A method and system for dynamically processing test data files under multi-threading

Abstract

The present application relates to the field of cache data processing, and more particularly to a kind of multi-thread test data file dynamic processing method and system, the present application is by obtaining the data performance behavior characteristic set of each test equipment, subsequent data performance behavior characteristic set is used to analyze the data chain attribute corresponding to test equipment, constructs the data chain attribute of test equipment exclusively, when subsequent data collected by test equipment needs to be processed, the data chain attribute corresponding to test equipment is called, corresponding effective length extraction is collected test data, only the component data chain corresponding to sensitive behavior component is extracted, the potential anomaly of pre-analysis test data is pre-analyzed, and the differentiated test data processing logic is constructed.The present application constructs the data chain attribute exclusively for different test equipment, so that behavior characteristic analysis can be self-adaptively matched with the transmission law of each device, without analyzing the potential anomaly of pre-analysis data, reduce resource waste, differentiate the processing of normal data and potential abnormal data, and reduce write load.

Description

Technical Field

[0001] This invention relates to the field of test data processing, and in particular to a method and system for dynamic processing of test data files under multi-threading. Background Technology

[0002] With the rapid development of industrial automation testing, simulation verification, and production line data acquisition, the amount of data continuously generated by testing equipment during operation has increased dramatically. Taking typical scenarios such as automotive component durability testing, aero-engine simulation, and electronic component aging testing as examples, a single testing device can generate thousands to tens of thousands of test data records per unit time. When multiple testing devices run in parallel, the total amount of data is even larger. This test data typically needs to be written to storage media in real time for subsequent analysis, traceability, and anomaly detection.

[0003] For example, Chinese Patent Publication No. CN109086186A discloses a log detection method and apparatus. This method obtains the user's current log sequence, determines the corresponding index sequence based on a preset global dictionary, and the index sequence includes multiple sequentially executed index numbers. At least one index number is input into a log prediction model to obtain a set of predicted index numbers corresponding to at least one index number. If the set of predicted index numbers does not contain the next index number corresponding to at least one index number in the index sequence, an anomaly is indicated in the log sequence. This method predicts log logic and log health, issuing alerts when log anomalies are detected, assisting testers in their testing work, and improving testing efficiency and accuracy.

[0004] However, the following problems still exist in the existing technology. Existing technologies rely on full parsing of the data content for anomaly detection in test data, without considering the temporal behavior characteristics of the test data at the data flow level. This results in problems such as high I / O overhead and write blocking caused by read-write lock contention during multi-threaded concurrency. In addition, normal data and abnormal data are written in the same way, making it difficult to guarantee the integrity of abnormal data and resulting in high detection latency. Summary of the Invention

[0005] To address this, the present invention provides a method and system for dynamic processing of test data files under multi-threading, which overcomes the problem that the existing technology relies on full parsing of the data content for anomaly detection of test data, does not consider the temporal behavior characteristics of the test data at the data stream level, and has problems such as large I / O overhead and write blocking caused by read-write lock contention during multi-threaded concurrency.

[0006] To achieve the above objectives, on the one hand, the present invention provides a method for dynamic processing of test data files under multi-threading, which includes: Obtain the data performance behavior feature set of the time-domain mapping of the test data collected by each test device within the historical period, wherein the data performance behavior feature set is composed of behavior components; The data chain attributes corresponding to each test device are analyzed based on the data performance behavior feature set. This includes extracting the time-domain data stream of the time-domain behavior feature set with an incrementally increasing extraction length to form several candidate data chains, analyzing the stability of the behavior components corresponding to each candidate data chain, verifying the effective length of the data chain, and determining the sensitive behavior components. In response to processing the test data collected by the test equipment, the data chain attribute corresponding to the test equipment is invoked, and the collected test data is periodically extracted according to the corresponding effective length. Only the component data chain corresponding to each of the sensitive behavior components is extracted, and the potential anomalies of the test data are pre-analyzed based on the component data chain. The test data is processed based on the results of the potential anomaly analysis, including: Write all test data with potential anomalies to the target area and mark it; In addition, a temporary buffer is constructed to temporarily store the test data that does not have potential anomalies, and a temporary read object is determined to temporarily read the corresponding local test data for correlation verification. Based on the correlation verification results, the potential anomaly analysis results are corrected or the test data is downloaded and written to the target area.

[0007] It should be noted that the process of analyzing the stability of the corresponding behavioral components of each candidate data chain includes, Several candidate data chains corresponding to the same extraction length in clustering; Extract the behavioral components corresponding to each of the candidate data chains; By comparing the same behavioral components among the candidate data chains, the stability indices of the behavioral components are determined, including the similarity between components and the dispersion within components. The stability of the corresponding behavioral component at the extraction length is determined based on the stability index; The behavioral components include transmission rhythm behavioral components, data distribution behavioral components, and transmission link behavioral components. If the similarity between components is greater than a predetermined similarity threshold and the dispersion within a component is less than a predetermined dispersion threshold, then the behavioral components are determined to have stability.

[0008] It should be noted that the process of verifying the effective length of the data chain includes, If a behavioral component exhibits stability at the specified extraction length, then the extraction length is determined as a candidate extraction length. Determine the number of stable behavioral components for each candidate extraction length; The candidate extraction length with the largest number of behavioral components is determined as the effective length.

[0009] It should be noted that the process of determining the weight of sensitive behaviors includes, Determine the behavioral components that possess stability within the effective length, and analyze the sensitivity index based on the time-domain data stream corresponding to the behavioral components; The behavioral components are sorted in descending order based on sensitivity indicators; Based on a predetermined ratio, select behavioral components at the beginning of the descending sequence as sensitive behavioral components. The sensitivity index is determined by introducing abnormal data into the testing equipment.

[0010] It should be noted that the process of determining sensitivity indicators includes, Abnormal data is introduced into the test equipment to conduct abnormal testing, and the corresponding behavioral components are collected synchronously. Determine the timing of the offset of the behavioral component, determine the offset lag time based on the offset timing relative to the timing of the introduction of abnormal data, and determine the corresponding offset amount; Sensitivity indicators are determined based on the offset and offset lag time.

[0011] It should be noted that the process of analyzing potential anomalies in the test data based on the aforementioned component data chain includes, Match the component data chain of sensitive behavior components with the prior rules of the time domain dimension; If a component data chain does not match the prior rules in the time domain dimension, then a potential anomaly is identified. Among them, the prior rules of the time domain dimension include several regular restrictions on sensitive behavioral components. The prior rules of the time domain dimension are determined based on the data performance behavior feature set within the historical period, and each sensitive behavioral component corresponds one-to-one with the prior rules of the time domain dimension.

[0012] It should be noted that the process of determining the prior laws in the time domain includes, Determine the set of data performance characteristics under normal operating conditions within the historical period, and extract several candidate data chains for sensitive behavioral components based on the data chain attributes and the corresponding extraction length. Based on the candidate data chain, the regularity of restrictions on each of the aforementioned sensitive behavioral components is summarized, including the range of amplitude restrictions and the range of change rate restrictions.

[0013] It should be noted that the process of temporarily storing test data that does not have potential anomalies, determining the temporary read object, and performing correlation verification by temporarily reading the corresponding local test data includes: Determine the time domain corresponding to the component data link and decompose it to obtain several time domain segments; Determine the percentage difference between the boundaries of the regularity indicators corresponding to the regularity constraints of the component data chains within each time domain segment; The time-domain segments are arranged in ascending order according to the proportion of differences, and a time-domain segment is selected at the beginning of the ascending sequence according to a predetermined proportion. Temporarily read local test data within each of the aforementioned time domain segments; Determine the semantic similarity between the local test data; If the semantic similarity is greater than or equal to the predetermined similarity threshold, then the association verification is determined to be without anomalies. If the semantic similarity is less than the predetermined similarity threshold, then an anomaly is determined in the association verification.

[0014] It should be noted that when correcting potential anomaly analysis results based on correlation verification results or downloading the test data into the target area, If the association verification is normal, the test data will be unloaded and written to the target area. If an anomaly is found in the association verification, correct the potential anomaly analysis results to change the potential anomaly result to indicate the presence of a potential anomaly.

[0015] On the other hand, a system for dynamically processing test data files under multi-threading is also provided, including: The behavior acquisition module is used to obtain the data performance behavior feature set of the test data collected by each test device in the historical period, which is a time-domain mapping of the data performance behavior feature set, and the data performance behavior feature set is composed of behavior components. The data chain analysis module is used to analyze the data chain attributes corresponding to each test device based on the data performance behavior feature set. This includes extracting the time-domain data stream of the time-domain behavior feature set with an incrementally increasing extraction length to form several candidate data chains, analyzing the stability of the behavior components corresponding to each candidate data chain, verifying the effective length of the data chain, and determining the sensitive behavior components. The potential anomaly identification module responds to the processing of test data collected by the test equipment by calling the data chain attribute corresponding to the test equipment, periodically extracting the collected test data according to the corresponding effective length, extracting only the component data chain corresponding to each of the sensitive behavior components, and performing a preliminary analysis of the potential anomalies of the test data based on the component data chain. The backend processing module processes the test data based on the results of potential anomaly analysis, including: Write all test data with potential anomalies to the target area and mark it; In addition, a temporary buffer is constructed to temporarily store the test data that does not have potential anomalies, and a temporary read object is determined to temporarily read the corresponding local test data for correlation verification. Based on the correlation verification results, the potential anomaly analysis results are corrected or the test data is downloaded and written to the target area.

[0016] Compared to existing technologies, this invention acquires data performance behavior feature sets from various test devices, integrates different behavioral components, and then uses these feature sets to analyze the data chain attributes corresponding to the test devices. This constructs data chain attributes specific to different test devices. When processing the data collected by the test devices, these data chain attributes are invoked to extract the collected test data to the appropriate effective length, extracting only the component data chains corresponding to sensitive behavioral components. This allows for pre-analysis of potential anomalies in the test data, and the anomaly analysis results are used to construct differentiated test data processing logic. This invention constructs dedicated data chain attributes for different test devices, enabling behavioral feature analysis to adaptively match the transmission patterns of each device. It eliminates the need for pre-analysis of potential anomalies, reducing resource waste. Furthermore, the differentiated processing of normal and abnormal data reduces write load.

[0017] The advantage lies in the fact that this invention constructs a data performance behavior feature set and analyzes data link attributes. The data performance behavior feature set consists of multiple behavior components, including transmission rhythm behavior components, data distribution behavior components, and transmission link behavior components. It fully considers the impact of the differences in test equipment on streaming data transmission. In industrial test scenarios, the data collected by the test equipment is not randomly generated, but is continuously output by the equipment according to a fixed sampling period, fixed communication protocol, and fixed channel polling mechanism. Therefore, under normal operating conditions, the transmission behavior of the data stream naturally has repeatability, regularity, and periodicity. For example, when a sensor samples and uploads data at a constant frequency, the mean and variance of its transmission interval tend to stabilize, reflecting the regularity of the transmission rhythm behavior component. When the test equipment continuously outputs records under steady-state conditions, the structure of the records is fixed and the numerical fluctuations are minimal. The number of bytes per record is concentrated, reflecting the similarity of the data distribution behavior component. Therefore, the data performance behavior feature set can observe anomalies when the equipment malfunctions. For example, when the equipment freezes, the variance of the transmission interval increases sharply; when the data format is disordered, the dispersion of the number of bytes increases; and when a channel fails, the number of active channels decreases. Therefore, by constructing a data performance behavior feature set composed of multiple behavior components, the data transmission behavior patterns of each test equipment can be comprehensively characterized from multiple dimensions, providing support for subsequent data chain attribute analysis.

[0018] The advantage of this invention lies in the fact that the data chain attributes of the test data include sensitive behavioral components and an effective length. The effective length is determined by extracting data from the time-domain data stream with progressively increasing extraction lengths and analyzing the stability of the behavioral components at each extraction length. In practice, when the extraction length is too short, the resulting data chain is insufficient to cover a complete behavioral cycle of the test device, resulting in significant differences in the values ​​of each behavioral component across the data chain and a lack of stability convergence. When the extraction length is too long, the data chain spans multiple behavioral cycles, introducing gradual drift between different cycles, which dilutes the regularity within the cycle and leads to decreased stability. Therefore, there exists an extraction length that covers a complete behavioral cycle of the test device, and at the corresponding extraction length... Each behavioral component exhibits the most significant periodicity and observational value, allowing for the determination of the regularity of the test equipment's behavior within a short time window, eliminating the need for long-term data accumulation and ensuring analytical accuracy. Furthermore, considering the differences in test equipment and the variations in the logic of test data generation, not all stable behavioral components possess equal characterization capabilities for anomalies. While some behavioral components exhibit small fluctuations and strong regularity, their changes are limited or their response is delayed when the test equipment malfunctions, making them unsuitable as effective evidence for early anomaly identification. Therefore, further screening can identify sensitive behavioral components that deviate most significantly from their prior temporal patterns, improving the accuracy and reliability of subsequent early analysis of potential anomalies.

[0019] The advantage lies in the fact that this invention performs differentiated processing on test data based on the results of potential anomaly analysis. Specifically, for test data where the preliminary analysis determines potential anomalies, it is directly written in full to the target area, ensuring the original integrity and priority visibility of the anomaly data, and avoiding the loss of anomaly details due to load reduction or compression processing, which could affect subsequent fault diagnosis and tracing. For test data where the preliminary analysis determines no potential anomalies, load reduction is not directly performed; instead, a temporary buffer is first constructed for temporary storage, and a temporary read object is determined to read the corresponding local test data for correlation verification. The significance lies in the fact that the preliminary anomaly analysis is a preliminary assessment based on the temporal behavioral characteristics of the data stream. While the advantages of this method lie in its low overhead and high efficiency, it carries a certain risk of false alarms due to the lack of parsed data content. Therefore, this invention uses a temporary buffer to reserve a traceable buffer phase for the anomaly detection. During this phase, local test data is selected for content-level correlation verification, with semantic similarity serving as a secondary confirmation criterion. Load reduction writing is only performed when the correlation verification confirms no anomalies. If the correlation verification detects anomalies, the pre-detection result is corrected and the entire data is written to the target area. This ensures the low overhead advantage of the pre-analysis while maintaining the integrity of the abnormal data, avoiding the high I / O overhead of full parsing, reducing the risk of false alarms and data loss, and lowering the write load. Attached Figure Description

[0020] Figure 1 This is a schematic diagram illustrating the steps of a multi-threaded dynamic processing method for test data files according to an embodiment of the invention. Figure 2 A schematic diagram of the time-domain data flow of the data performance behavior feature set in an embodiment of the invention; Figure 3 A logic diagram for determining sensitive behavior components in an embodiment of the invention; Figure 4 This is a logic diagram for the preliminary analysis of potential anomalies in the test data in an embodiment of the invention. Detailed Implementation

[0021] To make the objectives and advantages of the present invention clearer, the present invention will be further described below with reference to embodiments; it should be understood that the specific embodiments described herein are merely for explaining the present invention and are not intended to limit the present invention.

[0022] Preferred embodiments of the present invention will now be described with reference to the accompanying drawings. Those skilled in the art should understand that these embodiments are merely illustrative of the technical principles of the present invention and are not intended to limit the scope of protection of the present invention.

[0023] Please see Figure 1 As shown, this is a schematic diagram of the steps of a multi-threaded dynamic processing method for test data files according to an embodiment of the invention. The multi-threaded dynamic processing method for test data files according to an embodiment of the invention includes: Step S1: Obtain the data performance behavior feature set of the test data collected by each test device in the historical period in the time domain mapping, wherein the data performance behavior feature set is composed of behavior components; Step S2: Analyze the data chain attributes corresponding to each test device based on the data performance behavior feature set, including extracting the time domain data stream of the time domain behavior feature set with an incrementally increasing extraction length to form several candidate data chains, analyzing the stability of the behavior components corresponding to each candidate data chain, verifying the effective length of the data chain, and determining the sensitive behavior components. Step S3: In response to processing the test data collected by the test equipment, the data chain attribute corresponding to the test equipment is called to periodically extract the collected test data with a corresponding effective length, and only the component data chain corresponding to each of the sensitive behavior components is extracted. Based on the component data chain, the potential anomalies of the test data are pre-analyzed. Step S4: Process the test data based on the potential anomaly analysis results, including... Write all test data with potential anomalies to the target area and mark it; In addition, a temporary buffer is constructed to temporarily store the test data that does not have potential anomalies, and a temporary read object is determined to temporarily read the corresponding local test data for correlation verification. Based on the correlation verification results, the potential anomaly analysis results are corrected or the test data is downloaded and written to the target area.

[0024] In practice, there are no restrictions on the type of testing equipment; it can be any one or more combinations of sensors, data acquisition cards, simulation computing devices, automated test benches, industrial controllers, and communication bus monitoring devices. Different types of testing equipment produce data that differs in format, frequency, and number of channels. However, the data streams output under normal operating conditions all possess repeatability, regularity, and periodicity determined by the equipment's own working mechanism. For example, sensors output at a fixed sampling period, data acquisition cards upload data using a channel polling mechanism, simulation computing devices iterate at a fixed step size, and automated test benches generate results sequentially according to the test cases.

[0025] In practice, the form of test data depends on the test equipment, which continuously outputs the data according to the established working mechanism. Examples include test logs and time-series sampling data, which will not be elaborated further.

[0026] In practice, test data from multi-threaded test devices can be processed simultaneously, and the data collected by each test device can be transmitted and written to independent threads.

[0027] To elaborate, the process of analyzing the stability of the behavioral components corresponding to each candidate data chain includes, Several candidate data chains corresponding to the same extraction length in clustering; Extract the behavioral components corresponding to each of the candidate data chains; By comparing the same behavioral components among the candidate data chains, the stability indices of the behavioral components are determined, including the similarity between components and the dispersion within components. The stability of the corresponding behavioral component at the extraction length is determined based on the stability index; The behavioral components include transmission rhythm behavioral components, data distribution behavioral components, and transmission link behavioral components. If the similarity between components is greater than a predetermined similarity threshold and the dispersion within a component is less than a predetermined dispersion threshold, then the behavioral components are determined to have stability.

[0028] Please see Figure 2 The diagram shown is a time-domain data stream of a data performance behavior feature set according to an embodiment of the invention. The time-domain data stream consists of several data performance behavior feature sets arranged in chronological order. Figure 2In the time axis T, different acquisition times t1, t2...tn all have data performance behavior feature sets, and each time has multiple behavioral components with corresponding values. Therefore, the candidate data chain obtained by extracting the time domain data stream with a certain extraction length is actually a number of data performance behavior feature sets arranged in time order. Furthermore, corresponding time domain curves can be constructed for the behavioral components.

[0029] In practice, the extraction length is increased incrementally. For each extraction length, the time-domain data stream needs to be extracted. For the same extraction length, data of the corresponding extraction length is repeatedly extracted starting from the beginning of the time domain data stream, thereby forming several candidate data chains; To simplify the calculation, the number of extractions does not need to traverse the entire time-domain data stream. Instead, only a certain number of candidate data chains can be extracted as samples. For example, only 1,000 candidate data chains can be extracted as samples with the same extraction length.

[0030] To simplify the calculation, the initial extraction length must cover at least 5 time-domain behavioral feature sets to ensure that the similarity between components and the dispersion within components can be calculated. The increment must cover at least 1 time-domain behavioral feature set to ensure that the extraction length can traverse different length values.

[0031] The process of determining stability indices includes, When calculating the similarity between components, first determine the time-domain curves of the behavioral components corresponding to each candidate data chain, calculate the similarity between the time-domain curves, and solve for the mean similarity as the similarity between components. When calculating the similarity, the cosine similarity calculation method can be used to calculate the cosine similarity between the time-domain curves and use the cosine similarity as the similarity. Of course, other curve similarity determination methods can also be used, which will not be elaborated here.

[0032] When calculating intra-component similarity, first determine the time-domain curve of the behavioral component corresponding to each candidate data chain, determine the amplitude variance of each time-domain curve, and solve for the mean of the amplitude variance as the component class dispersion.

[0033] The similarity between components considers the degree of consistency of the same behavioral component across different candidate data chains, that is, whether the same behavioral component exhibits the same temporal change pattern in different behavioral cycles of the test device.

[0034] Intra-component dispersion measures the amplitude fluctuation of the same behavioral component within a single candidate data chain. In other words, it measures whether the value of the behavioral component is stable within a behavioral cycle. If the intra-component dispersion is high, it indicates that the behavioral component fluctuates violently within a single data chain, resulting in data interference that masks the true pattern and makes it difficult to extract stable regularity constraints, which can easily lead to false alarms in subsequent anomaly judgments.

[0035] The transmission rhythm behavior component, data distribution behavior component, and transmission link behavior component are predefined, among which, The transmission rhythm behavior component reflects the regularity of data at the transmission level. It is one of the transmission frequency or transmission interval of the test data, and can be determined based on the timestamp when the test data is collected.

[0036] The data distribution behavior component reflects the characteristics of the test data in terms of its arrangement. It is one of the following: the number of bytes in a single record or the variance of the number of bytes in a single record within the observation time. It can be determined by determining the number of bytes in each serialized record of the test data. The observation time is determined based on the sampling frequency, and in practice, it is set to the time required for 5 samplings. When there are no abnormalities in the operating conditions, the test data of the test equipment exhibits regularity in its form. For example, for test equipment using a fixed protocol format, each record is serialized according to the same field structure, and the number of bytes remains consistent. For test equipment using variable-length encoding, the number of bytes in the record fluctuates regularly within a narrow range as the payload changes. For test equipment that outputs multiple records in combination, the number of bytes in several records shows a periodic increase, decrease, or alternation. The combination of multiple records as a whole exhibits regularity. When the equipment malfunctions, such as missing fields, encoding errors, data truncation, or format disorder, the number of bytes in a single record will deviate from the normal range, and the variance of the number of bytes will increase accordingly, which will be reflected in the form and can be captured by the data distribution behavior component.

[0037] The transmission link behavior component reflects the characteristics exhibited on the data transmission link. It is one of the data throughput and the rate of change of data throughput. When the operating conditions are abnormal, the data throughput and the rate of change of data throughput will deviate significantly. For example, when the equipment lags, the number of records transmitted per unit time drops sharply, and the data throughput decreases accordingly; when the equipment gets stuck in an abnormal loop or retries an error, the number of records transmitted per unit time increases sharply, and the data throughput increases accordingly. Therefore, without parsing the test data itself, the transmission link behavior component can reflect anomalies to a certain extent.

[0038] In implementation, the similarity threshold and dispersion threshold can be determined through verification and optimization. Specifically, different test values ​​are set for the similarity threshold and dispersion threshold. The stability of the behavioral components is judged based on the corresponding test values, and subsequent steps are performed to determine the identification results of several potential anomalies. The prediction accuracy is statistically analyzed, and the test value with the highest accuracy is determined as the final similarity threshold and dispersion threshold. After the preliminary analysis determines the potential anomaly results, the test data is read and judged by those skilled in the art. If the judgment result is the same as the result of the preliminary analysis determining the potential anomalies, it is considered a correct prediction; this will not be elaborated further.

[0039] In practice, since the similarity and dispersion thresholds each have a large range of values, setting test values ​​one by one across the entire range for verification and optimization would result in too many verification and optimization attempts and excessive computational overhead. Therefore, the inter-component similarity and intra-component dispersion of each candidate data chain at each extraction length within a historical period can be pre-obtained and sorted. The selection range of test values ​​is then narrowed based on the sorting results. Specifically, the 70th and 90th quantiles of inter-component similarity and the 10th and 30th quantiles of intra-component dispersion are extracted. Test values ​​for inter-component similarity are selected from the 70th to 90th quantiles, and test values ​​for intra-component dispersion are selected from the 10th to 30th quantiles.

[0040] This invention constructs a data performance behavior feature set and analyzes data link attributes. The data performance behavior feature set consists of multiple behavior components, including transmission rhythm behavior components, data distribution behavior components, and transmission link behavior components. It fully considers the impact of the differences in test equipment on streaming data transmission. In industrial test scenarios, the data collected by the test equipment is not randomly generated, but is continuously output by the equipment according to a fixed sampling period, fixed communication protocol, and fixed channel polling mechanism. Therefore, under normal equipment operation, the transmission behavior of the data stream naturally has repeatability, regularity, and periodicity. For example, when a sensor samples and uploads data at a constant frequency, the mean and variance of its transmission interval tend to stabilize, reflecting the regularity of the transmission rhythm behavior component. When the test equipment continuously outputs records under steady-state conditions, the structure of the records is fixed and the numerical fluctuations are minimal. The number of bytes per record is concentrated, reflecting the similarity of the data distribution behavior component. Therefore, the data performance behavior feature set can observe anomalies when the equipment malfunctions. For example, when the equipment freezes, the variance of the transmission interval increases sharply; when the data format is disordered, the dispersion of the number of bytes increases; and when a channel fails, the number of active channels decreases. Therefore, by constructing a data performance behavior feature set composed of multiple behavior components, the data transmission behavior patterns of each test equipment can be comprehensively characterized from multiple dimensions, providing support for subsequent data chain attribute analysis.

[0041] To elaborate, the process of verifying the effective length of a data link includes: If a behavioral component exhibits stability at the specified extraction length, then the extraction length is determined as a candidate extraction length. Determine the number of stable behavioral components for each candidate extraction length; The candidate extraction length with the largest number of behavioral components is determined as the effective length.

[0042] The candidate length with the largest number of behavioral components is used as the criterion for determining the effective length. The effective length has the largest number of stable behavioral components, which indicates that the candidate pool that can be used to screen sensitive behavioral components is the largest. This allows for the selection of the most sensitive behavioral components to anomalies based on richer features, thus ensuring the sensitivity and accuracy of subsequent anomaly identification.

[0043] To elaborate, please refer to Figure 3 As shown, it is a logic diagram for determining sensitive behavior components according to an embodiment of the invention. The process of determining sensitive behavior components includes, Determine the behavioral components that possess stability within the effective length, and analyze the sensitivity index based on the time-domain data stream corresponding to the behavioral components; The behavioral components are sorted in descending order based on sensitivity indicators; Based on a predetermined ratio, select behavioral components at the beginning of the descending sequence as sensitive behavioral components. The sensitivity index is determined by introducing abnormal data into the testing equipment.

[0044] In practice, the predetermined proportion was set at 25%, with the aim of selecting behavioral categories with higher sensitivity indicators as sensitive behavioral components.

[0045] To elaborate, the process of determining sensitivity indicators includes, Abnormal data is introduced into the test equipment to conduct abnormal testing, and the corresponding behavioral components are collected synchronously. Determine the timing of the offset of the behavioral component, determine the offset lag time based on the offset timing relative to the timing of the introduction of abnormal data, and determine the corresponding offset amount; Sensitivity indicators are determined based on the offset and offset lag time.

[0046] In practice, there are no restrictions on the methods for introducing abnormal data. For example, it is possible to inject simulated abnormal data into the data output terminal of the test equipment, modify the configuration parameters of the test equipment to trigger abnormal output, or perform security interference on the test equipment. These will not be elaborated further.

[0047] In practice, the timing of the offset is determined based on prior rules in the time domain. If the behavioral component at the corresponding moment is not subject to regular constraints, then that moment is determined as the offset timing. The time difference between the offset timing and the timing of the introduction of abnormal data is the offset lag time.

[0048] The offset is the ratio of the absolute value of the deviation of the behavioral component corresponding to the offset timing from the regularity limit to the length of the range corresponding to the regularity limit.

[0049] It is understandable that the regularity restriction is essentially a range. Therefore, the range length is the difference between the two boundaries corresponding to the range, and the excess is the difference between the value and the boundary corresponding to the range.

[0050] The specific calculation methods for sensitivity indicators include, The ratio of the offset to the standard offset is calculated to obtain the offset sensitivity index. The purpose of this is to eliminate the dimension and take into account the level of the offset relative to the standard offset. The ratio of standard lag time to offset lag time is calculated to obtain a time-sensitive index. The purpose of this is to eliminate dimensions and to take into account the level of offset lag time relative to standard lag time. The sensitivity index is obtained by summing the offset sensitivity index and the time sensitivity index.

[0051] The standard offset can be set to the average offset of each behavioral component within the historical period, and the standard lag time can be set to the average lag time of each behavioral component within the historical period.

[0052] This invention addresses the data chain attributes of test data, which include sensitive behavioral components and an effective length. The effective length is determined by extracting data from the time-domain data stream with progressively increasing extraction lengths and analyzing the stability of the behavioral components at each extraction length. In practice, when the extraction length is too short, the resulting data chain is insufficient to cover a complete behavioral cycle of the test device, leading to significant differences in the values ​​of each behavioral component across the data chain and preventing stability convergence. When the extraction length is too long, the data chain spans multiple behavioral cycles, introducing gradual drift between different cycles, which dilutes the regularity within the cycle and reduces stability. Therefore, there exists an extraction length that covers a complete behavioral cycle of the test device, and at the corresponding extraction length, the values ​​of each behavioral component... The components exhibit the most significant periodicity and observational value, allowing subsequent judgments on the behavior of the test equipment to be completed within this short window without relying on long-term data accumulation, thus ensuring analytical accuracy. Furthermore, considering the differences in test equipment and the variations in the generation logic of test data, not all stable behavioral components have the same ability to represent anomalies. Some behavioral components, although exhibiting small fluctuations and strong regularity, show limited changes or delayed responses when test equipment malfunctions, making them unsuitable as effective evidence for early anomaly identification. Therefore, further screening can identify sensitive behavioral components that deviate most significantly from their prior temporal patterns, improving the accuracy and reliability of subsequent early analysis of potential anomalies.

[0053] Please participate Figure 4 As shown, it is a logic diagram of the pre-analysis of potential anomalies in the test data according to an embodiment of the invention. The process of pre-analyzing potential anomalies in the test data based on the component data chain includes, Match the component data chain of sensitive behavior components with the prior rules of the time domain dimension; If a component data chain does not match the prior rules in the time domain dimension, then a potential anomaly is identified. Among them, the prior rules of the time domain dimension include several regular restrictions on sensitive behavioral components. The prior rules of the time domain dimension are determined based on the data performance behavior feature set within the historical period, and each sensitive behavioral component corresponds one-to-one with the prior rules of the time domain dimension.

[0054] It is understandable that the component data chain is the arrangement of the values ​​of the sensitive behavior components at each moment within the time domain segment. The component data chain has corresponding regularity constraints, and the regularity indicators of each moment of the component data chain can be determined. The regularity indicators include amplitude and rate of change. When determining whether the component data chain matches the prior patterns in the time domain, If the amplitude at any given time does not fall within the amplitude limit or the rate of change does not fall within the rate of change limit, then it is determined that the component data chain does not match the prior rules of the time domain dimension.

[0055] To elaborate, the process of determining the a priori laws in the time domain includes, Determine the set of data performance characteristics under normal operating conditions within the historical period, and extract several candidate data chains for sensitive behavioral components based on the data chain attributes and the corresponding extraction length. Based on the candidate data chain, the regularity of restrictions on each of the aforementioned sensitive behavioral components is summarized, including the range of amplitude restrictions and the range of change rate restrictions.

[0056] It is understandable that the candidate data chain is the numerical arrangement of the sensitive behavior components corresponding to each moment within a time period. Therefore, the amplitude and rate of change of the sensitive behavior category at each moment can be determined. The amplitude is statistically distributed normally, and the 95% confidence interval of the amplitude normal distribution is used as the amplitude limit range. The rate of change is statistically distributed normally, and the 95% confidence interval of the rate of change normal distribution is used as the rate of change limit range. Furthermore, for each sensitive behavioral component, a corresponding change rate limit range and amplitude limit range can be set, so that the sensitive behavioral components have a one-to-one corresponding regularity limit.

[0057] To elaborate, the process of temporarily storing test data that does not have potential anomalies, determining temporary read objects, and temporarily reading corresponding local test data for correlation verification includes: Determine the time domain corresponding to the component data link and decompose it to obtain several time domain segments; Determine the percentage difference between the boundaries of the regularity indicators corresponding to the regularity constraints of the component data chains within each time domain segment; The time-domain segments are arranged in ascending order according to the proportion of differences, and a time-domain segment is selected at the beginning of the ascending sequence according to a predetermined proportion. Temporarily read local test data within each of the aforementioned time domain segments; Determine the semantic similarity between the local test data; If the semantic similarity is greater than or equal to the predetermined similarity threshold, then the association verification is determined to be without anomalies. If the semantic similarity is less than the predetermined similarity threshold, then an anomaly is determined in the association verification.

[0058] In practice, the predetermined proportion is set at 25%, which aims to select time-domain segments where the corresponding regularity indicators are close to the regularity limit boundary.

[0059] In practice, when calculating the percentage of difference, it is necessary to calculate the percentage of difference in amplitude and the percentage of difference in rate of change separately, and set the average of the percentage of difference in amplitude and the percentage of difference in rate of change as the percentage of difference. Among them, the amplitude difference ratio is the absolute value of the difference between the mean amplitude value and the boundary corresponding to the regularity constraint within the time domain segment, and the rate of change difference ratio is the absolute value of the difference between the mean rate of change and the boundary corresponding to the regularity constraint within the time domain segment. It is understandable that, since the component data chains of the sensitive behavioral components corresponding to the test data that do not have potential anomalies are all within the regularity constraints, the difference between the mean amplitude and the two boundaries of the regularity constraints can be calculated. In practice, the boundary closest to the mean amplitude needs to be selected to participate in the calculation to determine the percentage of amplitude difference. Correspondingly, the difference between the mean rate of change and the two boundaries of the regularity constraints can be calculated, and the boundary closest to the mean rate of change needs to be selected to participate in the calculation to determine the percentage of rate of change difference.

[0060] In practice, the purpose of calculating semantic similarity is to consider the inherent consistency of test data at the semantic level. Specifically, when the test equipment is operating without abnormalities, the test data it collects is continuously output by the equipment according to its established working mechanism. The local test data within each time domain segment should be semantically similar. For example, multiple records continuously output by the same sensor under steady-state conditions tend to have consistent semantic information such as measurement values, status codes, and field structures. The result data generated by the same test case at different times should also have the same or similar semantic content. This semantic similarity is rooted in the stability of the test equipment's working mechanism and is an inherent manifestation of the equipment's normal operation.

[0061] When abnormal records are introduced into the test data, the local test data of the time domain segment containing the abnormal record will semantically deviate from other normal time domain segments. For example, a sensor malfunction causing a sudden change in output value or exceeding the measurement range will cause the measurement semantics of that time domain segment to deviate from the normal range; data encoding errors causing field content to be disordered will cause the structural semantics of that time domain segment to be inconsistent with normal records; and abnormal test case execution resulting in unexpected values ​​in the result field will cause the business semantics of that time domain segment to deviate from expectations. These semantic deviations reduce the semantic similarity between the local test data of the abnormal time domain segment and the local test data of other time domain segments.

[0062] Therefore, by determining the semantic similarity between each local test data and comparing it with a predetermined similarity threshold, it is possible to determine whether the potential anomalies identified by the pre-analysis are indeed valid. The results of the pre-analysis can be effectively verified by comparing the semantic similarity of a small number of local test data, thus balancing low overhead and high reliability.

[0063] In practice, the semantic similarity threshold is preset, whereby, Test data of the corresponding test equipment is pre-collected and decomposed into several local test data by corresponding time domain segments. The semantic similarity of each local test data is compared and the semantic similarity ranking is calculated. The 5th percentile is used as the semantic similarity threshold to quantify the low-order value of the semantic similarity level between the corresponding local test data of the corresponding test equipment under normal working conditions.

[0064] There are no restrictions on the method for calculating semantic similarity. You can vectorize the local test data and then calculate the cosine similarity, and use the cosine similarity as the corresponding semantic similarity. Of course, other semantic similarity calculation methods can also be used, which will not be elaborated here.

[0065] To elaborate, when correcting potential anomaly analysis results based on correlation verification results or downloading the test data into the target region, If the association verification is normal, the test data will be unloaded and written to the target area. If an anomaly is found in the association verification, correct the potential anomaly analysis results to change the potential anomaly result to indicate the presence of a potential anomaly.

[0066] The significance of performing load shedding writes lies in considering that in industrial testing scenarios, the data output by test equipment during normal operation is highly repetitive and has a low subsequent call rate. Specifically, industrial test equipment continuously outputs data under steady-state conditions, and its records exhibit high consistency in field structure, numerical range, and trend. Adjacent records often differ only in non-critical fields such as timestamps, resulting in extremely high repetition of core data content. At the same time, abnormal data is typically only used for statistical summarization or trend viewing in subsequent analysis, and the probability of its original byte stream being called back line by line is low. In most cases, statistical summaries or index information are sufficient to meet the analysis needs.

[0067] Therefore, for data without anomalies, load shedding can be performed, and the following options are available: Test data with potential anomalies can be written directly in full to the target area to ensure the original integrity and real-time readability of the abnormal data. For test data without potential anomalies and with no anomalies in the associated verification, a compression method is used to write the original test data to the target area, achieving load reduction writing. Since the subsequent call rate of this part of the data is low, even if compressed storage is used, the trigger frequency of subsequent decompression operations is also low. The CPU resource usage required for decompression is greatly diluted in the overall running cycle and will not have a continuous impact on real-time analysis. At the same time, the amount of compressed data is significantly reduced, which can effectively alleviate the write pressure in multi-threaded concurrent write scenarios and reduce I / O bandwidth usage and storage space consumption.

[0068] This invention performs differentiated processing on test data based on the results of potential anomaly analysis. For test data identified as having potential anomalies in the preliminary analysis, it is directly written in its entirety to the target area, ensuring the original integrity and priority visibility of the anomaly data. This avoids the loss of anomaly details due to load reduction or compression, which could affect subsequent fault diagnosis and tracing. For test data identified as not having potential anomalies in the preliminary analysis, load reduction is not directly performed. Instead, a temporary buffer is first constructed for temporary storage, and a temporary read object is determined to read the corresponding local test data for correlation verification. The significance lies in the fact that the preliminary anomaly analysis is a preliminary judgment based on the temporal behavior characteristics of the data stream. The advantages are low overhead and high efficiency, but due to the lack of parsed data content, there is a certain possibility of false alarms. Therefore, this invention uses a temporary buffer to reserve a traceable buffer stage for the no-anomaly determination. In this stage, local test data is selected for content-level correlation verification, and semantic similarity is used as the basis for secondary confirmation. Only when the correlation verification confirms that there are no anomalies is the load reduction write performed. If the correlation verification finds an anomaly, the pre-judgment result is corrected and the data is written to the target area in full, thereby ensuring the low overhead advantage of the pre-analysis, while ensuring the integrity of the abnormal data, avoiding the high I / O overhead of full parsing, reducing the risk of false alarms and data loss, and reducing the write load.

[0069] On the other hand, a system for dynamically processing test data files under multi-threading is also provided, including: The behavior acquisition module is used to obtain the data performance behavior feature set of the test data collected by each test device in the historical period, which is a time-domain mapping of the data performance behavior feature set, and the data performance behavior feature set is composed of behavior components. The data chain analysis module is used to analyze the data chain attributes corresponding to each test device based on the data performance behavior feature set. This includes extracting the time-domain data stream of the time-domain behavior feature set with an incrementally increasing extraction length to form several candidate data chains, analyzing the stability of the behavior components corresponding to each candidate data chain, verifying the effective length of the data chain, and determining the sensitive behavior components. The potential anomaly identification module responds to the processing of test data collected by the test equipment by calling the data chain attribute corresponding to the test equipment, periodically extracting the collected test data according to the corresponding effective length, extracting only the component data chain corresponding to each of the sensitive behavior components, and performing a preliminary analysis of the potential anomalies of the test data based on the component data chain. The backend processing module processes the test data based on the results of potential anomaly analysis, including: Write all test data with potential anomalies to the target area and mark it; In addition, a temporary buffer is constructed to temporarily store the test data that does not have potential anomalies, and a temporary read object is determined to temporarily read the corresponding local test data for correlation verification. Based on the correlation verification results, the potential anomaly analysis results are corrected or the test data is downloaded and written to the target area.

[0070] It should be noted that the multiple functional modules involved in this application are only a logical division based on the functions implemented according to the present invention, and are not a strict limitation on the physical structure; in practical applications, the above functional modules can be implemented by one or more integrated circuits, a processor executing program code in memory, or a combination of the above devices.

[0071] The technical solution of the present invention has been described above with reference to the preferred embodiments shown in the accompanying drawings. However, it will be readily understood by those skilled in the art that the scope of protection of the present invention is obviously not limited to these specific embodiments. Without departing from the principles of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will all fall within the scope of protection of the present invention.

Claims

1. A method for dynamically processing test data files under multi-threading, characterized in that, include: Obtain the data performance behavior feature set of the time-domain mapping of the test data collected by each test device within the historical period, wherein the data performance behavior feature set is composed of behavior components; The data chain attributes corresponding to each test device are analyzed based on the data performance behavior feature set. This includes extracting the time-domain data stream of the time-domain behavior feature set with an incrementally increasing extraction length to form several candidate data chains, analyzing the stability of the behavior components corresponding to each candidate data chain, verifying the effective length of the data chain, and determining the sensitive behavior components. In response to processing the test data collected by the test equipment, the data chain attribute corresponding to the test equipment is invoked, and the collected test data is periodically extracted according to the corresponding effective length. Only the component data chain corresponding to each of the sensitive behavior components is extracted, and the potential anomalies of the test data are pre-analyzed based on the component data chain. The test data is processed based on the results of the potential anomaly analysis, including: Write all test data with potential anomalies to the target area and mark it; In addition, a temporary buffer is constructed to temporarily store the test data that does not have potential anomalies, and a temporary read object is determined to temporarily read the corresponding local test data for correlation verification. Based on the correlation verification results, the potential anomaly analysis results are corrected or the test data is downloaded and written to the target area.

2. The method for dynamically processing test data files under multi-threading according to claim 1, characterized in that, The process of analyzing the stability of the behavioral components corresponding to each candidate data chain includes, Several candidate data chains corresponding to the same extraction length in clustering; Extract the behavioral components corresponding to each of the candidate data chains; By comparing the identical behavioral components among the candidate data chains, the stability index of the behavioral components is determined. This includes inter-component similarity and intra-component dispersion; The stability of the corresponding behavioral component at the extraction length is determined based on the stability index; The behavioral components include transmission rhythm behavioral components, data distribution behavioral components, and transmission link behavioral components. If the similarity between components is greater than a predetermined similarity threshold and the dispersion within a component is less than a predetermined dispersion threshold, then the behavioral components are determined to have stability.

3. The method for dynamically processing test data files under multi-threading according to claim 2, characterized in that, The process of verifying the valid length of a data link includes, If a behavioral component exhibits stability at the specified extraction length, then the extraction length is determined as a candidate extraction length. Determine the number of stable behavioral components for each candidate extraction length; The candidate extraction length with the largest number of behavioral components is determined as the effective length.

4. The method for dynamically processing test data files under multi-threading according to claim 3, characterized in that, The process of determining the sensitive behavior component includes, Determine the behavioral components that possess stability within the effective length, and analyze the sensitivity index based on the time-domain data stream corresponding to the behavioral components; The behavioral components are sorted in descending order based on sensitivity indicators; Based on a predetermined ratio, select behavioral components at the beginning of the descending sequence as sensitive behavioral components. The sensitivity index is determined by introducing abnormal data into the testing equipment.

5. The method for dynamically processing test data files under multi-threading according to claim 4, characterized in that, The process of determining sensitivity indicators includes, Abnormal data is introduced into the test equipment to conduct abnormal testing, and the corresponding behavioral components are collected synchronously. Determine the timing of the offset of the behavioral component, determine the offset lag time based on the offset timing relative to the timing of the introduction of abnormal data, and determine the corresponding offset amount; Sensitivity indicators are determined based on the offset and offset lag time.

6. The method for dynamically processing test data files under multi-threading according to claim 1, characterized in that, The process of analyzing potential anomalies in the test data based on the component data chain includes, Match the component data chain of sensitive behavior components with the prior rules of the time domain dimension; If a component data chain does not match the prior rules in the time domain dimension, then a potential anomaly is identified. Among them, the prior rules of the time domain dimension include several regular restrictions on sensitive behavioral components. The prior rules of the time domain dimension are determined based on the data performance behavior feature set within the historical period, and each sensitive behavioral component corresponds one-to-one with the prior rules of the time domain dimension.

7. The method for dynamically processing test data files under multi-threading according to claim 6, characterized in that, The process of determining prior laws in the time domain includes, Determine the set of data performance characteristics under normal operating conditions within the historical period, and extract several candidate data chains for sensitive behavioral components based on the data chain attributes and the corresponding extraction length. Based on the candidate data chain, the regularity restrictions for each of the aforementioned sensitive behavioral components are summarized. This includes the amplitude limit range and the rate of change limit range.

8. The method for dynamically processing test data files under multi-threading according to claim 7, characterized in that, The process of temporarily storing the test data that does not have potential anomalies, determining the temporary read object, and temporarily reading the corresponding local test data for correlation verification includes: Determine the time domain corresponding to the component data link and decompose it to obtain several time domain segments; Determine the percentage difference between the boundaries of the regularity indicators corresponding to the regularity constraints of the component data chains within each time domain segment; The time-domain segments are arranged in ascending order according to the proportion of differences, and a time-domain segment is selected at the beginning of the ascending sequence according to a predetermined proportion. Temporarily read local test data within each of the aforementioned time domain segments; Determine the semantic similarity between the local test data; If the semantic similarity is greater than or equal to the predetermined similarity threshold, then the association verification is determined to be without anomalies. If the semantic similarity is less than the predetermined similarity threshold, then an anomaly is determined in the association verification.

9. The method for dynamically processing test data files under multi-threading according to claim 1, characterized in that, When correcting potential anomaly analysis results based on correlation verification results or when downloading the test data to the target region. If the association verification is normal, the test data will be unloaded and written to the target area. If an anomaly is found in the association verification, correct the potential anomaly analysis results to change the potential anomaly result to indicate the presence of a potential anomaly.

10. A system for dynamically processing test data files under multi-threading as described in any one of claims 1-9, characterized in that, include: The behavior acquisition module is used to obtain the data performance behavior feature set of the test data collected by each test device in the historical period, which is a time-domain mapping of the data performance behavior feature set, and the data performance behavior feature set is composed of behavior components. The data chain analysis module is used to analyze the data chain attributes corresponding to each test device based on the data performance behavior feature set. This includes extracting the time-domain data stream of the time-domain behavior feature set with an incrementally increasing extraction length to form several candidate data chains, analyzing the stability of the behavior components corresponding to each candidate data chain, verifying the effective length of the data chain, and determining the sensitive behavior components. The potential anomaly identification module responds to the processing of test data collected by the test equipment by calling the data chain attribute corresponding to the test equipment, periodically extracting the collected test data according to the corresponding effective length, extracting only the component data chain corresponding to each of the sensitive behavior components, and performing a preliminary analysis of the potential anomalies of the test data based on the component data chain. The backend processing module processes the test data based on the results of potential anomaly analysis, including: Write all test data with potential anomalies to the target area and mark it; In addition, a temporary buffer is constructed to temporarily store the test data that does not have potential anomalies, and a temporary read object is determined to temporarily read the corresponding local test data for correlation verification. Based on the correlation verification results, the potential anomaly analysis results are corrected or the test data is downloaded and written to the target area.

Images