A background global monitoring and early warning method and system for multi-service system linkage

Abstract

The application discloses a kind of background global monitoring early warning method and system for multi-service system linkage, including first acquisition background global multi-source heterogeneous data and implementation standardization pretreatment, again constructs multi-service linkage dependent knowledge graph, realizes multilevel fault identification and global risk pre-judgment by building abnormal research mechanism.Meanwhile, construct quantitative scoring model to divide four standardization early warning levels, complete early warning directional hierarchical push in combination with operation post authority and business scope.The preset full-fault scene cross-service linkage disposal rule library of the application realizes multi-system fault automatic linkage disposal, and by archiving fault whole-process data, incremental training mode is used to iteratively optimize model parameters, graph weight and early warning rule, realize monitoring system self-adapting upgrade.The application solves the problems of traditional background monitoring fragmentation, low accuracy of early warning push, cross-service disposal lag, effectively improves the globality of background monitoring and operation intelligent level under multi-service linkage scene.

Description

Technical Field

[0001] This invention relates to the field of intelligent early warning technology, and in particular to a back-end full-domain monitoring and early warning method and system for multi-business system linkage. Background Technology

[0002] Currently, government and enterprise digital back-end systems generally adopt a distributed deployment architecture with multiple business systems. These systems are interconnected, share data, and link processes to support overall business operations. However, existing back-end monitoring and early warning technologies are mostly designed for single business systems, resulting in fragmented monitoring models and localized monitoring scopes. This makes them unsuitable for the full-domain operation and maintenance needs of multi-system linkage scenarios, and they suffer from several technical shortcomings: First, existing monitoring systems have a single data collection dimension, only collecting logs and operational parameter data from a single system. They cannot integrate heterogeneous data from multiple systems and sources, leading to data silos and insufficient monitoring data coverage, making it impossible to reconstruct the complete state of multi-business linkage operation. Second, traditional monitoring lacks a systematic business linkage and relies on cognition, judging single-point device or module anomalies based solely on fixed thresholds. This fails to identify the interrelationships and coupling between business systems, easily leading to missed single-point anomalies, misjudgments of linkage failures, and delayed prediction of overall failures. Even minor faults can easily trigger cascading downtime across systems.

[0003] Meanwhile, the existing early warning mechanism suffers from vague hierarchical structure, lacks a standardized quantitative scoring system, and exhibits subjective and inconsistent classification of abnormal early warning levels. Early warning pushes utilize a global broadcast model, failing to differentiate based on the job permissions and business jurisdiction of maintenance personnel. This results in core maintenance personnel being distracted by invalid warnings, missing crucial information, and extremely low maintenance efficiency. Furthermore, traditional fault handling relies on manual experience and lacks standardized cross-business collaborative handling rules. When faced with multi-system interconnected faults, manual response is delayed, and inconsistent procedures easily lead to errors and fault propagation. Finally, the existing monitoring and early warning system is rigid; model parameters and early warning rules cannot be iteratively optimized based on historical fault data. After long-term operation, its adaptability and accuracy continuously decline, failing to meet the maintenance monitoring needs of updated business systems.

[0004] Therefore, there is an urgent need for a new method for multi-business system linkage backend full-domain monitoring and early warning to solve the above problems. Summary of the Invention

[0005] To achieve the above objectives, this invention provides a back-end full-domain monitoring and early warning method for multi-business system linkage, which solves the problems of fragmented back-end monitoring, one-sided anomaly analysis, low accuracy of early warning push, and delayed cross-business handling in traditional back-end monitoring. It can significantly improve the full-domain, accuracy, and intelligent operation and maintenance level of back-end fault monitoring in multi-business linkage scenarios.

[0006] This invention provides a backend-wide monitoring and early warning method for multi-business system linkage, comprising the following steps: S1. Collect heterogeneous data from multiple sources across the entire backend and perform preprocessing; S2. Construct a knowledge graph of inter-business system dependencies; S3. Construct a progressive three-level anomaly assessment mechanism to identify and predict anomalies from single-point anomalies to global faults; S4. Construct a quantitative scoring model to classify abnormal events into four standardized early warning levels, and conduct targeted and tiered delivery of early warning information based on the job authority and business jurisdiction of operation and maintenance personnel. S5. Pre-build a cross-business linkage handling strategy rule library covering all fault scenarios, and automatically link and handle faults across business systems; S6. Archive the entire process of fault data and use incremental training mode to iteratively optimize model parameters, graph weights and early warning rules to achieve adaptive upgrades of the monitoring and early warning system.

[0007] Preferably, in S1, the collected multi-source heterogeneous data includes background device operating parameters, business system operating logs, interface call data, database read and write data, business flow data, and network transmission data; The collected multi-source heterogeneous data is preprocessed, including data cleaning, data normalization, data imputation, and time-series alignment. An extreme value normalization algorithm is used for normalization, and the normalization formula is as follows: ; in, This is the raw monitoring data. This is the maximum value of similar monitoring data. This is the minimum value among similar monitoring data. This refers to standardized data after normalization. The standardized monitoring dataset is obtained after preprocessing. Its expression is: ; in, For the first Standardized monitoring data, To monitor the total number of data entries, .

[0008] Preferably, in S1, the background device operating parameters include the CPU utilization, memory usage, disk read / write speed, remaining disk capacity, device operating temperature, port online status, hardware load rate, and device start / stop status of the background server, switch, and storage device. The business system operation log includes the startup log, operation trajectory log, program error log, process start and stop log, thread resource usage log, system timeout log, and function call operation log of each business system; Interface call data includes the call frequency, call success rate, response latency, number of timeouts, exception error codes, concurrent call volume, data transmission byte volume, and interface circuit breaker status data for cross-business system interfaces and internal system interfaces. Database read and write data includes database form read and write speed, execution time of data addition, deletion, modification and query, transaction success rate, data cache hit rate, number of database connections, read and write exception error data and data redundancy backup status; Business workflow data includes business work order submission volume, approval workflow duration, business completion rate, number of abnormal work orders, business node backlog data, user business access frequency, and business failure callback data. Network transmission data includes intranet bandwidth utilization, data transmission latency, network packet loss rate, port connection status, number of abnormal access requests, number of data packet retransmissions, and network jitter values.

[0009] Preferably, in S2, the knowledge graph for multi-business system linkage includes an entity layer, a relation layer, and a weight layer; The entity layer includes business system entities, backend hardware device entities, business interaction interface entities, and database storage node entities. Each type of entity is configured with a unique global identifier ID, which is used to associate and bind running status data and fault characteristic data. The relationship layer includes upstream and downstream call dependencies, cross-entity data transmission relationships, business process linkage relationships, and hardware resource consumption relationships. By constructing a global entity association topology matrix, a visualized business linkage network is built. The expression for the global entity association topology matrix is ​​as follows: ; In the formula, For the entire topology matrix of global entity association, This represents the total number of entities within the knowledge graph. For the first The entity and the first The associated topology identifier value of each entity, And it is a positive integer; The rules for determining the values ​​of elements in the global entity association topology matrix are as follows: When the The entity and the first When there is a direct linkage between two entities When the first The entity and the first When an entity has no linkage or association with another entity ; Diagonal elements of the matrix This indicates that the entity itself has no self-linking relationship; The weighting layer is used to quantify the tightness of the association between different entities and the priority of fault propagation. The association weight is calculated by a standardized linkage association degree formula. The calculation formula is: ; in, For the first The entity and the first The weights for bidirectional linkage between entities are taken in the range of [0,1]. For the first time within the preset statistical period The entity and the first Frequency of bidirectional interaction between entities; For the first time within the preset statistical period The entity and the first The effective data interaction volume of each entity; For the first , No. The number of related entities affected by the failure of any one entity represents the fault linkage radiation capability. This is the linkage frequency weighting coefficient. This represents the weighting coefficient for the amount of data interaction. The weighting coefficients for the scope of the fault's impact satisfy the constraint relationship. ,and ; By fusing the global entity association topology matrix with quantized association weights, a weighted association topology matrix is ​​constructed. The matrix calculation formula is: .

[0010] Preferably, in S3, the progressive three-level anomaly assessment mechanism includes a first-level single-point anomaly assessment, a second-level local linkage anomaly assessment, and a third-level global fault assessment, specifically: The first-level single-point anomaly analysis achieves single-node anomaly identification through parameter threshold comparison; Second-level local linkage anomaly analysis is based on the knowledge graph association relationship to analyze local business cluster anomalies caused by single-point anomalies; Level 3 global fault assessment predicts cross-system global cascading faults using a global correlation inference model. The formula for the global correlation inference model is: ; in, This represents the probability of a global failure. For the first The association weight of each local business cluster For the first The probability of anomalies in a local business cluster. This represents the total number of local business clusters. .

[0011] Preferably, in S4, a multi-dimensional weighted scoring algorithm is used to construct a quantitative scoring model, and the comprehensive anomaly scoring formula is as follows: ; in, For the comprehensive score of abnormality, Score the duration of the abnormality. The score is based on the number of business transactions affected by anomalies. Scoring the deviation of outlier data. For the risk scoring of abnormal linkage and spread, , , , These are the dimension weight coefficients, and , .

[0012] Preferably, in S4, based on the comprehensive anomaly score The standardized early warning levels are divided into four levels: Level 1 warning indicates an emergency fault. ≥90 points; Level 2 warning indicates a serious fault, at which point 70 points or less is required. <90 points; A Level 3 warning indicates a general fault; at this time, 40 minutes or less... <70 points; A Level 4 warning indicates a minor anomaly, at which point a score of 0 or lower is required. <40 points.

[0013] Preferably, in S5, the cross-business linkage handling strategy rule base is used to store the handling process, permission instructions, and linkage system list corresponding to various fault scenarios. The handling strategy is matched by fault scenario tags, and the handling priority formula is: ; in, Prioritize fault handling; This is the priority adjustment coefficient. ; An abnormal comprehensive score; The severity level is determined by the history of the fault.

[0014] Preferably, in S6, a dynamic loss function is used for incremental training. The formula for the dynamic loss function is: ; in, This represents the total loss value during iteration; Incremental learning coefficients, ; To train loss values ​​for newly added fault data; Use the loss value to train the historical model.

[0015] This invention also provides a back-end full-domain monitoring and early warning system for multi-business system linkage, used to implement the above-mentioned monitoring and early warning methods, including a data acquisition and preprocessing module, a knowledge graph construction module, an anomaly analysis module, a hierarchical early warning module, a cross-business linkage handling module, and an adaptive iterative optimization module; The data acquisition and preprocessing module is used to collect multi-source heterogeneous data from the entire domain, including backend equipment operating parameters, business system operating logs, interface call data, database read and write data, business flow data, and network transmission data. It also performs data cleaning, data filling, time-series alignment and normalization preprocessing, and outputs a standardized monitoring dataset. The knowledge graph construction module is used to build a multi-business linkage dependency knowledge graph, build a global entity association topology matrix and a weighted association topology matrix, quantify the linkage strength of each entity, and form a business linkage topology network. The Level 3 Anomaly Analysis Module is used to perform Level 1 Single-Point Anomaly Analysis, Level 2 Local Linkage Anomaly Analysis, and Level 3 Global Fault Prediction. Based on the knowledge graph association weights and the global association inference model, it performs anomaly identification and cascading fault risk prediction. The quantitative grading early warning module is used to complete the comprehensive scoring of anomalies through a multi-dimensional weighted scoring model, divide the warning into four standardized levels, and combine the operation and maintenance post permissions and business jurisdiction to push warning information in a targeted and graded manner. The cross-business linkage handling module is used to call the pre-built full-scenario linkage handling rule library, automatically match the handling strategy according to the fault handling priority, and execute cross-business system automated linkage protection and fault repair operations; The adaptive iterative optimization module is used to archive the entire fault process data to form a structured fault sample set, and adopts an incremental training mode and dynamic loss function to adaptively iteratively update the model parameters, graph weights, early warning thresholds and handling rules.

[0016] Therefore, the present invention employs the above-mentioned backend full-domain monitoring and early warning method and system for multi-business system linkage, and the beneficial effects are as follows: (1) Based on the knowledge graph of multi-business system linkage dependence, this invention sorts out the coupling relationship of the system, breaks the drawbacks of traditional single monitoring fragmentation and data silos, realizes full-node, full-business, full-process full-domain monitoring in the background, can accurately capture hidden anomalies, and provide comprehensive and reliable data support for fault judgment and early warning.

[0017] (2) The progressive three-level abnormal judgment mechanism constructed by the present invention can accurately identify single-point, local linkage and whole-domain chain hidden faults. It can standardize the division of warning levels through a multi-dimensional quantitative scoring model, and realize the targeted hierarchical push of warnings by combining operation and maintenance permissions and business scope. It can effectively avoid the interference of invalid warnings and the omission of key warnings, and significantly improve the accuracy of fault response and warning.

[0018] (3) Based on the rule library of cross-business linkage handling strategy for the whole scenario, the present invention realizes the automated linkage handling of faults in multiple business systems, which can replace the inefficient manual operation and maintenance mode, shorten the fault handling time, and suppress the cross-system spread of faults. At the same time, through fault data archiving and incremental training, the model parameters, graph weights and early warning rules are adaptively and iteratively optimized to adapt to the iterative change requirements of business systems, reduce the cost of manual operation and maintenance, and continuously ensure the stable operation of the back-end system.

[0019] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0020] Figure 1 This is an overall flowchart of an embodiment of a back-end full-domain monitoring and early warning method for multi-business system linkage according to the present invention; Figure 2 This is a flowchart illustrating the knowledge graph construction process of an embodiment of a backend full-domain monitoring and early warning method for multi-business system linkage according to the present invention. Figure 3 This is a flowchart illustrating the progressive three-level anomaly assessment process of an embodiment of a back-end full-domain monitoring and early warning method for multi-business system linkage according to the present invention. Figure 4 This is a comparison test result diagram of the traditional monitoring method and the method of the present invention with the back-end full-domain monitoring and early warning method and system embodiment of the present invention for multi-business system linkage. Detailed Implementation

[0021] The technical solution of the present invention will be further described below with reference to the accompanying drawings and embodiments.

[0022] Unless otherwise defined, the technical or scientific terms used in this invention shall have the ordinary meaning understood by one of ordinary skill in the art to which this invention pertains. The terms "first," "second," and similar terms used in this invention do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Terms such as "comprising" or "including" mean that the element or object preceding the word encompasses the elements or objects listed following the word and their equivalents, without excluding other elements or objects.

[0023] like Figure 1 As shown, a backend-wide monitoring and early warning method for multi-business system linkage includes the following steps: S1. Collect heterogeneous data from multiple sources across the entire backend and perform preprocessing.

[0024] The multi-source heterogeneous data collected by this invention includes background device operating parameters, business system operating logs, interface call data, database read and write data, business flow data, and network transmission data.

[0025] The backend device operating parameters include CPU utilization, memory usage, disk read / write speed, remaining disk capacity, device operating temperature, port online status, hardware load rate, and device start / stop status of the backend server, switch, and storage device.

[0026] The business system operation logs include the startup logs, operation trajectory logs, program error logs, process start and stop logs, thread resource usage logs, system timeout logs, and function call operation logs of each business system.

[0027] Interface call data includes the call frequency, call success rate, response latency, number of timeouts, exception error codes, concurrent call volume, data transmission byte volume, and interface circuit breaker status data for cross-business system interfaces and internal system interfaces.

[0028] Database read and write data includes database form read and write speed, execution time of data addition, deletion, modification and query, transaction success rate, data cache hit rate, number of database connections, read and write exception error data, and data redundancy backup status.

[0029] Business workflow data includes the number of business work orders submitted, approval workflow duration, business completion rate, number of abnormal work orders, business node backlog data, user business access frequency, and business failure callback data.

[0030] Network transmission data includes intranet bandwidth utilization, data transmission latency, network packet loss rate, port connection status, number of abnormal access requests, number of data packet retransmissions, and network jitter values.

[0031] The collected multi-source heterogeneous data is preprocessed, including data cleaning, data normalization, data imputation, and time-series alignment. An extreme value normalization algorithm is used for normalization, and the normalization formula is as follows: ; in, This is the raw monitoring data. This is the maximum value of similar monitoring data. This is the minimum value among similar monitoring data. This is standardized data after normalization.

[0032] The standardized monitoring dataset is obtained after preprocessing. Its expression is: ; in, For the first Standardized monitoring data, To monitor the total number of data entries, .

[0033] S2, such as Figure 2 As shown, a multi-business system linkage dependency knowledge graph is constructed, including an entity layer, a relationship layer, and a weight layer.

[0034] The entity layer includes business system entities, backend hardware device entities, business interaction interface entities, and database storage node entities. Each type of entity is configured with a unique global identifier ID, which is used to associate and bind running status data and fault characteristic data.

[0035] The relationship layer includes upstream and downstream call dependencies, cross-entity data transmission relationships, business process linkage relationships, and hardware resource consumption relationships. By constructing a global entity association topology matrix, a visualized business linkage network is built. The expression for the global entity association topology matrix is ​​as follows: ; In the formula, For the entire topology matrix of global entity association, This represents the total number of entities within the knowledge graph. For the first The entity and the first The associated topology identifier value of each entity, And it is a positive integer.

[0036] The rules for determining the values ​​of elements in the global entity association topology matrix are as follows: When the The entity and the first When there is a direct linkage between two entities When the first The entity and the first When an entity has no linkage or association with another entity ; Diagonal elements of the matrix This indicates that the entity itself has no self-linking relationship.

[0037] The weighting layer is used to quantify the tightness of the association between different entities and the priority of fault propagation. The association weight is calculated by a standardized linkage association degree formula. The calculation formula is: ; in, For the first The entity and the first The weights for bidirectional linkage between entities are taken in the range of [0,1]. For the first time within the preset statistical period The entity and the first Frequency of bidirectional interaction between entities; For the first time within the preset statistical period The entity and the first The effective data interaction volume of each entity; For the first , No. The number of related entities affected by the failure of any one entity represents the fault linkage radiation capability. This is the linkage frequency weighting coefficient. This refers to the weighting coefficient for data interaction volume. The weighting coefficients for the scope of the fault's impact satisfy the constraints. ,and .

[0038] By fusing the global entity association topology matrix with quantized association weights, a weighted association topology matrix is ​​constructed. The matrix calculation formula is: .

[0039] S3, such as Figure 3 As shown, a progressive three-level anomaly assessment mechanism is constructed to identify and predict faults from single-point anomalies to global faults. This mechanism includes level one single-point anomaly assessment, level two localized linked anomaly assessment, and level three global fault assessment. Specifically: The first-level single-point anomaly assessment achieves single-node anomaly identification through parameter threshold comparison.

[0040] The secondary local linkage anomaly assessment uses knowledge graph relationships to assess local business cluster anomalies caused by single-point anomalies.

[0041] Level 3 global fault assessment predicts cross-system global cascading faults using a global correlation inference model. The formula for the global correlation inference model is: ; in, This represents the probability of a global failure. For the first The association weight of each local business cluster For the first The probability of anomalies in a local business cluster. This represents the total number of local business clusters. .

[0042] S4. Construct a quantitative scoring model to classify abnormal events into four standardized early warning levels, and deliver early warning information in a targeted and tiered manner based on the job authority and business jurisdiction of the operation and maintenance personnel.

[0043] This step uses a multi-dimensional weighted scoring algorithm to construct a quantitative scoring model. The comprehensive anomaly scoring formula is as follows: ; in, For the comprehensive score of abnormality, Score the duration of the abnormality. The score is based on the number of business transactions affected by anomalies. Scoring the deviation of outlier data. For the risk scoring of abnormal linkage and spread, , , , These are the dimension weight coefficients, and , .

[0044] Further based on the comprehensive score of anomalies The standardized early warning levels are divided into four levels: Level 1 warning indicates an emergency fault. ≥90 points.

[0045] Level 2 warning indicates a serious fault, at which point 70 points or less is required. <90 points.

[0046] A Level 3 warning indicates a general fault; at this time, 40 minutes or less... <70 points.

[0047] A Level 4 warning indicates a minor anomaly, at which point a score of 0 or lower is required. <40 points.

[0048] S5. Pre-build a cross-business linkage handling strategy rule library covering all fault scenarios, storing the handling process, permission instructions, and linkage system list corresponding to various fault scenarios. The handling strategy is matched by fault scenario tags, and the handling priority formula is: ; in, Prioritize fault handling; This is the priority adjustment coefficient. ; An abnormal comprehensive score; The severity level is determined by the history of the fault.

[0049] S6. Archive the entire process of fault data and use incremental training mode to iteratively optimize model parameters, graph weights and early warning rules to achieve adaptive upgrades of the monitoring and early warning system.

[0050] Specifically, a dynamic loss function is used for incremental training. The formula for the dynamic loss function is as follows: ; in, This represents the total loss value during iteration; Incremental learning coefficients, ; To train loss values ​​for newly added fault data; Use the loss value to train the historical model.

[0051] This invention also provides a back-end full-domain monitoring and early warning system for multi-business system linkage, used to implement the above-mentioned monitoring and early warning methods, including a data acquisition and preprocessing module, a knowledge graph construction module, an anomaly analysis module, a hierarchical early warning module, a cross-business linkage handling module, and an adaptive iterative optimization module.

[0052] The data acquisition and preprocessing module is used to collect heterogeneous data from multiple sources across the entire domain, including backend equipment operating parameters, business system operating logs, interface call data, database read and write data, business flow data, and network transmission data. It also performs data cleaning, data filling, time-series alignment, and normalization preprocessing to output a standardized monitoring dataset.

[0053] The knowledge graph construction module is used to build a multi-business linkage dependency knowledge graph, construct a global entity association topology matrix and a weighted association topology matrix, quantify the linkage strength of each entity, and form a business linkage topology network.

[0054] The Level 3 Anomaly Analysis Module is used to perform Level 1 Single-Point Anomaly Analysis, Level 2 Local Linkage Anomaly Analysis, and Level 3 Global Fault Prediction. Based on the knowledge graph association weights and the global association inference model, it performs anomaly identification and cascading fault risk prediction.

[0055] The quantitative grading and early warning module is used to complete the comprehensive scoring of anomalies through a multi-dimensional weighted scoring model, divide the warning into four standardized levels, and combine the operation and maintenance position permissions and business jurisdiction to push warning information in a targeted and graded manner.

[0056] The cross-business linkage handling module is used to call a pre-built full-scenario linkage handling rule library, automatically match handling strategies according to fault handling priorities, and execute cross-business system automated linkage protection and fault repair operations.

[0057] The adaptive iterative optimization module is used to archive the entire fault process data to form a structured fault sample set, and adopts an incremental training mode and dynamic loss function to adaptively iteratively update the model parameters, graph weights, early warning thresholds and handling rules.

[0058] Example 1: This embodiment takes a multi-business linkage operation and maintenance scenario of a large enterprise's digital back-end as the application object. The enterprise's back-end includes a user management system, a data statistics system, a business approval system, an interface scheduling system, and a database storage system. In daily operation, single-point anomalies can easily cause cross-system chain failures. Traditional monitoring methods cannot achieve full-domain monitoring and accurate early warning. The specific implementation process of the method of this invention is as follows.

[0059] Step 1: Build a comprehensive data acquisition probe, deployed across various business nodes in the enterprise backend, to collect multi-source heterogeneous data from five major business systems in real time. This includes server CPU, memory, and disk hardware operating parameters; system operation logs and error messages; frequency, success rate, and latency of inter-system interface calls; database read / write speed, data fault tolerance, and storage capacity; business approval, data flow, and user access data; and intranet network latency and packet loss transmission data. After collecting the raw data, perform standardized preprocessing: data cleaning removes duplicate, invalid, and null data; extreme value normalization algorithms unify the dimensions of data across different dimensions; linear interpolation fills in missing data; and timestamp-based time-series alignment of all data is completed, ultimately generating a standardized monitoring dataset. This is used for subsequent model analysis and map construction.

[0060] Step 2: Construct a knowledge graph of dependencies between multiple business systems: The entity layer comprises 5 business system entities, 12 backend server entities, 28 business interface entities, and 4 database entities; the relationship layer organizes the call dependencies, data transmission, process linkages, and resource consumption relationships between the entities. For example, the user management system provides user permission data support for the business approval system, and the interface scheduling system is responsible for data interaction and transmission between all systems; the weight layer calculates the association weight of each entity using an association weight formula, and in this embodiment, weight coefficients are set. =0.4、 =0.35、 =0.25, which satisfies the condition. The weights of the linkages between each core business system are calculated using formulas, clarifying the priority of the linkage impact of each system failure, and providing a basis for subsequent abnormal linkage analysis.

[0061] Step 3: Establish a progressive anomaly assessment system with three levels to achieve hierarchical fault identification and prediction. Level 1 Single-Point Anomaly Assessment: By pre-setting hardware parameters, interface indicators, and business data thresholds, and comparing real-time monitoring data, identify explicit anomalies in single nodes or systems, such as excessive server CPU utilization or failed interface calls. Level 2 Local Linkage Anomaly Assessment: Based on knowledge graph entity relationships, infer the operational status of related business clusters based on single-point anomalies to determine whether a single-point anomaly triggers local business linkage anomalies. Level 3 Global Fault Assessment: Employ a global linkage inference model to calculate the probability of global fault occurrence and predict the risk of cross-system cascading faults. In this embodiment, the five major business systems are divided into two local business clusters. The global linkage inference model is used to calculate the probability of cluster anomaly linkage in real time, achieving early prediction of global faults.

[0062] Step 4: Conduct anomaly scoring using a multi-dimensional quantitative scoring model. In this embodiment, dimension weight coefficients are set. =0.25、 =0.3、 =0.25、 =0.2, which satisfies A comprehensive score is calculated based on four dimensions: duration of anomalies, number of affected services, data deviation, and risk of spread. The scores are then used to classify alerts into four levels. Simultaneously, the job permissions and business jurisdiction of operations and maintenance personnel are reviewed, categorizing them into four types: super administrators, business operations and maintenance supervisors, general operations and maintenance engineers, and monitoring duty personnel. Different alert levels are then matched to different target groups to achieve targeted and tiered alert delivery. The four alert levels, scoring criteria, and corresponding target groups are shown in Table 1 below. Table 1. Correspondence between Level 4 Warning Levels, Scoring Criteria, and Target Groups for Warnings

[0063] During the test in this embodiment, the interface call delay of the interface scheduling system was continuously exceeded. After quantitative scoring of 82 points, it was determined to be a level 2 serious warning. The system automatically pushed the warning to the interface business operation and maintenance supervisor and the corresponding operation and maintenance engineer, achieving accurate and targeted reach, with no invalid warning pushes.

[0064] Step 5: Automated Cross-Business System Collaborative Handling: A collaborative handling strategy rule library covering all fault scenarios in the enterprise's backend system is pre-built. This includes standardized handling procedures, linkage commands, system start / stop rules, and data repair strategies for 32 sub-categories of fault scenarios across five major categories: hardware faults, interface faults, business flow faults, data transmission faults, and system downtime faults. Fault handling priority is calculated using a handling priority formula; this embodiment sets an adjustment coefficient. =0.6, combining anomaly scoring with the historical fault severity ranking for handling order. When an anomaly is detected in the interface scheduling system and triggers a level 2 alert, the system automatically matches the interface delay fault handling strategy in the rule base and automatically executes coordinated operations such as abnormal interface rate limiting, backup interface switching, faulty interface restart, and temporary protection for related business systems, without manual intervention, quickly curbing the spread of the fault.

[0065] Step Six: Fault Data Archiving and Incremental Iterative Optimization of the System: The entire process of fault data collection, analysis, early warning information, handling procedures, and handling results is archived to form a structured fault dataset. An incremental training mode is adopted, relying on the dynamic loss function defined in claim 9 to conduct iterative model optimization. This embodiment sets incremental learning coefficients. =0.7, balancing the characteristics of newly added fault data with historical model training experience. By minimizing the total iterative loss value, the parameters of the anomaly scoring model, the association weights of the business knowledge graph, the early warning threshold rules, and the handling strategy rules are optimized. After multiple incremental iterations, the system's accuracy in identifying interface anomalies and cross-system linkage faults has been significantly improved, achieving adaptive upgrades to the monitoring and early warning system.

[0066] To verify the effectiveness of this invention, this embodiment conducts a 30-day comparative test between the traditional monitoring method and the method of this invention, and statistically analyzes the core operation and maintenance indicators. The comparison results are shown in Table 2 below. Figure 4 As shown: Table 2. Comparison of test results between traditional monitoring methods and the method of this invention.

[0067] Overall test data shows that, compared with the traditional single, static, and passive background monitoring mode, the present invention has achieved a comprehensive technical upgrade in fault identification, risk prediction, early warning push, fault handling, and system iteration in multi-business linkage scenarios, and the overall operation and maintenance monitoring performance has been significantly improved.

[0068] Therefore, the present invention adopts the above-mentioned back-end full-domain monitoring and early warning method and system for multi-business system linkage, which can effectively eliminate data silos and monitoring blind spots, significantly improve the accuracy of hidden linkage fault identification and full-domain risk prediction capability, greatly reduce invalid early warning interference, shorten fault handling time, curb the spread of cross-system faults, and continuously optimize the adaptability of the monitoring system by relying on the incremental iteration mechanism, thereby comprehensively improving the operational stability, operation and maintenance intelligence and automation level of the multi-business back-end cluster.

[0069] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit them. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the technical solutions of the present invention, and these modifications or equivalent substitutions cannot cause the modified technical solutions to deviate from the spirit and scope of the technical solutions of the present invention.

Claims

1. A back-end comprehensive monitoring and early warning method for multi-business system linkage, characterized in that, Includes the following steps: S1. Collect heterogeneous data from multiple sources across the entire backend and perform preprocessing; S2. Construct a knowledge graph of inter-business system dependencies; S3. Construct a progressive three-level anomaly assessment mechanism to identify and predict anomalies from single-point anomalies to global faults; S4. Construct a quantitative scoring model to classify abnormal events into four standardized early warning levels, and conduct targeted and tiered delivery of early warning information based on the job authority and business jurisdiction of operation and maintenance personnel. S5. Pre-build a cross-business linkage handling strategy rule library covering all fault scenarios, and automatically link and handle faults across business systems; S6. Archive the entire process of fault data and use incremental training mode to iteratively optimize model parameters, graph weights and early warning rules to achieve adaptive upgrades of the monitoring and early warning system.

2. The back-end full-domain monitoring and early warning method for multi-business system linkage according to claim 1, characterized in that, In S1, the collected multi-source heterogeneous data includes backend device operating parameters, business system operating logs, interface call data, database read and write data, business flow data, and network transmission data; The collected multi-source heterogeneous data is preprocessed, including data cleaning, data normalization, data imputation, and time-series alignment. An extreme value normalization algorithm is used for normalization, and the normalization formula is as follows: ； in, This is the raw monitoring data. This is the maximum value of similar monitoring data. This is the minimum value among similar monitoring data. This refers to standardized data after normalization. The standardized monitoring dataset is obtained after preprocessing. Its expression is: ； in, For the first Standardized monitoring data, To monitor the total number of data entries, .

3. The back-end full-domain monitoring and early warning method for multi-business system linkage according to claim 2, characterized in that, In S1, the background device operating parameters include the CPU utilization, memory usage, disk read / write speed, disk remaining capacity, device operating temperature, port online status, hardware load rate, and device start / stop status of the background server, switch, and storage device. The business system operation log includes the startup log, operation trajectory log, program error log, process start and stop log, thread resource usage log, system timeout log, and function call operation log of each business system; Interface call data includes the call frequency, call success rate, response latency, number of timeouts, exception error codes, concurrent call volume, data transmission byte volume, and interface circuit breaker status data for cross-business system interfaces and internal system interfaces. Database read and write data includes database form read and write speed, execution time of data addition, deletion, modification and query, transaction success rate, data cache hit rate, number of database connections, read and write exception error data and data redundancy backup status; Business workflow data includes business work order submission volume, approval workflow duration, business completion rate, number of abnormal work orders, business node backlog data, user business access frequency, and business failure callback data. Network transmission data includes intranet bandwidth utilization, data transmission latency, network packet loss rate, port connection status, number of abnormal access requests, number of data packet retransmissions, and network jitter values.

4. The back-end full-domain monitoring and early warning method for multi-business system linkage according to claim 3, characterized in that, In S2, the multi-business system linkage relies on the knowledge graph, which includes the entity layer, the relationship layer, and the weight layer. The entity layer includes business system entities, backend hardware device entities, business interaction interface entities, and database storage node entities. Each type of entity is configured with a unique global identifier ID, which is used to associate and bind running status data and fault characteristic data. The relationship layer includes upstream and downstream call dependencies, cross-entity data transmission relationships, business process linkage relationships, and hardware resource consumption relationships. By constructing a global entity association topology matrix, a visualized business linkage network is built. The expression for the global entity association topology matrix is ​​as follows: ； In the formula, For the entire topology matrix of global entity association, This represents the total number of entities within the knowledge graph. For the first The entity and the first The associated topology identifier value of each entity, And it is a positive integer; The rules for determining the values ​​of elements in the global entity association topology matrix are as follows: When the The entity and the first When there is a direct linkage between two entities When the first The entity and the first When an entity has no linkage or association with another entity ; Diagonal elements of the matrix This indicates that the entity itself has no self-linking relationship; The weighting layer is used to quantify the tightness of the association between different entities and the priority of fault propagation. The association weight is calculated through a standardized linkage association degree formula. The calculation formula is: ； in, For the first The entity and the first The weights for bidirectional linkage between entities are taken in the range of [0,1]. For the first time within the preset statistical period The entity and the first Frequency of bidirectional interaction between entities; For the first time within the preset statistical period The entity and the first The effective data interaction volume of each entity; For the first , No. The number of related entities affected by the failure of any one entity represents the fault linkage radiation capability. This is the linkage frequency weighting coefficient. This refers to the weighting coefficient for data interaction volume. The weighting coefficients for the scope of the fault's impact satisfy the constraint relationship. ,and ; By fusing the global entity association topology matrix with quantized association weights, a weighted association topology matrix is ​​constructed. The matrix calculation formula is: 。 5. A back-end full-domain monitoring and early warning method for multi-business system linkage according to claim 4, characterized in that, In S3, the progressive three-level anomaly assessment mechanism includes level one single-point anomaly assessment, level two local linkage anomaly assessment, and level three global fault assessment, specifically: The first-level single-point anomaly analysis achieves single-node anomaly identification through parameter threshold comparison; Second-level local linkage anomaly analysis is based on the knowledge graph association relationship to analyze local business cluster anomalies caused by single-point anomalies; Level 3 global fault assessment predicts cross-system global cascading faults using a global correlation inference model. The formula for the global correlation inference model is: ； in, This represents the probability of a global failure. For the first The association weight of each local business cluster For the first The probability of anomalies in a local business cluster. This represents the total number of local business clusters. .

6. A back-end full-domain monitoring and early warning method for multi-business system linkage according to claim 5, characterized in that, In S4, a multi-dimensional weighted scoring algorithm is used to construct a quantitative scoring model. The comprehensive anomaly scoring formula is as follows: ； in, For the comprehensive score of abnormality, Score the duration of the abnormality. The score is based on the number of business transactions affected by anomalies. Scoring the deviation of outlier data. For the risk scoring of abnormal linkage and spread, , , , These are the dimension weight coefficients, and , .

7. A back-end full-domain monitoring and early warning method for multi-business system linkage according to claim 6, characterized in that, In S4, based on the comprehensive anomaly score The standardized early warning levels are divided into four levels: Level 1 warning indicates an emergency fault. ≥90 points; Level 2 warning indicates a serious fault, at which point 70 points or less is required. <90 points; A Level 3 warning indicates a general fault; at this time, 40 minutes or less... <70 points; A Level 4 warning indicates a minor anomaly, at which point a score of 0 or lower is required. <40 points.

8. A back-end full-domain monitoring and early warning method for multi-business system linkage according to claim 7, characterized in that, In S5, the cross-business collaborative handling strategy rule base is used to store the handling processes, permission instructions, and lists of linked systems corresponding to various fault scenarios. Handling strategies are matched based on fault scenario tags, and the handling priority formula is: ； in, Prioritize fault handling; This is the priority adjustment coefficient. ; An abnormal comprehensive score; The severity level is determined by the history of the fault.

9. A back-end full-domain monitoring and early warning method for multi-business system linkage according to claim 8, characterized in that, In S6, a dynamic loss function is used for incremental training. The formula for the dynamic loss function is: ； in, This represents the total loss value during iteration; Incremental learning coefficients, ; To train loss values ​​for newly added fault data; Use the loss value to train the historical model.

10. A back-end full-domain monitoring and early warning system for multi-business system linkage, used to implement the monitoring and early warning method according to any one of claims 1-9, characterized in that, It includes a data acquisition and preprocessing module, a knowledge graph construction module, an anomaly analysis module, a hierarchical early warning module, a cross-business collaborative handling module, and an adaptive iterative optimization module; The data acquisition and preprocessing module is used to collect multi-source heterogeneous data from the entire domain, including backend equipment operating parameters, business system operating logs, interface call data, database read and write data, business flow data, and network transmission data. It also performs data cleaning, data filling, time-series alignment and normalization preprocessing, and outputs a standardized monitoring dataset. The knowledge graph construction module is used to build a multi-business linkage dependency knowledge graph, build a global entity association topology matrix and a weighted association topology matrix, quantify the linkage strength of each entity, and form a business linkage topology network. The Level 3 Anomaly Analysis Module is used to perform Level 1 Single-Point Anomaly Analysis, Level 2 Local Linkage Anomaly Analysis, and Level 3 Global Fault Prediction. Based on the knowledge graph association weights and the global association inference model, it performs anomaly identification and cascading fault risk prediction. The quantitative grading early warning module is used to complete the comprehensive scoring of anomalies through a multi-dimensional weighted scoring model, divide the warning into four standardized levels, and combine the operation and maintenance post permissions and business jurisdiction to push warning information in a targeted and graded manner. The cross-business linkage handling module is used to call the pre-built full-scenario linkage handling rule library, automatically match the handling strategy according to the fault handling priority, and execute cross-business system automated linkage protection and fault repair operations; The adaptive iterative optimization module is used to archive the entire fault process data to form a structured fault sample set, and adopts an incremental training mode and dynamic loss function to adaptively iteratively update the model parameters, graph weights, early warning thresholds and handling rules.

Images