A global risk monitoring and early warning method based on big data analysis

Abstract

The application discloses a global risk monitoring and early warning method based on big data analysis, which comprises the following steps: collecting data, pre-processing and generating standard global monitoring data; connecting each node to generate a global monitoring object correlation graph and an operation capacity sequence; identifying safe reserve calling behavior and generating a safe reserve consumption segment; connecting the safe reserve consumption segment to generate a safe reserve migration path, and generating a global safe reserve account book and a safe reserve burnout trajectory; identifying and generating a risk disposal event, and combining changes to generate a direct disposal response and a disposal transfer response; generating risk disposal transfer data, and connecting to generate a risk disposal shadow path and a disposal transfer load sequence; generating a reserve acceptance gap prediction sequence and global risk outbreak prediction data; and generating global risk monitoring and early warning results and sending them to a risk disposal terminal. The application uses big data analysis to construct a reserve burnout and disposal shadow path, realizes accurate risk early warning, and has traceability.

Description

Technical Field

[0001] This invention relates to the field of risk monitoring and early warning technology, and in particular to a method for comprehensive risk monitoring and early warning based on big data analysis. Background Technology

[0002] Existing comprehensive risk monitoring methods typically collect data on the operational status, resource capacity, and load changes of each monitored object. Risks are identified through fixed indicators or single-object anomalies, and then early warning results are generated by combining the connections between objects. Some methods can track load migration and risk mitigation processes, but they primarily focus on status changes after a risk occurs.

[0003] Existing technologies struggle to identify the continuous depletion and gradual consumption of safety reserves during the decline in the operational capabilities of monitored objects. They also fail to correlate the migration path of safety reserves with the load transfer path after risk mitigation. Consequently, it is difficult to determine whether the load transfer caused by risk mitigation exceeds the remaining safety reserves of the receiving object, leading to inaccurate predictions of the priority targets for risk outbreaks, outbreak times, and the gaps in coverage.

[0004] Therefore, how to provide a comprehensive risk monitoring and early warning method based on big data analysis is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0005] One objective of this invention is to propose a comprehensive risk monitoring and early warning method based on big data analysis. This invention utilizes big data analysis to construct a shadow path for reserve burnout and disposal, thereby achieving accurate risk early warning and ensuring traceability.

[0006] A comprehensive risk monitoring and early warning method based on big data analysis according to an embodiment of the present invention includes the following steps:

[0007] Collect full-domain operational data and monitoring object relationship data of each monitoring object within the entire domain, and preprocess them to generate standard full-domain monitoring data;

[0008] Connect each node to generate a global monitoring object association graph, and generate an operational capability sequence for each monitoring object based on standard global monitoring data;

[0009] Based on the operational capability sequence and standard full-domain monitoring data, identify the security reserve call behavior that occurs during monitoring, generate security reserve call events, and generate security reserve consumption fragments;

[0010] Based on the association graph of objects monitored across the entire domain, the security reserve consumption segments with the same calling objects and consecutive calling times are connected to generate security reserve migration paths, and the entire domain security reserve ledger and security reserve burn-out trajectory are generated.

[0011] Based on standard full-domain monitoring data, risk handling behaviors and original risk monitoring objects are identified, risk handling events are generated, and direct handling responses and handling transfer responses are generated respectively, taking into account changes in operation and load before and after handling.

[0012] The risk disposal transfer data is generated by associating direct disposal responses and disposal transfer responses, and then the risk disposal transfer data is connected to generate risk disposal shadow paths and disposal transfer load sequences.

[0013] Based on the monitoring object identification, risk disposal shadow path, disposal transfer load sequence, and safety reserve burnout trajectory, generate a reserve absorption gap prediction sequence and full-domain risk outbreak prediction data;

[0014] Based on the prediction data of risk outbreaks across the entire domain, the prediction sequence of reserve capacity gaps, and the shadow path of risk disposal, the results of risk monitoring and early warning across the entire domain are generated and sent to the risk disposal terminal.

[0015] Optionally, the preprocessing includes data cleaning, format unification, time alignment, and monitoring object identifier matching;

[0016] The overall operational data includes operational status data, resource capacity data, security reserve call-up data, load migration data, resource recovery data, and risk handling action data;

[0017] The monitored object relationship data includes spatial connection relationships, business dependency relationships, resource sharing relationships, and load transfer relationships.

[0018] Optionally, the generation of the operational capability sequence includes:

[0019] The monitoring object identifiers and monitoring object relationship data are obtained from the standard full-domain monitoring data. Each monitoring object is used as a node, and the corresponding nodes are connected according to spatial connection relationship, business dependency relationship, resource sharing relationship and load transfer relationship to generate a full-domain monitoring object association graph.

[0020] According to the monitoring object identifier and time, the operation status data and resource capacity data of the same monitoring object in the standard full-domain monitoring data are matched to generate the monitoring object operation data sequence;

[0021] The operational status data in the operational data sequence of the monitored objects are numerically processed and combined with the resource capacity data corresponding to the same time to generate operational capability values ​​for each time. The operational capability values ​​are arranged in chronological order to generate the operational capability sequence of each monitored object.

[0022] Optionally, the generation of the safety reserve consumption segment includes:

[0023] The difference between adjacent operational capacity values ​​is calculated in chronological order, consecutive time periods of decline are merged to generate operational capacity decline segments, and operational capacity reference values ​​are generated based on the operational capacity before the segment begins.

[0024] Obtain load migration data and safety reserve call data for the monitoring objects corresponding to the segment of reduced operational capacity, and generate corresponding load transfer data according to load type, load amount and occurrence time, corresponding to load transfer records and load takeover records;

[0025] The data corresponding to load transfer is matched with the time segment of reduced operating capacity. Data that is within the segment when the load is transferred out, the amount transferred out corresponds to the amount received, and the operating capacity recovers to the reference value after the load is transferred out is retained, and implicit compensation data is generated.

[0026] Based on the implicit compensation corresponding data, the monitoring object of the call source, the monitoring object of the call receiver, and the call time are determined, and the call resource quantity change process is generated according to the call resource quantity within the call time, and the security reserve call event is generated by combining them.

[0027] Security reserve call events are divided according to the call time. The net consumption sequence and consumption amount of security reserve are generated by combining the call resource amount and resource recovery data. These are then combined with the call source monitoring object, the call receiving monitoring object and the call time to generate a security reserve consumption fragment.

[0028] Optionally, the generation of the safety reserve burnout trajectory includes:

[0029] Arrange the security reserve consumption fragments according to the call time to generate a security reserve consumption fragment sequence;

[0030] From subsequent security reserve consumption segments, find data that have the same calling object, consecutive calling times, and a connection relationship in the global monitoring object association graph, and generate security reserve continuation data;

[0031] Connect the security reserve consumption segments according to the corresponding relationships of the calling objects and the calling time in the security reserve continuation data, and extend different subsequent segments to generate security reserve migration paths;

[0032] The net consumption of security reserves is summarized according to the monitoring object identification and the call time. The initial security reserve of each calling monitoring object is determined, and the remaining security reserve is updated in sequence to generate a global security reserve ledger.

[0033] Based on the remaining safety reserve of the same monitored object connected by the call time, a sequence of changes in the remaining safety reserve is generated, and a safety reserve burn-out trajectory is generated by combining the monitored object identifier and the safety reserve migration path.

[0034] Optionally, the generation of the disposal transfer response includes:

[0035] Identify risk response actions from risk response action data, determine the original risk monitoring targets and the start and end times of the response, combine them to generate risk response events, and generate risk response event identifiers;

[0036] Obtain operational status data and load migration data of the original risk monitoring object within the same duration before and after the start time of the disposal, and generate operational comparison data of the original risk monitoring object according to the collection time, operational status type and load type;

[0037] The difference between the operational status data and load migration data before and after the handling is calculated to generate the operational status change sequence and load decrease sequence, which are then combined with the risk handling event identifier and the original risk monitoring object to generate a direct handling response;

[0038] Identify the associated monitoring objects that took over the loads transferred from the original risk monitoring objects after the start of the handling process from the load migration data, arrange the load taking over according to the load type and collection time, and generate a load taking over sequence of associated monitoring objects.

[0039] The load accrual sequence and load decrement sequence of the associated monitoring objects are matched according to load type and continuous time slice. Data on load accrual increases that originate from the original risk monitoring objects are retained and combined with risk disposal event identifiers, associated monitoring objects, and load types to generate disposal transfer responses.

[0040] Optionally, the generation of the disposal transfer load sequence includes:

[0041] Based on the risk handling event identifier and load type, for the same risk handling event, the direct handling response and handling transfer response are used to obtain the original risk monitoring object, load decrease sequence, associated monitoring object and associated monitoring object load take-up sequence, and generate handling response association data;

[0042] Based on the data related to the response, the associated monitoring objects are identified as risk-bearing monitoring objects. According to the order of occurrence of continuous time slices and load-bearing records, the load reduction is sequentially allocated to each risk-bearing monitoring object to generate a corresponding sequence of changes in transferred load.

[0043] The original risk monitoring targets, risk transfer monitoring targets, transfer time, and transfer load corresponding to each consecutive time slice are combined to generate risk disposal transfer data.

[0044] Based on the association diagram of the monitoring objects in the whole domain, the risk disposal transfer data is arranged according to the risk disposal event identifier and transfer time. Taking the same original risk monitoring object as the starting point of the path, the data pointing to each risk-bearing monitoring object are connected to generate a risk disposal shadow path.

[0045] Arrange the sequence of changes in transfer load according to the risk-bearing monitoring object and the transfer time, and summarize the transfer load of the same risk-bearing monitoring object in the same continuous time slice to generate a sequence of disposal transfer load.

[0046] Optionally, the generation of the global risk outbreak prediction data includes:

[0047] Based on the monitoring object identifier and time stamp, corresponding data for reserve acceptance is generated, including the monitoring object for risk acceptance, transfer time, transfer load, and remaining safety reserve.

[0048] Obtain the sequence of changes in the remaining safety reserve of each risk-bearing monitoring object before the transfer time, calculate the change in the remaining safety reserve corresponding to adjacent time markers, and generate the net rate of change of safety reserve based on the sum of the changes and the number of sampling intervals;

[0049] Starting with the last remaining safety reserve of each risk-bearing monitoring object before the first transfer time, the first acceptable safety reserve is generated by combining the net change rate of safety reserve and the transfer time interval. The subsequent acceptable safety reserves are generated by combining the previous acceptable safety reserve, the transfer load and the adjacent transfer time interval, thus forming an acceptable safety reserve prediction sequence.

[0050] Based on the risk-bearing monitoring targets and time markers, the difference between the transfer load and the available safety reserve is calculated according to the corresponding disposal transfer load sequence and the available safety reserve prediction sequence, and a reserve acceptance gap prediction sequence is generated.

[0051] The risk-bearing monitoring target corresponding to the first positive value in the reserve absorption gap prediction sequence is identified as the priority target for the outbreak of risk across the entire region. The corresponding transfer time and reserve absorption gap value are combined to generate the prediction data for the outbreak of risk across the entire region.

[0052] Optionally, the generation of the overall risk monitoring and early warning results includes:

[0053] The system obtains the priority targets and expected outbreak times of risks across the entire domain from the risk outbreak prediction data. It then obtains the first transfer time pointing to the priority targets from the risk disposal shadow path according to the priority targets. Finally, it obtains the reserve acceptance gap value within the range from the transfer time to the expected outbreak time from the reserve acceptance gap prediction sequence and arranges them in chronological order to generate a reserve acceptance gap prediction segment.

[0054] Obtain the path portion from the corresponding original risk monitoring object to the risk priority outbreak object in the entire domain along the risk disposal shadow path, and generate risk disposal shadow association fragments;

[0055] The system combines the predicted data of the overall risk outbreak, the predicted fragments of the reserve absorption gap, and the shadow correlation fragments of risk disposal to generate the overall risk monitoring and early warning results, and sends the overall risk monitoring and early warning results to the risk disposal terminal.

[0056] The beneficial effects of this invention are:

[0057] This invention collects operational status data, resource capacity data, security reserve call data, load migration data, resource recovery data, risk handling action data, and monitoring object relationship data of each monitoring object across the entire domain, forming unified standard full-domain monitoring data. It also constructs a full-domain monitoring object association diagram and an operational capability sequence of each monitoring object, enabling the monitoring process to simultaneously reflect the operational changes of the monitoring objects themselves and the spatial connections, business dependencies, resource sharing, and load transfer relationships between monitoring objects. This avoids the problem of one-sided information caused by risk judgment based on a single monitoring object or a single operational indicator, and improves the completeness of full-domain risk status identification.

[0058] This invention continuously tracks the processes of load transfer, load takeover, security reserve mobilization, and resource recovery during the decline in the operational capacity of monitored objects. It generates security reserve mobilization events, security reserve consumption segments, and security reserve migration paths, and calculates the remaining security reserve amount for each monitored object taking over the mobilization, forming a global security reserve ledger and a security reserve burnout trajectory. This continuously reflects the mobilization direction, consumption process, and remaining capacity of security reserves across different monitored objects, solving the problem of existing technologies that only record the present value of resource capacity and struggle to identify the gradual consumption and cross-object migration process of security reserves.

[0059] This invention further correlates the operational changes of the original risk monitoring objects before and after risk mitigation with the load-bearing changes of related monitoring objects, generating risk mitigation transfer data, risk mitigation shadow paths, and mitigation transfer load sequences. It also establishes a time-based correspondence between the mitigation transfer load and the available safety reserves of each risk-bearing monitoring object, generating a reserve-bearing gap prediction sequence. By identifying the first risk-bearing monitoring object with a reserve-bearing gap value greater than zero, it can determine the priority targets for risk outbreaks across the entire domain, the expected outbreak time, and the reserve-bearing gap value. This transforms risk warning from passive identification after a risk occurs to proactive prediction during the risk transfer process, while retaining the path information of risk transfer from the original risk monitoring object to the risk-bearing monitoring object, improving the accuracy, traceability, and targeted nature of the overall risk warning results. Attached Figure Description

[0060] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0061] Figure 1 This is an overall flowchart of a comprehensive risk monitoring and early warning method based on big data analysis proposed in this invention;

[0062] Figure 2 This diagram illustrates the generation of risk disposal transfer data, branch-type risk disposal shadow paths, and disposal transfer load sequences in a big data-based global risk monitoring and early warning method proposed in this invention. Detailed Implementation

[0063] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0064] refer to Figures 1-2 A comprehensive risk monitoring and early warning method based on big data analysis includes the following steps:

[0065] Collect full-domain operation data and monitoring object relationship data of each monitoring object within the entire domain. Preprocess the full-domain operation data and monitoring object relationship data to generate standard full-domain monitoring data. The full-domain operation data includes operation status data, resource capacity data, security reserve call data, load migration data, resource recovery data, and risk handling action data. The monitoring object relationship data includes spatial connection relationship, business dependency relationship, resource sharing relationship, and load transfer relationship.

[0066] Using the monitored objects as nodes, the nodes are connected according to the monitoring object relationship data in the standard full-domain monitoring data to generate a full-domain monitoring object association diagram, and the operational capability sequence of each monitored object is generated based on the operational status data and resource capacity data in the standard full-domain monitoring data;

[0067] Based on the operational capability sequence and standard full-domain monitoring data, identify the safety reserve call behavior that occurs after the operational capability of the monitored object declines, generate a safety reserve call event, the safety reserve call event includes the calling source monitored object, the calling receiving monitored object, the call time and the change process of the called resource amount, and generate a safety reserve consumption fragment based on the safety reserve call event;

[0068] Based on the association graph of the monitoring objects in the whole domain, the monitoring objects that receive the call of the previous security reserve consumption segment are connected with the monitoring objects that receive the call of the next security reserve consumption segment and whose call times are the same and sequentially connected, to generate a security reserve migration path. The security reserve migration paths are summarized according to the monitoring object identifier and the call time to generate a whole domain security reserve ledger, and a security reserve burn-out trajectory is generated based on the whole domain security reserve ledger.

[0069] Based on standard full-domain monitoring data, risk handling behaviors and their corresponding original risk monitoring objects are identified, risk handling events are generated, direct handling responses are generated based on the operational changes of the original risk monitoring objects before and after the implementation of risk handling events, and handling transfer responses are generated based on the load changes of associated monitoring objects after the implementation of risk handling events.

[0070] The direct response and the transfer response corresponding to the same risk management event are associated to generate risk management transfer data. The risk management transfer data includes the original risk monitoring object, the risk receiving monitoring object, the transfer time and the transfer load. Based on the association graph of the full-domain monitoring object, the risk management transfer data are connected according to the direction from the original risk monitoring object to the risk receiving monitoring object and the transfer time sequence to generate a risk management shadow path. A management transfer load sequence is generated based on the risk management shadow path.

[0071] The risk disposal shadow path, disposal transfer load sequence, and safety reserve burnout trajectory are matched according to the monitoring object identifier and time marker. Based on the disposal transfer load sequence, the whole domain safety reserve ledger, and the safety reserve burnout trajectory, a reserve absorption gap prediction sequence is generated. Based on the reserve absorption gap prediction sequence, whole domain risk outbreak prediction data is generated. The whole domain risk outbreak prediction data includes the whole domain risk priority outbreak object, the expected outbreak time, and the reserve absorption gap value.

[0072] Based on the prediction data of risk outbreaks across the entire domain, the prediction sequence of reserve capacity gaps, and the shadow path of risk disposal, the results of risk monitoring and early warning across the entire domain are generated and sent to the risk disposal terminal.

[0073] In this embodiment, preprocessing includes data cleaning, format unification, time alignment, and monitoring object identifier matching;

[0074] The overall operational data includes operational status data, resource capacity data, security reserve call-up data, load migration data, resource recovery data, and risk handling action data;

[0075] The monitored object relationship data includes spatial connection relationships, business dependency relationships, resource sharing relationships, and load transfer relationships.

[0076] In this embodiment, the generation of the operational capability sequence includes:

[0077] The monitoring object identifiers and monitoring object relationship data are obtained from the standard full-domain monitoring data. Each monitoring object is used as a node, and the corresponding nodes are connected according to spatial connection relationship, business dependency relationship, resource sharing relationship and load transfer relationship to generate a full-domain monitoring object association graph.

[0078] According to the monitoring object identifier and time, the operation status data and resource capacity data of the same monitoring object in the standard full-domain monitoring data are matched to generate the monitoring object operation data sequence;

[0079] The operational status data in the operational data sequence of the monitored objects is numerically processed and combined with the resource capacity data corresponding to the same time to generate operational capability values ​​for each time. The operational capability values ​​are arranged in chronological order to generate the operational capability sequence of each monitored object.

[0080] Specifically, the operational status data and resource capacity data of the same monitoring object for 30 consecutive sampling times are read from the operational data sequence of the monitoring object. The maximum and minimum values ​​of the same data type within the 30 sampling times are processed dimensionlessly. Data that indicate a decrease in operational capacity as the value increases are reversed. The processed operational status data are averaged to generate a comprehensive operational status value. The ratio of available resource capacity to total resource capacity is used to generate a resource capacity value. The comprehensive operational status value and resource capacity value are then combined according to a ratio of 0.5 and 0.5. When the comprehensive operational status value is 0.82 and the resource capacity value is 0.74, an operational capacity value of 0.78 is generated.

[0081] In this embodiment, the generation of the safety reserve consumption segment includes:

[0082] The difference in operational capacity between adjacent time points in the operational capacity sequence is calculated in chronological order. Time periods in which the operational capacity difference is continuously negative are merged to generate a segment of operational capacity decline. An operational capacity reference value is generated based on the operational capacity before the start of the operational capacity decline segment.

[0083] Specifically, the operational capability values ​​in the operational capability sequence are read in chronological order, and the difference between adjacent operational capability values ​​is calculated. The sampling times with consecutive negative values ​​are connected. When the operational capability values ​​are 0.85, 0.82, 0.77 and 0.73, an operational capability decline segment covering three adjacent sampling intervals is generated. The operational capability values ​​of 0.81, 0.83 and 0.82 in the three sampling times before the start of the operational capability decline segment are read, and the average result of the three operational capability values, 0.82, is used to generate the operational capability reference value.

[0084] The load migration data and safety reserve call data of the monitoring objects corresponding to the segment of operational capacity decline are obtained from the standard full-domain monitoring data. The load transfer records and load takeover records of the corresponding monitoring objects are matched according to load type, load amount and occurrence time to generate load transfer corresponding data.

[0085] Specifically, load migration data within the corresponding operational capacity decline segments of monitored object A and monitored object B are read respectively. Monitored object A transfers 6, 5, 2, 4 and 1 resource quantities to monitored object B in 5 consecutive time slices. Monitored object B transfers 6, 5, 2, 4 and 1 resource quantities to monitored object C in the next set of 5 consecutive time slices. Load transfer corresponding data for AB and BC are generated according to the load type, load quantity and occurrence time, corresponding to the load transfer records and load acceptance records respectively.

[0086] The load transfer data is time-correlated with the segment of reduced operating capacity. The load transfer data that is within the segment of reduced operating capacity, the load transfer amount corresponds to the load receiving amount, and the operating capacity of the corresponding monitored object is restored to the operating capacity reference value after the load transfer is completed is retained, and implicit compensation data is generated.

[0087] Specifically, the load transfer data corresponding to AB is correlated with the time segment of the operational capacity decline of monitored object A. The reference value of the operational capacity of monitored object A is 0.82, and the operational capacity values ​​after the load is transferred out are 0.71, 0.77, and 0.83 respectively. The third sampling time is recorded as the operational capacity recovery time. The load transfer data corresponding to BC is correlated with the time segment of the operational capacity decline of monitored object B. The reference value of the operational capacity of monitored object B is 0.81, and the operational capacity values ​​after the load is transferred out are 0.70, 0.76, and 0.82 respectively. The third sampling time is recorded as the operational capacity recovery time. Implicit compensation data is generated from the two sets of load transfer data.

[0088] Based on the implicit compensation data, the monitoring object corresponding to the load transfer record is determined as the call source monitoring object, the monitoring object corresponding to the load takeover record is determined as the call takeover monitoring object, the time from the start of load transfer to the end of load takeover is determined as the call time, the call resource quantity change process is generated according to the call resource quantity in the security reserve call data within the call time, and the call source monitoring object, call takeover monitoring object, call time, and call resource quantity change process are combined to generate a security reserve call event;

[0089] Specifically, based on the implicit compensation data corresponding to AB, monitoring object A is determined as the source monitoring object, monitoring object B is determined as the receiving monitoring object, and the first call resource quantity change process is generated according to the call resource quantities of 6, 5, 2, 4 and 1 resources within 5 consecutive time slices. Based on the implicit compensation data corresponding to BC, monitoring object B is determined as the source monitoring object, monitoring object C is determined as the receiving monitoring object, and the second call resource quantity change process is generated according to the call resource quantities of 6, 5, 2, 4 and 1 resources within 5 consecutive time slices, thereby generating the security reserve call events corresponding to AB and BC.

[0090] The security reserve call events are divided into continuous time slices according to the call time. The net consumption of security reserves is generated by combining the call resource volume and resource recovery data in each continuous time slice. The net consumption of security reserves is arranged according to the call time to generate a net consumption sequence of security reserves. The net consumption of security reserves is then summarized to generate a total consumption of security reserves. The net consumption sequence of security reserves, the consumption of security reserves, the call source monitoring object, the call receiving monitoring object, and the call time are combined to generate a security reserve consumption segment.

[0091] Specifically, the recovery resource amounts corresponding to the first security reserve call event in the five consecutive time slices are 2, 1, 3, 2, and 2 resources respectively. Combined with the call resource amounts of 6, 5, 2, 4, and 1 resources, a net security reserve consumption of 4, 4, -1, 2, and -1 resources is generated, and these are summed to generate a security reserve consumption of 8 resources. The recovery resource amounts corresponding to the second security reserve call event are 2, 1, 4, 1, and 3 resources respectively. A net security reserve consumption of 4, 4, -2, 3, and -2 resources is generated, and these are summed to generate a security reserve consumption of 7 resources.

[0092] In this embodiment, the generation of the safety reserve burnout trajectory includes:

[0093] The safety reserve consumption fragments are sorted according to the call time to generate a safety reserve consumption fragment sequence;

[0094] For each security reserve consumption segment in the security reserve consumption segment sequence, find the security reserve consumption segment from the subsequent security reserve consumption segments whose calling source monitoring object is the same as the calling receiving monitoring object of the security reserve consumption segment, whose calling time is sequential and whose corresponding monitoring objects have a connection relationship in the global monitoring object association graph. Combine the found security reserve consumption segments with the security reserve consumption segment to generate security reserve continuation data.

[0095] Specifically, read the call source monitoring object A and the call receiving monitoring object B in the first security reserve consumption segment, and read the call source monitoring object B and the call receiving monitoring object C in the second security reserve consumption segment. Map the two security reserve consumption segments to the same sampling time axis, and generate security reserve continuation data according to the object connection direction from A to B and from B to C and the combination of the previous and subsequent call times.

[0096] Based on the correspondence and call time between the calling monitoring object of the previous security reserve consumption segment and the calling source monitoring object of the next security reserve consumption segment in each security reserve continuation data, the security reserve consumption segments are connected sequentially, and different subsequent security reserve consumption segments corresponding to the same security reserve consumption segment are extended to generate a security reserve migration path.

[0097] Specifically, the security reserve consumption segment corresponding to A to B is taken as the previous path node, and the security reserve consumption segment corresponding to B to C is taken as the next path node. The two path nodes are connected according to the correspondence between the calling and receiving monitoring object B and the next calling source monitoring object B to generate the security reserve migration path corresponding to ABC.

[0098] The net consumption of security reserves corresponding to each calling and receiving monitoring object in the security reserve migration path is summarized according to the monitoring object identification and the calling time. The initial security reserve amount corresponding to the first calling and receiving monitoring object is determined from the resource capacity data and operation status data of the standard full-domain monitoring data. The remaining security reserve amount of the same calling and receiving monitoring object is updated according to the calling time order, and the full-domain security reserve ledger is generated.

[0099] Specifically, an initial safety reserve of 60 resources corresponding to monitoring object B is generated from resource capacity data and operational status data. Remaining safety reserves of 56, 52, 53, 51, and 52 resources are generated sequentially according to the net consumption of safety reserves of 4, 4, -1, 2, and -1 resources. An initial safety reserve of 20 resources corresponding to monitoring object C is generated from resource capacity data and operational status data. Remaining safety reserves of 16, 12, 14, 11, and 13 resources are generated sequentially according to the net consumption of safety reserves of 4, 4, -2, 3, and -2 resources. These reserves are then written into the global safety reserve ledger.

[0100] Connect the remaining security reserves of the same monitored object in the global security reserve ledger according to the call time, generate the remaining security reserve change sequence, and combine the remaining security reserve change sequence, the monitored object identifier and the corresponding security reserve migration path to generate the security reserve burnout trajectory;

[0101] Specifically, according to the call time, the resource quantities corresponding to monitoring object B (60, 56, 52, 53, 51, and 52) are connected to generate the remaining safety reserve quantity change sequence of monitoring object B. The resource quantities corresponding to monitoring object C (20, 16, 12, 14, 11, and 13) are connected to generate the remaining safety reserve quantity change sequence of monitoring object C. Then, according to the safety reserve migration direction corresponding to A, B, and C, the two remaining safety reserve quantity change sequences are combined to generate the safety reserve burnout trajectory.

[0102] In this embodiment, the generation of the disposal transfer response includes:

[0103] Risk response actions are identified from the risk response action data in the standard full-domain monitoring data. The original risk monitoring object is determined according to the monitoring object to which the risk response action is directed. The start time and end time of the risk response action are obtained. The risk response action, the original risk monitoring object, the start time and end time are combined to generate a risk response event. A risk response event identifier is generated according to the original risk monitoring object and the start time.

[0104] Specifically, according to the action execution order in the risk handling action data, the risk handling actions pointing to the monitoring object A within two consecutive sampling periods are combined into a risk handling behavior, the monitoring object A is determined as the original risk monitoring object, and the risk handling event and risk handling event identifier are generated using the start time and end time of the two sampling periods.

[0105] Based on the start time of the risk response event, the operational status data and load migration data of the original risk monitoring object within the same duration before and after the start time of the response are obtained from the standard full-domain monitoring data. The data are then matched according to the collection time, operational status type and load type to generate the original risk monitoring object's operational comparison data.

[0106] Specifically, the operating status data and load migration data of the two sampling periods before and after the start time of the treatment are read respectively. The data before and after the treatment are mapped to two consecutive time slices and matched according to the collection time, operating status type and load type to generate the original risk monitoring object operating comparison data.

[0107] The operational status data and load migration data before and after the disposal in the original risk monitoring object's operational control data are calculated according to continuous time slices to generate an operational status change sequence and a load decrease sequence. The risk disposal event identifier, the original risk monitoring object, the operational status change sequence and the load decrease sequence are combined to generate a direct disposal response.

[0108] Specifically, the operating state values ​​for the two consecutive time slices before the processing were 0.82 and 0.81, respectively, and the corresponding operating state values ​​after the processing were 0.78 and 0.76, respectively. This generates operating state change values ​​of 0.04 and 0.05, which are then arranged to form an operating state change sequence. The load values ​​before the processing were 90 and 92 resource values, respectively, and the load values ​​after the processing were 65 and 62 resource values, respectively. This generates load decrease values ​​of 25 and 30 resource values, which are then arranged to form a load decrease sequence.

[0109] Identify monitoring objects that take over the load transferred from the original risk monitoring objects after the start time of the disposal from the load migration data of the standard full-domain monitoring data, determine them as associated monitoring objects, arrange the load taking over of associated monitoring objects according to load type and collection time, and generate a load taking over sequence of associated monitoring objects.

[0110] Specifically, the load capacity of monitored object B in the two consecutive time slices before the treatment was 5 and 6 resources respectively, and after the treatment it was 25 and 28 resources respectively, thus generating load capacity increases of 20 and 22 resources. The load capacity of monitored object C in the two consecutive time slices before the treatment was 3 and 2 resources respectively, and after the treatment it was 8 and 10 resources respectively, thus generating load capacity increases of 5 and 8 resources respectively. The associated load capacity sequences of monitored objects B and C are generated respectively.

[0111] The load accrual sequence and load decrement sequence of associated monitoring objects are matched according to load type and continuous time slice. The load accrual sequence of associated monitoring objects with increased load and load source of the original risk monitoring object is retained. The risk handling event identifier, associated monitoring object, load type and associated monitoring object load accrual sequence are combined to generate a handling transfer response.

[0112] Specifically, the load decrease sequences of 25 and 30 resource quantities are time-corresponded to the 20 and 22 resource quantities corresponding to monitoring object B and the 5 and 8 resource quantities corresponding to monitoring object C, respectively. The load transfer to monitoring object A corresponding to the load transfer quantity is read from the load migration data. The risk handling event identifier, associated monitoring object, load type and the corresponding associated monitoring object load transfer sequence are combined to generate the handling transfer response corresponding to monitoring object B and monitoring object C.

[0113] In this embodiment, the generation of the load transfer sequence includes:

[0114] Based on the risk handling event identifier and load type, the direct handling response and the handling transfer response corresponding to the same risk handling event are matched. The original risk monitoring object and load reduction sequence are obtained from the direct handling response, and the associated monitoring object and the associated monitoring object load take-up sequence are obtained from the handling transfer response to generate handling response association data.

[0115] Specifically, the direct response and two response transfer responses corresponding to the original risk monitoring object A are collected according to the risk handling event identifier. According to the load type and continuous time slice, the load decrease sequences of 25 and 30 resource quantities are respectively matched with the associated monitoring object load take-up sequences of 20 and 22 resource quantities corresponding to monitoring object B and the associated monitoring object load take-up sequences of 5 and 8 resource quantities corresponding to monitoring object C, so as to generate the corresponding response association data of A and B and A and C respectively.

[0116] Based on the associated data of the handling and response, the associated monitoring objects are identified as risk-bearing monitoring objects. According to the occurrence order of continuous time slices and load-bearing records, the load reduction amount of each continuous time slice is sequentially allocated to the load-bearing amount corresponding to each risk-bearing monitoring object. After the previous risk-bearing monitoring object is allocated, the remaining load reduction amount is used to process the next risk-bearing monitoring object, generating a sequence of changes in the transferred load amount corresponding to each risk-bearing monitoring object.

[0117] Specifically, the load decrease in the first consecutive time slice is 25 resources. 20 resources are allocated to monitoring object B according to the order of occurrence of the load take-off record, and the remaining 5 resources are allocated to monitoring object C. The load decrease in the second consecutive time slice is 30 resources. 22 resources are allocated to monitoring object B, and the remaining 8 resources are allocated to monitoring object C. This generates the load transfer change sequence of 20 and 22 resources corresponding to monitoring object B and 5 and 8 resources corresponding to monitoring object C.

[0118] The original risk monitoring targets, risk transfer monitoring targets, transfer time, and transfer load corresponding to each consecutive time slice are combined to generate risk disposal transfer data.

[0119] Specifically, the transfer load of 20 and 22 resources is combined with the original risk monitoring object A, the risk-bearing monitoring object B and the corresponding continuous time slice to generate risk disposal transfer data corresponding to AB. The transfer load of 5 and 8 resources is combined with the original risk monitoring object A, the risk-bearing monitoring object C and the corresponding continuous time slice to generate risk disposal transfer data corresponding to AC.

[0120] Based on the association graph of the monitoring objects in the whole domain, the risk disposal transfer data is arranged according to the risk disposal event identifier and transfer time. Taking the same original risk monitoring object as the starting point of the path, the corresponding risk disposal transfer data are connected according to the direction from the original risk monitoring object to each risk-bearing monitoring object, and a risk disposal shadow path is generated.

[0121] Specifically, risk disposal transfer data corresponding to AB and AC are collected according to the same risk disposal event identifier. Taking the original risk monitoring object A as the starting point of the path, the connection relationship between A and B and between A and C is read from the association graph of the whole domain monitoring object. The risk disposal transfer data corresponding to two consecutive time slices are arranged according to the transfer time to generate branch-type risk disposal shadow paths from A to B and C respectively. The AB path records the transfer load of 20 and 22 resources, and the AC path records the transfer load of 5 and 8 resources.

[0122] Arrange the sequence of changes in transfer load according to the risk-bearing monitoring objects and transfer time in the risk disposal shadow path, and summarize the transfer load of the same risk-bearing monitoring object in the same continuous time slice to generate a disposal transfer load sequence.

[0123] Specifically, the transfer load is arranged according to the risk-bearing monitoring objects and continuous time slices. The 20 and 22 resource quantities corresponding to monitoring object B are arranged to generate a disposal transfer load sequence, and the 5 and 8 resource quantities corresponding to monitoring object C are arranged to generate a disposal transfer load sequence.

[0124] In this embodiment, the generation of global risk outbreak prediction data includes:

[0125] Based on the monitoring object identifier and time marker, the monitoring objects and transfer time of risk acceptance in the risk disposal shadow path, the transfer load in the disposal transfer load sequence, and the remaining safety reserve in the safety reserve burnout trajectory are matched to generate corresponding reserve acceptance data.

[0126] Specifically, according to the risk-bearing monitoring objects and time markers, the 20 and 22 resource quantities corresponding to monitoring object B and the 5 and 8 resource quantities corresponding to monitoring object C are respectively matched with the remaining safety reserve quantity of the same monitoring object at the corresponding time in the safety reserve burnout trajectory, so as to generate reserve-bearing corresponding data for monitoring object B and monitoring object C.

[0127] The remaining safety reserve change sequence of each risk-bearing monitoring object before the transfer time is obtained from the overall safety reserve ledger. The change in remaining safety reserve is calculated according to adjacent time markers. The sum of the changes in each remaining safety reserve is then compared with the number of sampling intervals to generate the net change rate of safety reserve.

[0128] Specifically, the remaining safety reserve of monitoring object B for the six consecutive sampling periods before the transfer time is 60, 56, 52, 53, 51 and 52 resources, respectively. The changes in adjacent remaining safety reserve are -4, -4, 1, -2 and 1 resources, respectively, with a total change of -8 resources. This corresponds to five sampling intervals, thus generating a net change rate of -1.6 resources for safety reserve per sampling interval. The remaining safety reserve of monitoring object C is 20, 16, 12, 14, 11 and 13 resources, respectively. The changes in adjacent remaining safety reserve are -4, -4, 2, -3 and 2 resources, respectively, with a total change of -7 resources, thus generating a net change rate of -1.4 resources for safety reserve per sampling interval.

[0129] Each transfer time is processed separately according to the risk-bearing monitoring object. Starting from the last remaining safety reserve of each risk-bearing monitoring object before the first transfer time, the safety reserve that can be absorbed at the first transfer time is generated by combining the net change rate of safety reserve and the transfer time interval. When there are subsequent transfer times for the same risk-bearing monitoring object, the safety reserve that can be absorbed at the subsequent transfer times is generated in sequence based on the safety reserve that can be absorbed at the previous transfer time, the transfer load corresponding to the previous transfer time, the net change rate of safety reserve, and the adjacent transfer time interval. The safety reserve is then arranged according to the risk-bearing monitoring object and the transfer time to generate a predictive sequence of safety reserves that can be absorbed.

[0130] Specifically, using the last recorded 52 resource quantities of monitoring object B as the prediction starting point, with the first transfer time separated from the prediction starting point by one sampling interval, and combining the net change rate of safety reserve of -1.6 resource quantities per sampling interval, an initial acceptable safety reserve of 50.4 resource quantities is generated. After the transfer load of 20 resource quantities is completed, a second acceptable safety reserve of 28.8 resource quantities is generated based on the net change of safety reserve corresponding to one sampling interval. Using the last recorded 13 resource quantities of monitoring object C as the prediction starting point, and combining the net change rate of safety reserve of -1.4 resource quantities per sampling interval, an initial acceptable safety reserve of 11.6 resource quantities is generated. After the transfer load of 5 resource quantities is completed, a second acceptable safety reserve of 5.2 resource quantities is generated based on the net change of safety reserve corresponding to one sampling interval. The acceptable safety reserve prediction sequence is then generated according to the risk-bearing monitoring object and the transfer time.

[0131] The sequence of disposing of transferred loads and the sequence of available safety reserves are matched according to the risk-bearing monitoring objects and time markers. The amount of transferred loads is subtracted from the amount of available safety reserves to generate the reserve absorption gap value. The reserve absorption gap values ​​are then arranged from earliest to latest according to the transfer time to generate the reserve absorption gap prediction sequence.

[0132] Specifically, the 20 and 22 resource quantities corresponding to monitoring object B are matched with the acceptable safe reserve quantities of 50.4 and 28.8 resource quantities, respectively, to generate reserve acceptance gap values ​​of -30.4 and -6.8 resource quantities. The 5 and 8 resource quantities corresponding to monitoring object C are matched with the acceptable safe reserve quantities of 11.6 and 5.2 resource quantities, respectively, to generate reserve acceptance gap values ​​of -6.6 and 2.8 resource quantities. The reserve acceptance gap prediction sequence is generated by arranging the transfer time from earliest to latest.

[0133] The first risk-bearing monitoring object with a reserve acceptance gap value greater than zero after being arranged by transfer time in the reserve acceptance gap prediction sequence is identified as the priority risk outbreak object in the whole domain. The corresponding transfer time is determined as the expected outbreak time. The priority risk outbreak object, the expected outbreak time and the corresponding reserve acceptance gap value are combined to generate the whole domain risk outbreak prediction data.

[0134] Specifically, the reserve absorption gap values ​​corresponding to monitoring objects B and C are arranged from earliest to latest according to the transfer time. The 2.8 resource quantities corresponding to the second transfer time of monitoring object C are determined as the first reserve absorption gap value greater than 0 after the arrangement. Monitoring object C is determined as the priority target for the outbreak of risk in the whole domain. The second transfer time is determined as the expected outbreak time. The monitoring object C, the expected outbreak time, and the reserve absorption gap value of 2.8 resource quantities are combined to generate the prediction data of the outbreak of risk in the whole domain.

[0135] In this embodiment, the generation of comprehensive risk monitoring and early warning results includes:

[0136] The system obtains the priority targets and expected outbreak times of risks across the entire domain from the risk outbreak prediction data. It then obtains the first transfer time pointing to the priority targets from the risk disposal shadow path according to the priority targets. Finally, it obtains the reserve acceptance gap value within the range from the transfer time to the expected outbreak time from the reserve acceptance gap prediction sequence and arranges them in chronological order to generate a reserve acceptance gap prediction segment.

[0137] Specifically, the first transfer time pointing to the monitored object C is read from the risk disposal shadow path corresponding to AC, and this is taken as the segment start time. The second transfer time when the monitored object C forms a positive reserve acceptance gap value is taken as the segment end time. Reserve acceptance gap values ​​of -6.6 and 2.8 resource quantities are read sequentially from the reserve acceptance gap prediction sequence, and the reserve acceptance gap prediction segments are generated in chronological order.

[0138] Obtain the path portion from the corresponding original risk monitoring object to the risk priority outbreak object in the entire domain along the risk disposal shadow path, and generate risk disposal shadow association fragments;

[0139] Specifically, taking monitoring object C as the priority target for risk outbreak across the entire domain, the risk management transfer data from the original risk monitoring object A to monitoring object C is read from the risk management shadow path, and the path part corresponding to AC is generated into a risk management shadow association fragment;

[0140] The system combines the predicted data of the overall risk outbreak, the predicted fragment of the reserve absorption gap, and the shadow correlation fragment of risk disposal to generate the overall risk monitoring and early warning results, and sends the overall risk monitoring and early warning results to the risk disposal terminal.

[0141] Specifically, the monitoring object C, the expected outbreak time, and the reserve gap value of 2.8 resource quantities are read from the overall risk outbreak prediction data. The reserve gap values ​​of -6.6 and 2.8 resource quantities are read from the reserve gap prediction segment. The original risk monitoring object, the risk-bearing monitoring object, and the transfer direction corresponding to AC are read from the risk disposal shadow association segment. The data are combined to generate an overall risk monitoring and early warning result and send it to the risk disposal terminal.

[0142] Example 1: To verify the feasibility of this invention in practice, it was applied to a comprehensive risk monitoring scenario in a large-scale integrated operation management center. This management center includes a core business processing area, a backup resource receiving area, and a data service area. These areas have business dependencies, resource sharing, and load transfer relationships. When the operational capacity of the core business processing area decreases, some business load will be transferred to the backup resource receiving area. As the load on the backup resource receiving area increases, it may also continue to draw on the security reserves of the data service area. Existing monitoring methods mainly check the current resource capacity and operational status of each area. They typically only issue alerts when the receiving object approaches its capacity limit, making it difficult to continuously identify the calling, consumption, recovery, and cross-object transfer processes of security reserves. It is also difficult to predict in advance whether the load migration caused by risk mitigation will exceed the remaining security reserves of the receiving object.

[0143] In this scenario, the core business processing area is designated as monitoring object A, the backup resource takeover area as monitoring object B, and the data service area as monitoring object C. For 30 consecutive days, operational status data, resource capacity data, security reserve call data, load migration data, resource recovery data, and risk handling action data for each monitoring object are collected, with a sampling period of 5 minutes. Simultaneously, business dependencies, resource sharing relationships, and load transfer relationships among A, B, and C are also collected. The collected data is cleaned, formatted, time-aligned, and matched with monitoring object identifiers to generate standard full-domain monitoring data. A full-domain monitoring object relationship graph is then established using A, B, and C as nodes.

[0144] Operational status data and resource capacity data for 30 consecutive sampling times are read from the operational data sequence of the monitored object. After dimensionless processing, a comprehensive operational status value and a resource capacity value are generated. The comprehensive operational status value of monitored object A is 0.82, and the resource capacity value is 0.74. These are combined to generate an operational capability value of 0.78. When the operational capability value of A decreases from 0.85 to 0.82, 0.77, and 0.73 respectively, an operational capability decrease segment is generated. The operational capability values ​​of 0.81, 0.83, and 0.82 from the three sampling times before the start of the decrease segment are used to generate an operational capability reference value of 0.82.

[0145] During the decline in A's operational capacity, load migration data records that A transferred 6, 5, 2, 4, and 1 resource units to B within 5 consecutive time slices. Subsequently, B's operational capacity declined, and B transferred 6, 5, 2, 4, and 1 resource units to C within the next set of 5 consecutive time slices. This generates corresponding load transfer data for A to B and B to C. After A completes the load transfer, its operational capacity value recovers from 0.71 and 0.77 to 0.83; after B completes the load transfer, its operational capacity value recovers from 0.70 and 0.76 to 0.82. All of the above operational capacities have recovered to their corresponding operational capacity reference values, thereby generating implicit compensation data for A to B and B to C.

[0146] Based on the implicit compensation data, security reserve call events corresponding to A to B and B to C are generated respectively. The resource amounts called by the A to B call events in the 5 consecutive time slices are 6, 5, 2, 4 and 1 resources respectively, and the recovery resource amounts are 2, 1, 3, 2 and 2 resources respectively. This generates a net security reserve consumption of 4, 4, -1, 2 and -1 resources, accumulating a total consumption of 8 resources. The recovery resource amounts corresponding to the B to C call events are 2, 1, 4, 1 and 3 resources respectively. This generates a net security reserve consumption of 4, 4, -2, 3 and -2 resources, accumulating a total consumption of 7 resources.

[0147] Based on the call time, the security reserve consumption segments corresponding to A to B and B to C are connected to generate a security reserve migration path from A to B to C. The initial security reserve of monitored object B is 60 resources, and after continuous updates, the remaining security reserve is generated to be 56, 52, 53, 51, and 52 resources. The initial security reserve of monitored object C is 20 resources, and after continuous updates, the remaining security reserve is generated to be 16, 12, 14, 11, and 13 resources. The remaining security reserves of B and C are written to the global security reserve ledger, and a security reserve burnout trajectory is generated according to the call time and security reserve migration direction.

[0148] During subsequent operation, monitored object A experienced an operational anomaly. The management center executed risk handling actions for two consecutive sampling cycles. Before the handling, the operational status values ​​for the two consecutive time slices were 0.82 and 0.81, and after the handling, they dropped to 0.78 and 0.76, generating operational status changes of 0.04 and 0.05. Before the handling, the load was 90 and 92 resource units, and after the handling, it dropped to 65 and 62 resource units, generating load decrease sequences of 25 and 30 resource units.

[0149] After the risk mitigation action was implemented, the load capacity of monitored object B increased from 5 and 6 resources before the mitigation to 25 and 28 resources, generating load capacity increases of 20 and 22 resources; the load capacity of monitored object C increased from 3 and 2 resources to 8 and 10 resources, generating load capacity increases of 5 and 8 resources. After confirmation by load migration data, the above increases all originated from monitored object A, thereby generating the corresponding mitigation transfer responses for B and C.

[0150] According to the order of occurrence of the load transfer records, the load reduction amounts of 25 and 30 resources corresponding to A are allocated to B and C. In the first consecutive time slice, 20 resources are allocated to B, and the remaining 5 resources are allocated to C. In the second consecutive time slice, 22 resources are allocated to B, and the remaining 8 resources are allocated to C. This generates risk disposal transfer data corresponding to A to B and A to C, and forms branch-type risk disposal shadow paths pointing from A to B and C respectively. At the same time, disposal transfer load sequences of 20 and 22 resources corresponding to B and 5 and 8 resources corresponding to C are generated.

[0151] The disposal and transfer load sequence and the safety reserve burnout trajectory are correlated according to the monitoring object identifier and time marker. The remaining safety reserve of monitoring object B in the six consecutive sampling times before the transfer time are 60, 56, 52, 53, 51 and 52 resources respectively. This generates a net change rate of safety reserve of -1.6 resources per sampling interval. The remaining safety reserve of monitoring object C are 20, 16, 12, 14, 11 and 13 resources respectively. This generates a net change rate of safety reserve of -1.4 resources per sampling interval.

[0152] Starting from the last recorded resource quantity of 52 in B, an initial acceptable safety reserve of 50.4 resources is generated. After accepting 20 resources, a second acceptable safety reserve of 28.8 resources is generated. Starting from the last recorded resource quantity of 13 in C, an initial acceptable safety reserve of 11.6 resources is generated. After accepting 5 resources, a second acceptable safety reserve of 5.2 resources is generated.

[0153] Comparing the 20 and 22 resource quantities corresponding to B with the 50.4 and 28.8 resource quantities respectively, reserve absorption gap values ​​of -30.4 and -6.8 resource quantities are generated, indicating that B still has absorption capacity. Comparing the 5 and 8 resource quantities corresponding to C with the 11.6 and 5.2 resource quantities respectively, reserve absorption gap values ​​of -6.6 and 2.8 resource quantities are generated. Since C has a positive gap for the first time at the second transfer time, C is identified as the priority target for the outbreak of risk in the entire region, the second transfer time is determined as the expected outbreak time, and 2.8 resource quantities are determined as the reserve absorption gap value.

[0154] During a 30-day application period, 36 risk mitigation actions were recorded. Nine of these involved load shifting to multiple monitored targets. In all cases, this invention generated corresponding risk mitigation shadow paths and identified reserve capacity gaps before the receiving targets actually experienced resource shortages. In the aforementioned operation, this invention identified a 2.8 resource capacity gap for monitored target C one sampling cycle in advance. Based on this, the management center reduced the load shifted to C and transferred some load to B, which still had capacity, ensuring continuous operation of related services. Therefore, this invention can correlate the safety reserve depletion process with the load shifting process after risk mitigation, predicting the priority risk targets, the expected outbreak time, and the reserve capacity gap value in advance, thus improving the advance notice, accuracy, and traceability of comprehensive risk monitoring and early warning.

[0155] Table 1. Performance Comparison of Comprehensive Risk Monitoring and Early Warning Methods

[0156] Priority burst object identification accuracy 72.2% 80.6% 86.1% 94.4% Branch transfer path integrity rate 44.4% 55.6% 77.8% 100% Average early warning time 0.2 sampling periods 0.6 sampling periods 0.9 sampling periods 1.4 sampling periods Average absolute error of reserve acceptance gap 6.8 resource quantities 5.1 resource quantities 3.9 resource quantities 1.7 resource units False alarm rate 19.4% 13.9% 11.1% 5.6%

[0157] As shown in Table 1, the accuracy rate of this invention in identifying priority risk targets across the entire domain reaches 94.4%, and it can correctly identify 34 out of 36 risk handling actions. This is an improvement of 22.2 percentage points compared to the fixed capacity threshold monitoring method and 13.8 percentage points compared to the single monitoring target trend analysis method. The main reason for this is that this invention does not judge risk solely based on the current capacity of the monitoring target or individual operational changes. Instead, it uses a correlation diagram of all monitoring targets across the entire domain to correlate the safety reserve burnout trajectory, the risk handling shadow path, and the handling transfer load sequence. This allows for simultaneous analysis of the impact of the load being transferred from the original risk monitoring target on multiple risk-bearing monitoring targets.

[0158] In nine instances of risk mitigation involving branch load transfers, the branch transfer path integrity rate of this invention reached 100%. It was able to completely record the transfer directions from the original risk monitoring object to different risk-receiving monitoring objects. The path integrity rate of the monitoring object association graph analysis method was 77.8%, while the fixed capacity threshold monitoring method only achieved 44.4%. This invention generates risk mitigation transfer data and branch-type risk mitigation shadow paths by associating direct mitigation responses and mitigation transfer responses. Therefore, it can reduce omissions in the sources and directions of load transfers, improving the integrity and traceability of the risk propagation process.

[0159] The average early warning time of this invention is 1.4 sampling periods, which is higher than the 0.2 sampling periods of the fixed capacity threshold monitoring method, the 0.6 sampling periods of the single monitoring object trend analysis method, and the 0.9 sampling periods of the monitoring object correlation graph analysis method. In the risk process of monitoring object C described in the embodiment, this invention identified 2.8 resource reserve absorption gaps one sampling period in advance. This single result does not conflict with the overall statistical result. The improvement in early warning capability comes from the fact that this invention uses the remaining safety reserve change sequence to calculate the net change rate of safety reserves and combines it with the subsequent transfer load to predict the absorbable safety reserves of each risk-bearing monitoring object.

[0160] In predicting reserve capacity gaps, the average absolute error of this invention is 1.7 resource units, lower than the 6.8 resource units of the fixed capacity threshold monitoring method, the 5.1 resource units of the single monitoring object trend analysis method, and the 3.9 resource units of the monitoring object correlation graph analysis method. Traditional methods typically estimate risk using the difference between current available capacity and load, without continuously considering the processes of safety reserve mobilization, resource recovery, and cross-object migration. This invention records the initial safety reserve, net consumption, and remaining safety reserve of each monitoring object through a global safety reserve ledger, making gap calculation closer to the actual capacity capacity.

[0161] The false alarm rate of this invention is 5.6%, corresponding to 2 false alarms in 36 risk management actions, which is lower than the 19.4% of the fixed capacity threshold monitoring method. This is because this invention simultaneously considers resource recovery, net changes in safety reserves, and the actual source of the transferred load, and can distinguish between short-term resource fluctuations and continuous reserve capacity shortages. In summary, this invention improves the accuracy of identifying priority outbreak targets, the completeness of the risk path, and the ability to provide early warnings, while also reducing the prediction error and false alarm rate of reserve capacity gaps.

[0162] The above are merely preferred embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A comprehensive risk monitoring and early warning method based on big data analysis, characterized in that, Includes the following steps: Collect full-domain operational data and monitoring object relationship data of each monitoring object within the entire domain, and preprocess them to generate standard full-domain monitoring data; Connect each node to generate a global monitoring object association graph, and generate an operational capability sequence for each monitoring object based on standard global monitoring data; Based on the operational capability sequence and standard full-domain monitoring data, identify the security reserve call behavior that occurs during monitoring, generate security reserve call events, and generate security reserve consumption fragments; Based on the association graph of objects monitored across the entire domain, the security reserve consumption segments with the same calling objects and consecutive calling times are connected to generate security reserve migration paths, and the entire domain security reserve ledger and security reserve burn-out trajectory are generated. Based on standard full-domain monitoring data, risk handling behaviors and original risk monitoring objects are identified, risk handling events are generated, and direct handling responses and handling transfer responses are generated respectively, taking into account changes in operation and load before and after handling. The risk disposal transfer data is generated by associating direct disposal responses and disposal transfer responses, and then the risk disposal transfer data is connected to generate risk disposal shadow paths and disposal transfer load sequences. Based on the monitoring object identification, risk disposal shadow path, disposal transfer load sequence, and safety reserve burnout trajectory, generate a reserve absorption gap prediction sequence and full-domain risk outbreak prediction data; Based on the prediction data of risk outbreaks across the entire domain, the prediction sequence of reserve capacity gaps, and the shadow path of risk disposal, the results of risk monitoring and early warning across the entire domain are generated and sent to the risk disposal terminal.

2. The method for comprehensive risk monitoring and early warning based on big data analysis according to claim 1, characterized in that, The preprocessing includes data cleaning, format standardization, time alignment, and monitoring object identifier matching; The overall operational data includes operational status data, resource capacity data, security reserve call-up data, load migration data, resource recovery data, and risk handling action data; The monitored object relationship data includes spatial connection relationships, business dependency relationships, resource sharing relationships, and load transfer relationships.

3. The method for comprehensive risk monitoring and early warning based on big data analysis according to claim 1, characterized in that, The generation of the operational capability sequence includes: The monitoring object identifiers and monitoring object relationship data are obtained from the standard full-domain monitoring data. Each monitoring object is used as a node, and the corresponding nodes are connected according to spatial connection relationship, business dependency relationship, resource sharing relationship and load transfer relationship to generate a full-domain monitoring object association graph. According to the monitoring object identifier and time, the operation status data and resource capacity data of the same monitoring object in the standard full-domain monitoring data are matched to generate the monitoring object operation data sequence; The operational status data in the operational data sequence of the monitored objects are numerically processed and combined with the resource capacity data corresponding to the same time to generate operational capability values ​​for each time. The operational capability values ​​are arranged in chronological order to generate the operational capability sequence of each monitored object.

4. The method for comprehensive risk monitoring and early warning based on big data analysis according to claim 1, characterized in that, The generation of the safety reserve consumption segment includes: The difference between adjacent operational capacity values ​​is calculated in chronological order, consecutive time periods of decline are merged to generate operational capacity decline segments, and operational capacity reference values ​​are generated based on the operational capacity before the segment begins. Obtain load migration data and safety reserve call data for the monitoring objects corresponding to the segment of reduced operational capacity, and generate corresponding load transfer data according to load type, load amount and occurrence time, corresponding to load transfer records and load takeover records; The data corresponding to load transfer is matched with the time segment of reduced operating capacity. Data that is within the segment when the load is transferred out, the amount transferred out corresponds to the amount received, and the operating capacity recovers to the reference value after the load is transferred out is retained, and implicit compensation data is generated. Based on the implicit compensation corresponding data, the monitoring object of the call source, the monitoring object of the call receiver, and the call time are determined, and the call resource quantity change process is generated according to the call resource quantity within the call time, and the security reserve call event is generated by combining them. Security reserve call events are divided according to the call time. The net consumption sequence and consumption amount of security reserve are generated by combining the call resource amount and resource recovery data. These are then combined with the call source monitoring object, the call receiving monitoring object and the call time to generate a security reserve consumption fragment.

5. The method for comprehensive risk monitoring and early warning based on big data analysis according to claim 1, characterized in that, The generation of the safety reserve burnout trajectory includes: Arrange the security reserve consumption fragments according to the call time to generate a security reserve consumption fragment sequence; From subsequent security reserve consumption segments, find data that have the same calling object, consecutive calling times, and a connection relationship in the global monitoring object association graph, and generate security reserve continuation data; Connect the security reserve consumption segments according to the corresponding relationships of the calling objects and the calling time in the security reserve continuation data, and extend different subsequent segments to generate security reserve migration paths; The net consumption of security reserves is summarized according to the monitoring object identification and the call time. The initial security reserve of each calling monitoring object is determined, and the remaining security reserve is updated in sequence to generate a global security reserve ledger. Based on the remaining safety reserve of the same monitored object connected by the call time, a sequence of changes in the remaining safety reserve is generated, and a safety reserve burn-out trajectory is generated by combining the monitored object identifier and the safety reserve migration path.

6. The method for comprehensive risk monitoring and early warning based on big data analysis according to claim 1, characterized in that, The generation of the disposal transfer response includes: Identify risk response actions from risk response action data, determine the original risk monitoring targets and the start and end times of the response, combine them to generate risk response events, and generate risk response event identifiers; Obtain operational status data and load migration data of the original risk monitoring object within the same duration before and after the start time of the disposal, and generate operational comparison data of the original risk monitoring object according to the collection time, operational status type and load type; The difference between the operational status data and load migration data before and after the handling is calculated to generate the operational status change sequence and load decrease sequence, which are then combined with the risk handling event identifier and the original risk monitoring object to generate a direct handling response; Identify the associated monitoring objects that took over the loads transferred from the original risk monitoring objects after the start of the handling process from the load migration data, arrange the load taking over according to the load type and collection time, and generate a load taking over sequence of associated monitoring objects. The load accrual sequence and load decrement sequence of the associated monitoring objects are matched according to load type and continuous time slice. Data on load accrual increases that originate from the original risk monitoring objects are retained and combined with risk disposal event identifiers, associated monitoring objects, and load types to generate disposal transfer responses.

7. The method for comprehensive risk monitoring and early warning based on big data analysis according to claim 1, characterized in that, The generation of the disposal transfer load sequence includes: Based on the risk handling event identifier and load type, for the same risk handling event, the direct handling response and handling transfer response are used to obtain the original risk monitoring object, load decrease sequence, associated monitoring object and associated monitoring object load take-up sequence, and generate handling response association data; Based on the data related to the response, the associated monitoring objects are identified as risk-bearing monitoring objects. According to the order of occurrence of continuous time slices and load-bearing records, the load reduction is sequentially allocated to each risk-bearing monitoring object to generate a corresponding sequence of changes in transferred load. The original risk monitoring targets, risk transfer monitoring targets, transfer time, and transfer load corresponding to each consecutive time slice are combined to generate risk disposal transfer data. Based on the association diagram of the monitoring objects in the whole domain, the risk disposal transfer data is arranged according to the risk disposal event identifier and transfer time. Taking the same original risk monitoring object as the starting point of the path, the data pointing to each risk-bearing monitoring object are connected to generate a risk disposal shadow path. Arrange the sequence of changes in transfer load according to the risk-bearing monitoring object and the transfer time, and summarize the transfer load of the same risk-bearing monitoring object in the same continuous time slice to generate a sequence of disposal transfer load.

8. The method for comprehensive risk monitoring and early warning based on big data analysis according to claim 1, characterized in that, The generation of the global risk outbreak prediction data includes: Based on the monitoring object identifier and time stamp, corresponding data for reserve acceptance is generated, including the monitoring object for risk acceptance, transfer time, transfer load, and remaining safety reserve. Obtain the sequence of changes in the remaining safety reserve of each risk-bearing monitoring object before the transfer time, calculate the change in the remaining safety reserve corresponding to adjacent time markers, and generate the net rate of change of safety reserve based on the sum of the changes and the number of sampling intervals; Starting with the last remaining safety reserve of each risk-bearing monitoring object before the first transfer time, the first acceptable safety reserve is generated by combining the net change rate of safety reserve and the transfer time interval. The subsequent acceptable safety reserves are generated by combining the previous acceptable safety reserve, the transfer load and the adjacent transfer time interval, thus forming an acceptable safety reserve prediction sequence. Based on the risk-bearing monitoring targets and time markers, the difference between the transfer load and the available safety reserve is calculated according to the corresponding disposal transfer load sequence and the available safety reserve prediction sequence, and a reserve acceptance gap prediction sequence is generated. The risk-bearing monitoring target corresponding to the first positive value in the reserve absorption gap prediction sequence is identified as the priority target for the outbreak of risk across the entire region. The corresponding transfer time and reserve absorption gap value are combined to generate the prediction data for the outbreak of risk across the entire region.

9. The method for comprehensive risk monitoring and early warning based on big data analysis according to claim 1, characterized in that, The generation of the comprehensive risk monitoring and early warning results includes: The system obtains the priority targets and expected outbreak times of risks across the entire domain from the risk outbreak prediction data. It then obtains the first transfer time pointing to the priority targets from the risk disposal shadow path according to the priority targets. Finally, it obtains the reserve acceptance gap value within the range from the transfer time to the expected outbreak time from the reserve acceptance gap prediction sequence and arranges them in chronological order to generate a reserve acceptance gap prediction segment. Obtain the path portion from the corresponding original risk monitoring object to the risk priority outbreak object in the entire domain along the risk disposal shadow path, and generate risk disposal shadow association fragments; The system combines the predicted data of the overall risk outbreak, the predicted fragments of the reserve absorption gap, and the shadow correlation fragments of risk disposal to generate the overall risk monitoring and early warning results, and sends the overall risk monitoring and early warning results to the risk disposal terminal.

Images