TWI738277B - Monitoring alarm method and its server end - Google Patents

Abstract

A server for monitoring alarms, which connects a management terminal and a system through a communication network. The server stores N records corresponding to N consecutive previous time intervals and is related to the system's response to the user's login The historical login data of the response status, each historical login data includes a login response time and a set of key factors related to the login response time. The server establishes a monitoring model based on the historical login data. When the server receives When the historical login data in the first previous time interval earlier than a current time interval is reached, the server uses the monitoring model to calculate a predicted login response time related to the current time interval, and based on the prediction Log in response time to determine whether there is a warning event in the system.

Description

Monitoring alarm method and its server end

The present invention relates to a monitoring method, in particular to a monitoring method that sends a warning message based on the existing login response data.

Information technology is booming nowadays, and the industries that apply information technology are also increasing. For example, the financial industry uses information technology to establish online banking, in which users can connect to online banking through communication networks and use various types of information in online banking. Financial services, such as account inquiries, transfers, loans, and other services, and how to confirm the normal operation of digital systems such as online banking has become an important issue for financial industry players.

The current method of monitoring a digital system is mainly implemented through a server connected to the digital system and a management terminal via a communication network. The server stores a control information related to the digital system, wherein the control information includes information related to the digital system. An abnormal condition of a digital system. The method mainly includes the following steps: the digital system continuously sends an operation data related to the digital system to the server; the server determines whether the digital system is An abnormal condition occurs; and when the server determines that the digital system has an abnormal condition, the server sends a warning message related to the abnormal condition to the management terminal.

Although the above method achieves the purpose of monitoring the digital system, there are still some dilemmas. First, the server sends the warning message related to the abnormal condition to the management terminal according to the abnormal condition, where the abnormal condition is mostly Major problems that make the system inoperable, such as the system does not respond or a certain module in the system is damaged. At this time, sending a warning message to the management terminal can only achieve the effect of remedying the situation, and cannot achieve the effect of preventing problems before they occur. Moreover, the control information is generated by a manager based on the experience of monitoring the digital system. The human experience may not only cause misjudgments from person to person, but also may affect the control information due to the misjudgment of human experience, leading to the servo Inappropriate behavior at the end has undesirable consequences.

Therefore, the purpose of the present invention is to provide a monitoring and warning method for judging whether an abnormal situation may occur based on the login data.

Another object of the present invention is to provide a server that judges whether an abnormal situation may occur based on the login data.

Therefore, the monitoring and alarm method of the present invention is implemented by a server connected to a management terminal and a system via a communication network. The server stores N records corresponding to N consecutive previous time intervals and is related to the system response. The historical login data of the response status of the user's login. Each historical login data includes a login response time and a set of key factors related to the login response time. The monitoring alarm method of the present invention includes steps (A), One step (B), one step (C), one step (D), one step (E), and one step (F).

In this step (A), the server generates N-1 training data based on the historical login data, where each training data includes the key factor set of the historical login data of the nth previous time interval. And the login response time corresponding to the historical login data of the first n-1 previous time interval, where 1>n≦N.

In the step (B), the server uses a plurality of different machine learning algorithms to establish a plurality of training models for predicting the predicted login response time for logging into the system according to the training data.

In the step (C), the server selects a monitoring model used to predict the predicted login response time for logging into the system from the training models.

In this step (D), when the server receives the historical login data in the first previous time interval earlier than a current time interval, the server uses the monitoring model according to the historical login data, Calculate a predicted login response time related to the current time interval.

In the step (E), the server determines whether there is a warning event in the system based on the predicted login response time.

In the step (F), when the server determines that the system has the warning event, the server sends a warning message to the management terminal.

Furthermore, the server for monitoring alarms of the present invention is connected to a management terminal and a system via a communication network. The server includes a server communication module, a server storage module, and a server processing module .

The server-side communication module is connected to the communication network, and the server-side storage module stores N records corresponding to N consecutive previous time intervals and historical login data related to the response status of the system in response to the user's login Each historical login data includes a login response time and a set of key factors related to the login response time.

The server-side processing module is electrically connected to the server-side communication module and the server-side storage module. The server-side processing module generates N-1 training data based on the historical login data, where each training data includes The key factor set of the historical login data of the first n previous time interval, and the login response time corresponding to the historical login data of the first n-1 previous time interval, where 1>n≦N, and according to the training Data, using a number of different machine learning algorithms to create a number of training models for predicting the predicted login response time for logging in to the system, and from the training models, select a prediction log for predicting logging in to the system Response time monitoring model. When the server-side processing module receives the historical login data in the first previous time interval earlier than a current time period, the server-side processing module uses the historical login data according to the The monitoring model calculates a predicted login response time related to the current time interval, and based on the predicted login response time, determines whether there is a warning event in the system. When the server-side processing module determines that the system has the need In the event of a warning, a warning message is sent to the management terminal.

The effect of the present invention is that the server determines whether there is the warning event in the system based on the historical login data of the first previous time interval, thereby not only avoiding human experience from affecting the server's decision-making, but also The server determines in advance whether the predicted login response time of the current time period is abnormal according to the historical login data of the first previous time period, and can predict whether abnormal conditions may occur in the system as soon as possible, and issue a warning to enable the administrator Deal with it as soon as possible to avoid major problems that make the system inoperable due to minor abnormalities, thereby achieving the effect of preventing problems before they occur.

Before the present invention is described in detail, it should be noted that in the following description, similar elements are denoted by the same numbers.

Referring to FIG. 1, an embodiment of the monitoring and alarm method of the present invention is implemented by a server 1, and the server 1 is connected to a system 2 and a management terminal 3 via a communication network 100.

The server terminal 1 includes a server terminal communication module 11 connected to the communication network 100, a server terminal storage module 12, and a server terminal electrically connected to the server terminal communication module 11 and the server terminal storage module 12 Processing module 13. The server-side storage module 12 stores N records of historical login data corresponding to N consecutive previous time intervals and related to the response status of the system's response to the user's login. Each historical login data includes a login response time. , And a set of key factors related to the login response time. In this embodiment, the implementation of the server 1 can be a personal computer, a cloud host, or a server, but it is not limited to this.

The system 2 is a system for multiple users to log in. In this embodiment, the implementation of the system 2 can be an online bank, an online shopping platform, or a social group website, but it is not limit.

The management terminal 3 is held by a corresponding manager. In this embodiment, the implementation aspect of the management terminal 3 can be a personal computer, a notebook computer or a mobile device, but is not limited to this.

Hereinafter, an embodiment of the monitoring and alarm method of the present invention implemented by the server 1 will be described in conjunction with the accompanying drawings.

Referring to Figure 2, the monitoring and alarming method of the present invention illustrates how the server 1 generates a warning message based on the historical login data related to the system 2 and sends it to the management terminal 3. The monitoring and alarming method includes a step 401, a step 401, and a step 401. Step 402, a step 403, a step 404, a step 405, and a step 406.

In this step 401, the server-side processing module 13 generates N-1 training data based on the historical login data, where each training data includes the key factor of the historical login data of the first n previous time interval Set, and the login response time corresponding to the historical login data of the first n-1 previous time interval, where 1>n≦N.

For example, the server storage module 12 stores data corresponding to 9:10 am to 9:10 am, 9:10 am to 9:20 am, and 9:20 am to 9 am on February 14, 2020. 30 minutes, 9:30 am to 9:40 am, 9:40 am to 9:50 am, and 9:50 am to 10:00 am for the six historical login data, the server processing mode Group 13 generates five training data based on the six historical log-in data. The first training data contains the historical log-in data corresponding to the first six previous time intervals, that is, from 9 am to 9:10 am The key factor set of, and corresponding to the first five previous time intervals, that is, from 9:10 am to 9:20 am, the log-in response time of the historical log-in data, and the other training data contains The content is so analogized.

It is worth mentioning that in this embodiment, the key factor set includes a number of concurrent online clicks, a number of online users, a number of abnormal logins, and a system memory usage, but in other embodiments, the key factor set Other key factors can also be included, and are not limited to this.

In this step 402, the server-side processing module 13 establishes a monitoring model for predicting the predicted login response time for logging into the system based on the training data.

With reference to FIG. 3, the step 402 also includes a sub-step 4021, a sub-step 4022, and a sub-step 4023. The sub-steps of the step 402 are described below.

In step 4021, the server-side processing module 13 uses a plurality of different machine learning algorithms, such as Linear Regression, Random Forest, and Decision Tree according to the training data. ), or the Least Absolute Shrinkage and Selection Operator (LASSO), to establish multiple training models for predicting the predicted login response time for logging into the system.

In step 4022, for each training model, the server-side processing module 13 obtains a determination coefficient and a root mean square error of the training data corresponding to the training model according to the training data.

In the step 4023, the server-side processing module 13 selects the monitor used to predict the response time of logging into the system from the training models according to the determination coefficient and the root mean square error corresponding to each training model For example, the server-side processing module 13 selects multiple candidate models whose determination coefficients are greater than a predetermined threshold from the training models, and then selects one of the candidate models corresponding to the minimum mean square Root error monitoring model, but in other embodiments, the server-side processing module 13 can also select the monitoring model in other ways based on the determination coefficient and the root mean square error, and it is not limited to this embodiment .

In step 403, when the server processing module 13 receives the historical login data from the system 2 in the first previous time interval earlier than a current time interval through the server communication module 11 The server-side processing module 13 uses the monitoring model to calculate a predicted login response time related to the current time interval based on the historical login data.

In step 404, the server processing module 13 determines whether there is a warning event in the system 2 based on the predicted login response time. When the server determines that the system 2 does not have the warning event, it ends the Monitoring alarm method; when the server determines that the system 2 has the event that needs to be warned, step 405 is performed.

With reference to FIG. 4, the step 404 further includes a sub-step 4041, a sub-step 4042, and a sub-step 4043. The sub-steps of the step 404 are described below.

In the sub-step 4041, the server processing module 13 selects the target previous time interval corresponding to the current time interval from the N previous time intervals. In this embodiment, the server processing module 13 is to select the target previous time interval from the N previous time intervals on a different date but at the same time from the current time interval. For example, the current time interval is 2020/2/14 from 10 am to 10 am At 10 o'clock, the server-side processing module 13 selects the target previous time interval from the N previous time intervals, where the target previous time interval is from 10 am to 10 am on 2020/2/7 a week ago It is 10 o'clock, but in other embodiments, the server-side processing module 13 can also select the target previous time interval corresponding to the current time interval according to other conditions, which is not limited to this embodiment.

In the sub-step 4042, the server-side processing module 13 obtains a preset threshold according to the login response time of the target historical login data related to a previous time interval of the target, for example, related to the target previous time interval. The login response time of the target historical login data from 10 am to 10:10 in the time interval 2020/2/7 is 0.5 seconds, and the server-side processing module 13 obtains the default threshold value of 0.75 according to the login response time The server-side processing module 13 multiplies the login response time 0.5 seconds by a base number of 1.5 to obtain the default threshold of 0.75 seconds. However, in other embodiments, the server-side processing module 13 can also be based on The login response time is obtained by other means to obtain the preset threshold, which is not limited to this embodiment.

In the sub-step 4043, the server-side processing module 13 determines whether the predicted login response time is greater than the preset threshold. When the server-side processing module 13 determines that the predicted login response time is greater than the preset threshold, It means that the server side determines that the system 2 has the warning event, and performs step 405. When the server side processing module 13 determines that the predicted login response time is not greater than the preset threshold, it means that the server side processing module 13 It is judged that the system 2 does not have the event that needs to be warned, and the monitoring and warning method is ended.

In step 405, the server processing module 13 selects at least one key factor from the key factor set corresponding to the historical login data of the first previous time interval, wherein the first previous time interval is The previous time interval that is earlier than the current time interval and continuous with the current time interval, for example, if the current time interval is 2020/2/14 from 10 am to 10:10 am, then the first previous time interval is 2020 /2/14 from 9:50 to 10:00 in the morning.

In the step 406, the server-side processing module 13 generates a warning message related to the at least one critical factor according to the at least one critical factor, and transmits the warning message via the communication network 100 through the server-side communication module 11 Warning message to the management terminal 3.

In summary, the monitoring alarm method of the present invention uses the historical login data of the corresponding system 2 through the server 1 to establish the monitoring model for predicting the predicted login response time for logging in to the system, and use the monitoring The model judges whether the warning event exists, and when there is the warning event, the warning message is sent to the management terminal, whereby the server 1 can determine whether the warning event exists based on the historical login data, thereby To prevent the server 1 from being affected by human experience and causing errors in the judgment result. On the other hand, the server 1 can judge the existence of the warning event through the historical login data and send the warning before a major accident occurs in the system 2. Warning messages are used to predict whether the system may be abnormal and issue warnings so that the administrator can deal with them as soon as possible to prevent problems before they occur. For example, before the system 2 crashes due to the exhaustion of system memory, the system The server 1 can then judge that the warning event exists through the predicted login response time being greater than the preset threshold, and send the warning message related to the system memory usage to the management terminal 3. Therefore, it can indeed achieve the invention the goal of.

However, the above are only examples of the present invention. When the scope of implementation of the present invention cannot be limited by this, all simple equivalent changes and modifications made in accordance with the scope of the patent application of the present invention and the content of the patent specification still belong to Within the scope covered by the patent of the present invention.

1: Server 100: Communication network 11: Server communication module 12: Server-side storage module 13: Server-side processing module 2: system 3: Management side 401~406: steps 4021~4023: Sub-step 4041~4043: sub-step

Other features and effects of the present invention will be clearly presented in the embodiments with reference to the drawings, in which: Figure 1 is a block diagram illustrating an embodiment of the server for monitoring alarms of the present invention, which is connected to a system and a management terminal via a communication network; Figure 2 is a flowchart illustrating the monitoring and alarming method of the present invention implemented in this embodiment; FIG. 3 is a flowchart illustrating the sub-steps of step 402 in the monitoring and alarm method of the present invention executed by this embodiment; and Fig. 4 is a flowchart illustrating the sub-steps of step 404 in the monitoring alarm method of the present invention executed by this embodiment.

1: Server

100: Communication network

11: Server communication module

12: Server-side storage module

13: Server-side processing module

2: system

3: Management side

Claims (8)

A monitoring alarm method is implemented by connecting a management terminal and a server terminal of a system for multiple users to log in via a communication network. The server terminal stores N records corresponding to N consecutive previous time intervals. And the historical login data related to the response status of the system in response to the user's login. Each historical login data includes a login response time and a set of key factors related to the login response time. The monitoring alarm method includes the following steps : (A) The server generates N-1 training data based on the historical login data, where each training data contains the key factor set of the historical login data of the first n previous time intervals, and the corresponding first The login response time of the historical login data of n-1 previous time intervals, where 1<n≦N; (B) The server uses a number of different machine learning algorithms to create a number based on the training data. A training model used to predict the predicted login response time of logging into the system; (C) the server selects a monitoring model used to predict the predicted login response time of logging into the system from the training models; (D) when the When the server receives the historical login data in the first previous time interval earlier than a current time interval, the server uses the monitoring model to calculate a related to the current time interval based on the historical login data Predicted login response time; (E) The server determines whether there is a warning event in the system based on the predicted login response time. The step (E) also includes the following Sub-step (E-1) the server selects the target previous time interval corresponding to the current time interval from the N previous time intervals, (E-2) the server according to the previous time interval related to the target The login response time of a target historical login data obtains a preset threshold, (E-3) the server determines whether the predicted login response time is greater than the preset threshold, and (E-4) when the server When the server determines that the predicted login response time is greater than the preset threshold, the server determines that the system has the warning event; and (F) when the server determines that the system has the warning event, the server sends a Warning message to the management terminal. The monitoring alarm method according to claim 1, wherein the step (C) further includes the following sub-steps: (C-1) For each training model, the server obtains the pair of training data according to the training data A determination coefficient and a root mean square error of the model that should be trained; and (C-2) The server selects the application from the training models according to the determination coefficient and the root mean square error corresponding to each training model A monitoring model that predicts the response time of logging into the system. The monitoring alarm method according to claim 1, wherein, in the step (A), the key factor set includes a number of concurrent online clicks, a number of online users, a number of abnormal logins, and a system memory usage. The monitoring and warning method according to claim 3, wherein the step (F) further includes the following sub-steps: (F-1) the server side self-corresponds to the key factor of the historical login data of the first previous time interval At least one key factor is selected from the set; and (F-2) the server generates and sends a warning message related to the at least one key factor to the management terminal according to the at least one key factor. A server is used to monitor alarms, and is connected to a management terminal and a system for multiple users to log in via a communication network, and includes a server communication module connected to the communication network; a server storage The module stores N historical login data corresponding to N consecutive previous time intervals and related to the response status of the system's response to the user's login. Each historical login data includes a login response time and a related A collection of key factors in the login response time; and a server-side processing module that electrically connects the server-side communication module and the server-side storage module. The server-side processing module generates N- 1 training data, where each training data includes the key factor set of the historical login data of the first n previous time interval, and the login response time corresponding to the historical login data of the first n-1 previous time interval, Among them, 1<n≦N, and according to the training data, a plurality of different machine learning algorithms are used to establish a plurality of training models for predicting the predicted login response time of logging into the system, and from these training models , Select a monitoring model used to predict the predicted login response time for logging into the system, when the server-side processing module receives the When the historical login data in the first previous time interval in the period of time, the server-side processing module uses the monitoring model to calculate a predicted login response time related to the current time interval based on the historical login data, and based on The predicted login response time determines whether there is a warning event in the system. When the server processing module determines that the system has the warning event, it sends a warning message to the management terminal, where the server processing module From the N previous time intervals, select a pair of target previous time intervals corresponding to the current time interval, and obtain a preset valve according to the login response time of the target historical login data related to one of the target previous time intervals Value and determine whether the predicted login response time is greater than the preset threshold. When it is determined that the predicted login response time is greater than the preset threshold, the server-side processing module determines that the system has the warning event. The server side according to claim 5, wherein, for each training model, the server side processing module obtains a determination coefficient and a root mean square error of the training data corresponding to the training model according to the training data, And the server-side processing module selects the monitoring model used to predict the response time of logging into the system from the training models according to the determination coefficient and the root mean square error corresponding to each training model. The server according to claim 5, wherein the set of key factors includes a number of concurrent online clicks, a number of online users, a number of abnormal logins, and a system memory usage. The server side according to claim 7, wherein, when the server side processing module determines that the system has the warning event, the server side processing module automatically corresponds to the historical login data of the first previous time interval The key reason In the subset, at least one key factor is selected, and based on the at least one key factor, a warning message related to the at least one key factor is generated and sent to the management terminal.

Images