4) The present invention adopts a microservice architecture combined with Docker containerization and Kubernetes container orchestration technology to decouple and deploy each service module of the system, supporting independent development, deployment, expansion and fault isolation of each functional module, improving the scalability, maintainability and resource scheduling efficiency of the system; the containerized deployment method supports rapid elastic scaling and adapts to dynamic load changes in large-scale cluster monitoring scenarios.

[0019] (5) This invention automatically selects the optimal feature subset from high-dimensional monitoring data through the BPSO adaptive feature selection mechanism, which effectively reduces the dimension of input data, reduces the computational overhead and storage cost of model training, and eliminates the interference of redundant features and noisy features. The Target Sampling strategy effectively solves the problem of severe imbalance between normal and abnormal samples in the system's background monitoring data by downsampling normal samples and fully retaining abnormal samples, and significantly improves the model's detection recall rate for rare abnormal types.

[0020] (6) Based on the federation principle, this invention constructs a multi-agent collaborative acquisition architecture. Each monitoring node deploys an independent agent to collect multi-source heterogeneous data in parallel, realizing the unification of autonomous acquisition and central coordination processing in each monitoring domain. It has high availability and fault tolerance, and the failure of a single node does not affect the operation of the overall system. The three-level security protection mechanism ensures that the data is secure and controllable in all aspects of storage, transmission and access.

[0021] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0022] Figure 1 This invention relates to a deep learning-based system background monitoring system. ; Figure 2 This is a flowchart of a system background monitoring method based on deep learning according to the present invention. Detailed Implementation

[0023] The technical solution of the present invention will be further described below with reference to the accompanying drawings and embodiments.

[0024] Unless otherwise defined, the technical or scientific terms used in this invention shall have the ordinary meaning understood by one of ordinary skill in the art to which this invention pertains. The terms "first," "second," and similar terms used in this invention do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Terms such as "comprising" or "including" mean that the element or object preceding the word encompasses the elements or objects listed following the word and their equivalents, without excluding other elements or objects. Terms such as "connected" or "linked" are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. Terms such as "upper," "lower," "left," and "right" are used only to indicate relative positional relationships; when the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0025] Example Please see Figures 1-2 This invention provides a system background monitoring system based on deep learning, comprising: The multi-agent data acquisition layer is deployed on various monitoring nodes in the system backend. Each agent contains an independent data acquisition module, protocol conversion module, and local cache module. The data acquisition module is used to collect multi-source heterogeneous monitoring data from the system backend, including performance index data, system log data, network traffic data, and hardware status data. The protocol conversion module adopts a configuration-decoupled architecture, converting heterogeneous protocols from different data sources into a unified internal data format through protocol conversion components, and performing step-by-step conversion of the original data through a converter serial accumulation mode. The local cache module is used to temporarily store the collected data when the network is interrupted.

[0026] The data preprocessing and feature optimization layer receives unified format data output from the multi-agent data acquisition layer, including a tensor alignment module, a missing value handling module, a normalization module, and a feature selection module. The tensor alignment module is used to perform timestamp alignment and sliding window continuity verification on multi-source heterogeneous data, generating aligned three-dimensional tensor data. The feature selection module adopts the BPSO (Binary Particle Swarm Optimization) algorithm, taking the feature vectors of the three-dimensional tensor data after embedding and mapping as input, and iteratively searches for the optimal feature subset through particle swarm optimization, outputting the optimal monitoring feature set after dimensionality reduction.

[0027] The multi-scale feature extraction layer receives the optimal monitoring feature set, including the MSCNN (Multi-Scale Convolutional Neural Network) module. The MSCNN module contains multiple parallel 1D convolutional branches. Each branch uses convolutional kernels of different sizes to capture local pattern features at different time scales. The feature maps output by each branch are spliced ​​and fused along the channel dimension to output a multi-scale fused feature map.

[0028] The residual feature refinement layer receives multi-scale fused feature maps, including multiple cascaded residual blocks. Each residual block contains a main branch and a shortcut branch. The main branch consists of a first convolutional layer, a first batch normalization layer, a first ReLU activation layer, a Dropout layer, a second convolutional layer, and a second batch normalization layer. The shortcut branch performs identity mapping or dimension alignment mapping on the input feature map. The outputs of the main branch and the shortcut branch are added element-wise and then output through an activation function to obtain the refined deep feature sequence.

[0029] The temporal modeling and anomaly detection layer receives refined deep feature sequences and includes a temporal modeling module and an anomaly determination module. The temporal modeling module adopts a TCN (Temporal Convolutional Network) or a stacked GRU combined with multi-head attention architecture to model the temporal dependencies of the feature sequences. The TCN uses causal convolution and dilated convolution, which exponentially expands the receptive field to capture long-range temporal dependencies. The stacked GRU and multi-head attention architecture includes multiple stacked GRU layers, multi-head attention layers, residual connection layers, and layer normalization layers. The multi-head attention layer computes attention weights in parallel from multiple subspaces to dynamically focus on key time steps. The anomaly determination module inputs the output of the temporal modeling module into the fully connected classification layer after global average pooling, and outputs the anomaly detection results and anomaly confidence.

[0030] The recursive trend prediction layer receives refined deep feature sequences, including prediction models trained for single-step prediction. During inference, a recursive multi-step prediction strategy is adopted, which combines the current prediction value with known future exogenous features to continuously update the input window and iteratively generate multi-step trend prediction results.

[0031] The early warning and visualization layer receives anomaly detection results and multi-step trend prediction results, including an alarm event generation module, an automatic response module, and a visualization display module. When the anomaly detection result or trend prediction result exceeds a preset threshold, the alarm event generation module generates a georeferenced alarm event containing a timestamp, monitoring object identifier, and event type. The automatic response module triggers the corresponding automatic response chain according to the alarm event type, including starting a new processing flow, notifying the responsible person, and adjusting monitoring parameters. The visualization display module is used to display the real-time monitoring status, historical trends, and prediction curves.

[0032] The system security management layer communicates with each of the aforementioned layers and includes a three-tier security protection module. This module comprises an infrastructure-level encrypted storage submodule, a communication-level HTTPS / SSL encrypted transmission submodule, and an application-level RBAC (Role-Based Access Control) and authorization token management submodule. The application-level RBAC and authorization token management submodule is used to perform fine-grained authentication and access control on service calls and user operations at each layer, ensuring that data owners have access control permissions at each processing stage.

[0033] The microservice architecture and containerized deployment layer provides underlying infrastructure support for the above layers, including a service registration and discovery module, a container orchestration module, and a system monitoring module. The service registration and discovery module encapsulates the system services based on Docker containers and performs container orchestration and elastic scaling through a Kubernetes cluster. The system monitoring module uses Prometheus and Grafana to monitor the running status of services at each layer in real time.

[0034] A deep learning-based system backend monitoring method includes the following steps: S1. Multi-Agent Data Acquisition and Protocol Conversion Steps: Multiple data acquisition agents deployed on various monitoring nodes in the system backend collect multi-source heterogeneous monitoring data in parallel, including performance index data, system log data, network traffic data, and hardware status data. For each data source, a configurable protocol conversion component converts heterogeneous protocols into a unified internal data format, and then performs step-by-step conversion using a converter in a serial accumulation mode to obtain standardized multi-source monitoring data. This includes the following steps: S11. Multi-agent deployment and parallel data acquisition: Data acquisition agents are deployed on each monitoring node in the system backend, and each agent independently executes data acquisition tasks. Each agent collects multi-source heterogeneous monitoring data in parallel according to a preset acquisition cycle, including performance index data (CPU utilization, memory usage, disk I / O, network bandwidth), system log data (operating system logs, application service logs, security logs), network traffic data (packet size, number of connections, protocol type distribution), and hardware status data (temperature, voltage, fan speed). S12. Configurable Protocol Conversion: For heterogeneous communication protocols from various data sources, a protocol conversion component converts different protocols into a unified internal data format. The protocol conversion component adopts a configuration-based decoupling architecture, defining message parsing rules through XML configuration files, including message header parsing rules, message variable parsing rules, and data conversion rules. For standard protocols (ModbusTCP, HTTP, MQTT), the corresponding message parser is directly matched for parsing. For custom protocols, message parser plugins are developed to extend the functionality and are dynamically loaded and used in the XML configuration file. S13. Serial Accumulation Processing with Converters: The unified format data output from S12 is input into the serial accumulation pipeline of converters for step-by-step conversion. In the serial accumulation mode, the output of each converter serves as the input to the next converter, and the processing result of the previous converter is passed to the next converter for further processing. Multiple converters are connected in series to achieve multi-level conversion of the original data. Each converter is configured with its own parameters, and different conversion functions are achieved through different combinations of converters and parameter configurations. Converter types include unit converters, range converters, encoding converters, format converters, and verification converters. Among them, unit converters are used to unify different units into standard units, range converters are used to map different ranges to a unified range, encoding converters are used to unify different character encodings into UTF-8, format converters are used to convert different data formats into a unified structured format, and verification converters are used to verify the integrity and legality of the data. After processing by all converters, standardized multi-source monitoring data is output. ,in, for The monitoring data vector at any given moment, For the overall dimensions of monitoring indicators, This represents the length of the time window.

[0035] S2. Data Preprocessing and Feature Optimization Steps: Based on standardized multi-source monitoring data, timestamp alignment, missing value imputation, and normalization are performed. The BPSO (Binary Particle Swarm Optimization) algorithm is used to search for the optimal feature subset in the normalized high-dimensional feature space, obtaining the optimal monitoring feature set after dimensionality reduction. This includes the following steps: S21, Timestamp Alignment and Tensor Verification: Standardizing the multi-source monitoring data output from S13. Timestamp alignment is performed to synchronize all monitoring data according to a unified time base. During daylight saving time switching periods, standard time zone processing methods are used to convert the time to UTC. The continuity of sliding window boundaries is checked to ensure there are no time intervals or overlaps between adjacent windows. If time intervals exist between windows, missing data is filled in using linear interpolation. If time overlaps exist between windows, a deduplication strategy is used to retain data from the later window. The timestamp-aligned data records are as follows: ; S22, Missing value imputation processing: This involves processing the output of S21. Missing values ​​are handled; if the proportion of missing values ​​is less than 5%, linear interpolation is used for imputation. The linear interpolation formula is: ; In the formula, For the time to be interpolated interpolated value, and These are the adjacent moments before and after the missing moment. and monitoring values ; If the missing value ratio reaches 5%~20%, the KNN (K Nearest Neighbor) imputation method is used to find the K complete samples with the closest Euclidean distance to the missing sample and take their weighted average as the imputation value; if the missing value ratio exceeds 20%, the corresponding feature dimension is discarded and marked as an invalid feature and not included in subsequent modeling; the data after imputation is denoted as . ; S23, Min-Max Normalization Processing: This involves normalizing the output of S22. Min-Max normalization is performed to map all feature values ​​to the interval [0, 1], eliminating dimensional differences between different monitoring indicators. The normalization formula is: ; In the formula, For the first Time of the first The raw values ​​of each monitoring indicator and These are the minimum and maximum values ​​of the first monitoring indicator over the entire time window, respectively. The normalized value; the normalized data is denoted as ; S24, BPSO Optimal Feature Selection: Using the normalized data output from S23 As input, the BPSO (Binary Particle Swarm Optimization) algorithm is used to... The BPSO algorithm searches for the optimal subset of features in the 3D feature space. It models feature selection as a binary optimization problem, with the specific process as follows: S241. Initialize the particle swarm: Initialize One particle, =20, each particle represents a subset of candidate features; the first The position vectors of the particles are ,in, , =1 indicates selecting the first... One characteristic, =0 indicates that the first [item] is excluded. The first feature; the second The velocity vector of each particle is Set the maximum number of iterations. =50; S242, Fitness Assessment: For each particle Based on its selected feature subset from Extract the corresponding feature subset data, and use a support vector machine classifier to calculate the classification accuracy on the validation set as the fitness value of the particle. : ; In the formula, Indicates based on particles The subset of data extracted from the selected feature columns. The classification accuracy on the validation set; S243. Update individual and global optima: Record the individual optimal point of each particle. (The position that maximizes fitness) and the global optimum (The position with the highest fitness among all particles); S244. Update particle velocity and position: Update the velocity of each particle in each dimension according to the following formula: ; In the formula, For the first During the nth iteration The first particle Dimensional speed, For the first During the nth iteration The first particle The position of the dimension For the first The first particle The individual optimal point of dimensionality. The position of the global optimum dimension, For inertial weights, take =0.7, and Let be the acceleration constant, and take . =2, and for Random numbers within the interval; position updates use binary update rules: ; ; In the formula, for Random numbers within the interval; S245. Termination condition judgment: Repeat S242 to S244 until the maximum number of iterations is reached. Terminate when the fitness value reaches 50 or no longer improves after 10 consecutive iterations; output the global optimal position. As the optimal feature selection mask; S246. Output the optimal feature subset: based on Extracting the final optimal monitoring feature set from the original features. ,in, The number of selected features.

[0036] S3. Multi-scale Feature Extraction Steps: Based on the optimal monitoring feature set, MSCNN (Multi-scale Convolutional Neural Network) is used for multi-timescale local feature extraction. Multiple parallel 1D convolutional branches, each using a different sized kernel, capture local patterns at different time scales. The outputs of each branch are concatenated and fused along the channel dimension to obtain a multi-scale fused feature map. This includes the following steps: S31, Parallel Multi-Branch 1D Convolution Extraction: Extracting the optimal monitoring feature set output from S246. As input, MSCNN is used for multi-scale parallel convolution processing, and settings are configured. Several parallel 1D convolutional branches, set =3, using convolutional kernels of different sizes to capture local pattern features at different time scales, among which the short-scale convolutional kernel Capturing second-level sudden fluctuations, mesoscale convolution kernels Capturing minute-level trend changes with long-scale convolution kernels Capture hourly periodic patterns; the convolution operations for each branch are as follows: ; In the formula, For the first The output feature map of each branch after convolution operation Indicates the kernel size as One-dimensional convolution operation, For the first The convolution kernel weight matrix of each branch, For bias terms, ReLU activation function , For the first The number of convolutional kernels in each branch; the kernel size of each branch are respectively , , These correspond to local receptive fields for 3 time steps (approximately seconds), 5 time steps (approximately minutes), and 7 time steps (approximately hours), respectively; each branch has 32 convolutional kernels, and the convolutional operation ensures that the dimensions of the output feature maps of each branch are consistent for subsequent stitching. S32, Multi-scale Feature Concatenation and Fusion: Combine the feature maps output from each branch of S31. , , By stitching along the channel dimension, a fused multi-scale feature map is obtained: ; In the formula, The spliced ​​multi-scale fusion feature map has the number of channels as the sum of the number of channels in the three branches (32+32+32=96). S33, Convolutional Fusion: Fusion of the output of S32 A fusion convolution operation is performed to aggregate multi-scale information through 1D convolution, resulting in the final fused feature map: ; In the formula, The output feature map after fusion convolution, the kernel size The number of convolution kernels is 64. To fuse the convolution weight matrices, For bias terms, This is the ReLU activation function.

[0037] S4. Residual Feature Refinement Steps: Based on the multi-scale fused feature map, deep feature refinement is performed through multiple cascaded residual blocks. Each residual block extracts deep features through convolutional transformation in the main branch, while shallow features are passed through identity mapping in the shortcut branch. The outputs of the main branch and the shortcut branch are added element-wise to obtain the refined deep feature sequence. This includes the following steps: S41. Residual block stacking construction: Based on the fused feature map output by S33 Deep feature refinement is performed through multiple cascaded residual blocks. Each residual block is structured according to the following steps, with the input denoted as... : S411, Main Branch Feature Transformation: Main branch changes the input Perform the following operations in sequence: ; In the formula, and Here are the weight matrix and bias of the first convolutional layer. This represents a convolution operation with a kernel size of 3, and BN represents batch normalization. It is the ReLU activation function. This is the intermediate feature tensor output by the first convolutional layer of the main branch of the residual block; ; In the formula, and The weight matrix and bias of the second convolutional layer are given. For random deactivation operation, deactivation rate =0.2, This is the deep feature tensor output by the second convolutional layer of the main branch of the residual block after random deactivation. S412, Shortcut Branch Passing: Shortcut branch passes input... Perform the following processing: If the number of input channels is the same as the number of output channels, then the identity mapping is directly passed, and the output branch tensor is: ; If the number of input channels and the number of output channels are not the same, then... Convolution performs dimension alignment and outputs branch tensors: ; In the formula, and for The weight matrix and bias of the convolution; S413, Residual Connection Output: This outputs the main branch characteristic from S411. Shortcut branching feature of S412 output After element-wise addition, the output is activated by the following function: ; In the formula, The output is a residual block; each residual block contains two convolutional operations, and a gradient highway is established through the identity mapping of the shortcut branch, so that the gradient can be directly passed from the back layer to the front layer, which alleviates the gradient vanishing problem in deep networks. S42, Cascaded Residual Processing: Settings Cascaded and stacked residual blocks, set =3; the first residual block is output in S33. As input, each subsequent residual block uses the output of the previous residual block as input, and processes them sequentially: ; ; ; In the formula, This represents the forward propagation calculation of a single residual block, with the third residual block output. That is, the refined deep feature sequence .

[0038] S5. Temporal Modeling and Anomaly Detection Steps: Based on the refined deep feature sequences, temporal dependency modeling is performed using a TCN (Temporal Convolutional Network) or a stacked GRU combined with multi-head attention architecture to capture long-range temporal dependencies in the feature sequences. The temporally modeled feature sequences are then input into a fully connected classification layer after global average pooling, outputting anomaly detection results and anomaly confidence scores. This includes the following steps: S51, TCN temporal modeling: using the refined deep feature sequence output by S42 For input, a Temporal Convolutional Network (TCN) is used for temporal dependency modeling; the TCN network consists of multiple stacked temporal convolutional blocks, each containing causal convolutions and dilated convolutions: S511, Causal Convolution: Ensures that the convolution output at the current time step depends only on the inputs at the current and previous time steps, without introducing information from future time steps; the output of causal convolution... At any moment From input The calculation shows that, The kernel size is the kernel size of the TCN. This ensures that convolution operations do not leak future information; S512, Dilated Convolution: The dilation rate is progressively increased in each TCN block, exponentially expanding the receptive field as the number of layers increases. The receptive field of the layer TCN block is: ; In the formula, For the first The receptive field of the layered TCN block, The kernel size is [size]. For the first The void ratio of the TCN block in each layer; the void ratio of each layer is calculated as follows: ( ) settings, i.e., layer 1 , second floor , third floor , 4th floor Experience the exponential growth of the wilderness with each layer: , , , TCN block output The calculation is as follows: ; S513, Residual Connection: Each TCN block uses a residual connection method, which adds the input and output and then normalizes them. ; In the formula, , Presentation layer normalization operation, For the first TCN block transformation of the layer; S52, Anomaly Confidence Calculation: Calculate the TCN time series features output from S513. Inputting a global average pooling layer and a fully connected layer yields the anomaly confidence score: ; Global compressed feature vector The following formula is used to calculate: ; In the formula, This represents the anomaly confidence score. This is the classification layer weight matrix. For bias terms, The Sigmoid activation function maps the output to... The interval is used as the anomaly confidence score; when When it is judged as abnormal, among which, To preset an abnormal threshold, The anomaly detection output is a binary label. ,in, Indicates an anomaly. This indicates normality, and the corresponding anomaly confidence score. ; S53, as an equivalent replacement for the TCN architecture in S51, adopts a stacked GRU and multi-head attention combined architecture for timing modeling: S531, Stacked GRU Encoding: This process transforms the refined deep feature sequence output from S42... Input the stacked GRU layers, and set the number of LSTM layers. =2, the number of hidden units in the first layer is 128, the number of hidden units in the second layer is 64, output the first hidden state sequence. Second hidden state sequence : ; ; The gating mechanism of the GRU unit is as follows: update the proportion of the hidden state that was retained from the previous moment to the current moment, and reset the proportion of the hidden state that was ignored from the previous moment: ; In the formula, To update the gate output, and To update the gate weight matrix, Input time, This is the hidden state from the previous moment; ; In the formula, To reset the gate output, and To reset the weight matrix of the gate; ; In the formula, In the candidate hidden state, and Let be the weight matrix of the candidate hidden states. This is element-wise multiplication; ; In the formula, The final hidden state at time t is obtained by stacking the hidden states at all times. The complete sequence formed later Input a multi-head attention layer.

[0039] S532, Multi-head Attention Weighting: This involves weighting the GRU hidden state sequence output by S531. Input multi-head attention layer, from Attention weights are computed in parallel across different subspaces. =4, each attention head independently learns the feature relationships in different representation subspaces, and the heads are concatenated and fused after parallel computation: ; in, ; In the formula, , , The first The projected matrix of query, key, and value for each size. Let be the dimension of the key vector. ; Obtain multi-head attention output: ; In the formula, To output the projection matrix, For multi-head attention output; S533, Residual Connections and Layer Normalization: Residual connections and layer normalization are added after the multi-head attention layer to obtain the temporal features after attention enhancement. ; In the formula, For the attention-enhanced temporal features, residual connections are used to preserve the original GRU output information, and layer normalization is used to stabilize the training process. S534, Anomaly Confidence Calculation: Calculate the output of S533. After global average pooling, the data is input into a fully connected classification layer to obtain anomaly confidence scores. The method for determining anomalies is the same as that for S52.

[0040] S6. Recursive Multi-Step Trend Prediction Steps: Based on the refined deep feature sequence, a prediction model trained for single-step prediction is used, and recursively applied during inference. Next, the input window is updated iteratively by combining the current predicted value with known future exogenous features, and the process is repeated. Step-by-step trend prediction results. This includes the following steps: S61, Single-Step Prediction Model Training: Employing the same temporal modeling architecture as S5 (TCN or GRU and MHA), the training objective is set to single-step prediction; using the refined deep feature sequence output by S42. As input, the monitored value at a future time step. To predict the target, train a single-step prediction model. : ; In the formula, For the historical monitoring window at time t, This is the predicted value for the next moment. This is the set of trainable parameters for the model, including convolutional layer weights, GRU layer weights, attention layer parameters, and fully connected layer weights. The loss function for the single-step prediction model uses the mean squared error: ; In the formula, For batch size, For the first The true value of each sample For the first Predicted values ​​for each sample; S62, Recursive Multi-Step Prediction: During the inference phase, the single-step prediction model trained in S61 is... Recursive application Next, generate Step trend prediction results; assuming the initial input window is... ,in, The length of the history window; for the first Step prediction The model uses the current input window. Given the input, output the next predicted value: ; In the formula, For the first The predicted value of the step, For the first The input window after one recursive step; S63, Input window scrolling update: Update the predicted value output by S62. With known future exogenous characteristics Combine them to form a new row of data: ; In the formula, For the first The known future exogenous features of a given time (including time features such as hour, day of the week, and holiday identifiers, obtained directly from the timestamp, without involving predictions of future observations) For splicing operations; Append to the end of the current input window and remove the oldest data row from the front of the window, maintaining the window length. constant: ; In the formula, This is a rolling update operation, specifically a deletion. The first line, append For the last line; S64. Trend Prediction Result Output: Repeat steps S62 and S63 until all results are generated. Step-by-step predicted values, output trend prediction sequence: ; In the formula, From The future begins at any moment The trend prediction result sequence of the step, take =24 (corresponding to 24 future time steps).

[0041] S7. Anomaly Warning and Visualization Steps: Based on anomaly detection results and trend prediction results, when the detection or prediction results exceed a preset threshold, a georeferenced alarm event containing a timestamp, monitored object identifier, and event type is generated, triggering an automatic response chain; and the real-time monitoring status, historical trends, and prediction curves are displayed through a visualization interface. This includes the following steps: S71, Dynamic Judgment of Default Value: This determines the anomaly confidence score output by S52. Compared with the preset abnormal threshold Compare and predict the sequence based on the trend output of S64. Determine if future trends exceed a safety threshold The exception detection logic is as follows: ; in, The threshold for anomaly confidence is preset based on the false alarm tolerance of the specific monitoring scenario; As a safety threshold for monitoring indicators, when the predicted value exceeds... Timely triggering of warnings; S72, Geographic Reference Alarm Event Generation: When S71 determines that Alert=True, a geographic reference alarm event is generated. ; In the formula, For the alarm event object, The timestamp that triggered the alarm. As a unique identifier for the monitored object, For event types (including "performance anomaly", "log anomaly", "network anomaly", "trend limit exceeded", etc.), For abnormal confidence levels , For predicted values ​​that exceed the threshold, Identify the geographical or logical location of the monitored object; S73, Automatic Response Chain Trigger: Based on the alarm event generated in S72. In Find the preset response strategy and execute the corresponding automatic response chain: S731, if For "performance anomaly": Initiate the performance diagnostic process, automatically collect relevant related indicator data of the monitored object, and send a diagnostic report to the person responsible for operation and maintenance; S732, if "Trend Exceeds Limits": Triggers the forecasting and early warning process, changing the trend forecasting sequence. Send the data to the dispatch system so that dispatchers can make resource adjustments in advance; S733, if For "log anomaly" or "network anomaly": trigger the security response process, automatically isolate the abnormal node, record the anomaly context information, and notify the security personnel in charge; S74. Multi-level early warning and graded notification: based on anomaly confidence level. And the degree of deviation from the prediction The warning levels are determined and are divided into three levels: general warning, major warning, and critical warning. when or When this is determined to be a general warning, an email notification is triggered; when or When this is deemed a major warning, both email and SMS notifications are triggered. when or When the situation is deemed critical, a triple notification is triggered via email, SMS, and telephone voice message. S75. Visualization: Displaying anomaly detection results Anomaly confidence score Trend prediction sequence and alarm events The ECharts visualization library provides multi-dimensional displays, including real-time monitoring data dashboards, anomaly detection result annotations, trend prediction curves, and alarm event lists. It also supports interactive queries and data filtering through a large visualization screen.

[0042] The following specific examples will further illustrate this method.

[0043] An internet company has 200 backend servers and needs to monitor 20 performance indicators, including CPU utilization, memory usage, disk I / O, network bandwidth, and response time, to promptly detect anomalies and issue warnings.

[0044] S1, Multi-agent data acquisition and protocol conversion.

[0045] One data acquisition agent is deployed on each of 200 servers, resulting in 200 agents collecting data in parallel on 20 metrics, including CPU utilization, memory usage, disk I / O, network bandwidth, and response time. Each agent collects data every 30 seconds and reports it to a protocol conversion component via the ModbusTCP protocol. The data is then uniformly converted to JSON format according to the XML configuration rules, and finally standardized by a unit converter before outputting standardized data. .

[0046] get The shape is 168×20, which is 20-dimensional monitoring data from the past 168 moments (84 minutes).

[0047] S2. Data preprocessing and feature optimization.

[0048] right Timestamp alignment was performed, and data missing at a certain time was found and filled in using linear interpolation. Min-Max normalization was then applied to map all indicators to the [0,1] interval. Finally, the BPSO algorithm (20 particles, 50 iterations) was used to select the optimal feature subset from the 20-dimensional features. .

[0049] get The shape is 168×13. BPSO screens out 13 key features (such as CPU utilization, response time, network bandwidth, disk queue length, etc., 7 redundant indicators are excluded).

[0050] S3, Multi-scale Feature Extraction.

[0051] Will The input is to the MSCNN module, where three parallel convolutional branches (k=3 / 5 / 7, each with 32 filters) capture second-level (approximately 1.5 minutes) fluctuations, minute-level (approximately 2.5 minutes) trends, and hour-level (approximately 3.5 minutes) periodic patterns, respectively. These patterns are then concatenated and output via a fusion convolution. .

[0052] get The shape is 168×64.

[0053] S4. Residual feature refinement.

[0054] Will Passing through 3 residual blocks in sequence (two levels of main branch, identity mapping of shortcut branch) The main branch output and the shortcut branch output are added element-wise and then activated by ReLU, resulting in the output. .

[0055] get The shape is 168×64.

[0056] S5, Temporal Modeling and Anomaly Detection.

[0057] by For input, a TCN network (4 layers, convolutional kernels) =3, void ratio =1 / 2 / 4 / 8) Output After global average pooling, the result is ∈R64, then through a fully connected layer and a sigmoid function to output the anomaly confidence score. =0.92.

[0058] get =0.92, exceeding the preset threshold of 0.7, and is therefore judged as abnormal.

[0059] S6, Recursive Multi-Step Trend Prediction.

[0060] With the same Input single-step prediction model Recursively predict the CPU utilization trend over the next 24 time points (12 minutes), output: Predictions indicate that CPU utilization will exceed 85% at the 18th moment.

[0061] The trend prediction sequence is obtained, indicating that the limit is about to be exceeded.

[0062] S7, Anomaly Warning and Visualization.

[0063] because =0.92≥0.9, which is considered a critical warning, triggering triple notification to the operations and maintenance manager via email, SMS and telephone; at the same time, the anomaly label and trend curve are displayed on the visualization screen, and the operations and maintenance personnel immediately intervene to handle the situation, confirm that it is caused by an abnormal process of a certain server, and complete the repair in a timely manner.

[0064] Therefore, the present invention adopts the above-mentioned deep learning-based system background monitoring method and system. By using a multi-branch parallel convolution structure in multi-scale feature extraction, with each branch using a convolution kernel of different size, it can simultaneously capture local features of multiple time scales in the system background monitoring data, such as second-level sudden fluctuations, minute-level trend changes and hour-level periodic patterns. This significantly improves the model's feature representation ability for complex time-series patterns and the accuracy of anomaly detection.

[0065] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit them. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the technical solutions of the present invention, and these modifications or equivalent substitutions cannot cause the modified technical solutions to deviate from the spirit and scope of the technical solutions of the present invention.

Claims

1. A system background monitoring method based on deep learning, characterized in that, Includes the following steps: S1. Multiple data acquisition agents deployed at each monitoring node in the system backend collect multi-source heterogeneous monitoring data in parallel, and transform and process the data to obtain standardized multi-source monitoring data. ; S2. Preprocess the standardized multi-source monitoring data and search for the optimal feature subset from the preprocessed high-dimensional feature space to obtain the optimal monitoring feature set after dimensionality reduction. S3. Extract local features at multiple time scales from the optimal monitoring feature set to obtain a multi-scale fused feature map; S4. Perform deep feature refinement on the multi-scale fused feature map to obtain the refined deep feature sequence. S5. Perform time-dependent modeling on the refined deep feature sequence, and input the modeled deep feature sequence into the fully connected classification layer after global average pooling, and output the anomaly detection result and anomaly confidence. S6. The refined deep feature sequence is trained using a prediction model for single-step prediction, and then recursively applied during inference. Next, the input window is updated iteratively by combining the current predicted value with known future exogenous features, and the process is repeated. Step trend prediction results; S7. Determine whether the anomaly detection results and trend prediction results exceed the preset threshold. If they do, generate a geographic reference alarm event and trigger an automatic response chain. It also displays real-time monitoring status, historical trends, and forecast curves through a visual interface.

2. The system background monitoring method based on deep learning according to claim 1, characterized in that, S2 includes: S21, Standardized multi-source monitoring data output by S1 Perform timestamp alignment; the data records after timestamp alignment are as follows: ; S22, output to S21 Handling missing values ​​in the data: If the proportion of missing values ​​is less than 5%, linear interpolation should be used to fill in the missing values. If the proportion of missing values ​​reaches 5% to 20%, the KNN imputation method is used to find the sample with the closest Euclidean distance to the missing sample. The weighted average of the complete samples is used as the imputation value; if the proportion of missing values ​​exceeds 20%, the corresponding feature dimension is discarded and marked as an invalid feature, not participating in subsequent modeling; the data after imputation is denoted as... ; S23, the output of S22 Min-Max normalization is performed, mapping all feature values ​​to the [0,1] interval. The normalized data is denoted as... ; S24, Normalized data output from S23 As input, the BPSO algorithm is used from Searching for the optimal subset of features in the dimensional feature space, including: S241, Initialization One particle, =20, each particle represents a subset of candidate features; the first The position vectors of the particles are ,in, , =1 indicates selecting the first... One characteristic, =0 indicates that the first [item] is excluded. The first feature; the second The velocity vector of each particle is Set the maximum number of iterations. =50; S242, For each particle Based on its selected feature subset from Extract the corresponding feature subset data, and use a support vector machine classifier to calculate the classification accuracy on the validation set as the fitness value of the particle. ; S243. Record the individual optimal point of each particle. and global optimum ; S244. Update the velocity of each particle in each dimension according to the following formula: ； In the formula, For the first During the nth iteration The first particle Dimensional speed, For the first During the nth iteration The first particle The position of the dimension For the first The first particle The individual optimal point of dimensionality. The position of the global optimum dimension, For inertial weights, take =0.7, and Let be the acceleration constant, and take . =2, and for Random numbers within the interval; Position updates use binary update rules: ； ； In the formula, for Random numbers within the interval; S245. Repeat S242 to S244 until the maximum number of iterations is reached. Terminate when the fitness value reaches 50 or no longer improves after 10 consecutive iterations; output the global optimal position. As the optimal feature selection mask; S246, according to Extracting the final optimal monitoring feature set from the original features. ,in, The number of selected features.

3. The system background monitoring method based on deep learning according to claim 2, characterized in that, S3 includes: S31. The optimal monitoring feature set output by S246 As input, MSCNN is used for multi-scale parallel convolution processing. The convolution operation makes the dimensions of the output feature maps of each branch consistent so as to facilitate subsequent stitching. S32. The feature maps output from each branch of S31. , , By stitching along the channel dimension, a fused multi-scale feature map is obtained. ; S33, output to S32 A fusion convolution operation is performed to aggregate multi-scale information through 1D convolution, resulting in the final fused feature map. .

4. The system background monitoring method based on deep learning according to claim 3, characterized in that, S4 includes: S41, Fusion feature map based on S33 output Deep feature refinement is performed through multiple cascaded residual blocks. Each residual block is structured according to a given method. The input is denoted as... ; S42, Settings Several residual blocks are cascaded and stacked, with the first residual block outputting S33. As input, each subsequent residual block takes the output of the previous residual block as input and processes it sequentially, as shown in the following equation: ； ； ； In the formula, This represents the forward propagation calculation of a single residual block, with the third residual block output. The refined deep feature sequence .

5. The system background monitoring method based on deep learning according to claim 4, characterized in that, S41 includes: S411, Main branch input Perform the following operations in sequence: ； In the formula, and Here are the weight matrix and bias of the first convolutional layer. This indicates a convolution operation with a kernel size of 3. This indicates a batch normalization operation. It is the ReLU activation function. This is the intermediate feature tensor output by the first convolutional layer of the main branch of the residual block; ； In the formula, and The weight matrix and bias of the second convolutional layer are given. For random deactivation operation, deactivation rate =0.2, This is the deep feature tensor output by the second convolutional layer of the main branch of the residual block after random deactivation. S412, Shortcut Branch Input Perform the following processing: If the number of input channels is the same as the number of output channels, then the identity mapping is directly passed, and the output branch tensor is: ； If the number of input channels and the number of output channels are not the same, then... Convolution performs dimension alignment and outputs branch tensors: ； In the formula, and for The weight matrix and bias of the convolution; S413, The main branch feature output by S411 Shortcut branching feature of S412 output After element-wise addition, the output is activated by the following function: ； In the formula, This is the output of the residual block.

6. The system background monitoring method based on deep learning according to claim 5, characterized in that, S5 includes: S51, the refined deep feature sequence output by S42 Using TCN as input, time-series dependency modeling is performed, and TCN time-series features are output. ; S52. The TCN timing features output from S51 Inputting a global average pooling layer and a fully connected layer yields the anomaly confidence score: ； In the formula, For globally compressed feature vectors, This refers to the anomaly confidence score. This is the classification layer weight matrix. For bias terms, The Sigmoid activation function maps the output to... The interval is used as the anomaly confidence score; when When it is judged as abnormal, among which, The preset anomaly threshold is used; the anomaly detection output is a binary label. ,in, Indicates an anomaly. This indicates normality, and the corresponding anomaly confidence score. ; S53, as an equivalent replacement for the TCN architecture in S51, adopts a stacked GRU and multi-head attention combined architecture for timing modeling.

7. A system background monitoring method based on deep learning according to claim 6, characterized in that, The TCN network in S51 includes multiple stacked temporal convolutional blocks, each containing causal convolutions and dilated convolutions, specifically including: S511, Causal Convolution: The output of causal convolution At any moment From input The calculation shows that, The kernel size is the kernel size of the TCN. This ensures that convolution operations do not leak future information; S512, Dentular Convolution: The void ratio is progressively increased in each TCN block, exponentially expanding the receptive field as the number of layers increases. The receptive field of the layer TCN block is: ； In the formula, For the first The receptive field of the layered TCN block, The kernel size is [size]. For the first The void ratio of the TCN block; TCN block output The calculation is as follows: ； S513. Each TCN block uses a residual connection method, adding the input and output and then normalizing: ； In the formula, , Presentation layer normalization operation, For the first TCN block transformation of the layer.

8. The system background monitoring method based on deep learning according to claim 7, characterized in that, S53 includes: S531. The refined deep feature sequence output by S42 Input the stacked GRU layers, and set the number of LSTM layers. =2, output the first hidden state sequence. Second hidden state sequence : ； ； S532, The second hidden state sequence output by S531 Input multi-head attention layer, from Attention weights are computed in parallel across different subspaces. Each attention head independently learns feature relationships in different representation subspaces. After parallel computation by each head, the values ​​are concatenated and fused to output: ； in, ； In the formula, For the first The output features of each attention head , , The first The size of the word lookup, key, and value projection matrix. The dimension of the key vector; Obtain multi-head attention output: ； In the formula, To output the projection matrix, For multi-head attention output; S533. Add residual connections and layer normalization after the multi-head attention layer to obtain the temporal features after attention enhancement: ； In the formula, For the attention-enhanced temporal features, residual connections are used to preserve the original GRU output information, and layer normalization is used to stabilize the training process. S534, output from S533 After global average pooling, the data is input into a fully connected classification layer to obtain anomaly confidence scores. The method for determining anomalies is the same as that for S52.

9. A system background monitoring method based on deep learning according to claim 8, characterized in that, S6 includes: S61. Employs the same temporal modeling architecture as S5, setting the training objective as single-step prediction; uses the refined deep feature sequence output by S42. As input, the monitored value at a future time step. To predict the target, train a single-step prediction model. : ； In the formula, For the historical monitoring window at time t, This is the predicted value for the next moment. This is the set of trainable parameters for the model, including convolutional layer weights, GRU layer weights, attention layer parameters, and fully connected layer weights. S62. In the inference phase, the single-step prediction model trained in S61 is... Recursive application Next, generate Step trend prediction results; assuming the initial input window is... ,in, The length of the history window; for the first Step prediction The model uses the current input window. Given the input, output the next predicted value: ； In the formula, For the first The predicted value of the step, For the first The input window after one recursive step; S63. The predicted value output by S62 With known future exogenous characteristics Combine them to form a new row of data: ； In the formula, For the first The known future exogenous characteristics at a given time. For splicing operations; Will Append to the end of the current input window and remove the oldest data row from the front of the window, maintaining the window length. constant: ； In the formula, This is a rolling update operation, specifically a deletion. The first line, append For the last line; S64. Repeat steps S62 and S63 until all are generated. Step-by-step predicted values, output trend prediction sequence: ； In the formula, From The future begins at any moment The sequence of trend prediction results for each step.

10. A system applied to the deep learning-based system background monitoring method according to any one of claims 1-9, characterized in that, include: The system comprises a multi-agent data acquisition layer, a data preprocessing and feature optimization layer, a multi-scale feature extraction layer, a residual feature refinement layer, a time series modeling and anomaly detection layer, a recursive trend prediction layer, an early warning and visualization layer, a system security management layer, and a microservice architecture and containerized deployment layer.

Images