Early warning method and device based on large model, electronic equipment and storage medium

Abstract

The invention provides an early warning method and device based on a large model, electronic equipment and a storage medium, and relates to the technical field of computers, in particular to the technical fields of large models, cloud computing, big data and the like. The specific implementation scheme is as follows: acquiring to-be-processed information of a target service; processing the to-be-processed information based on the large model to obtain at least one information analysis rule screened by the large model for the to-be-processed information; processing the to-be-processed information based on at least one information analysis rule to analyze potential risks and / or faults in the target service; and executing a corresponding early warning strategy under the condition of analyzing that the potential risk and / or fault exists in the target service.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to technical fields such as large models, cloud computing, and big data. Background Art

[0002] With the development of computer technology, many businesses need to be completed through services provided by the network. Many services have relatively complex processing logic. In order to ensure the normal operation of the service, it is usually necessary to perform health management on the service. Summary of the invention

[0003] The present disclosure provides an early warning method, device, electronic device and storage medium based on a large model.

[0004] According to one aspect of the present disclosure, there is provided an early warning method based on a large model, comprising:

[0005] Get pending information of the target service;

[0006] Process the information to be processed based on the big model to obtain at least one information analysis rule screened by the big model for the information to be processed;

[0007] Processing the information to be processed based on at least one information analysis rule to analyze potential risks and / or failures in the target service;

[0008] When potential risks and / or failures are found in the target service, a corresponding early warning strategy is executed.

[0009] According to another aspect of the present disclosure, there is provided an early warning device based on a large model, comprising:

[0010] An acquisition module is used to obtain the pending information of the target service;

[0011] A first screening module is used to process the information to be processed based on the big model to obtain at least one information analysis rule screened by the big model for the information to be processed;

[0012] A processing module, configured to process the information to be processed based on at least one information analysis rule to analyze potential risks and / or failures in the target service;

[0013] The early warning module is used to execute a corresponding early warning strategy when potential risks and / or failures are analyzed in the target service.

[0014] According to another aspect of the present disclosure, there is provided an electronic device, comprising:

[0015] at least one processor; and

[0016] a memory communicatively connected to the at least one processor; wherein,

[0017] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute any method in the embodiments of the present disclosure.

[0018] According to another aspect of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable the computer to execute any method according to the embodiments of the present disclosure.

[0019] According to another aspect of the present disclosure, a computer program product is provided, including a computer program, which implements any method according to the embodiments of the present disclosure when executed by a processor.

[0020] In addition, the disclosed embodiments support the same detection device sending multiple health check messages to perform device health checks. Therefore, based on the response results of multiple health check messages, the overall health status of the target device layer can be comprehensively determined to further improve the accuracy of detection.

[0021] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The accompanying drawings are used to better understand the present solution and do not constitute a limitation of the present disclosure.

[0023] Figure 1 is a flowchart of a large model-based early warning method according to an embodiment of the present disclosure;

[0024] Figure 2 is a flowchart of a large model-based early warning method according to an embodiment of the present disclosure;

[0025] Figure 3 is a schematic diagram of the architecture of an early warning method based on a large model according to an embodiment of the present disclosure;

[0026] Figure 4 It is a schematic diagram of the overall process of the early warning method based on a large model according to an embodiment of the present disclosure;

[0027] Figure 5 is a structural schematic diagram of an early warning device based on a large model according to an embodiment of the present disclosure;

[0028] Figure 6 It is a block diagram of an electronic device used to implement the early warning method based on a large model according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0029] The following is a description of exemplary embodiments of the present disclosure in conjunction with the accompanying drawings, including various details of the embodiments of the present disclosure to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope of the present disclosure. Similarly, for the sake of clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0030] In related technologies, the main function of event fault warning is to play an operation and maintenance role in each current service. It can collect various logs and abnormal information generated by each service, perform secondary processing to extract the core content, and effectively classify the information. Different logics are processed for the events, faults, and alarms that occur. Event fault warning mainly forwards relevant data through existing configuration rules plus related rule engines. For example, after receiving the log, it is processed by the rule engine. However, since it contains multiple different rules, there may be parallel or serial logic between the rules. The processing flow is complicated and unclear. It is difficult to clearly observe whether there are errors in the rule engine during use and whether there are problems with the rules themselves.

[0031] In related technologies, the rule engine needs to find the rules that meet the conditions in a series of rules according to the written fixed logic. The key is how to quickly find and then give the rules of the compound conditions, and then execute the subsequent logic according to the relevant content. Using the rule engine for data operation and maintenance may have the following problems:

[0032] 1. In the case of new rules, the rule engine needs to be reloaded to implement hot updates. Hot updates require not only updating the rule base, but also updating the rule engine to adapt to the new rule base. In this way, when new rules appear, you need to wait for the rule engine to be updated before the rule engine can filter based on the updated rules. In this case, there is a time difference in the actual effect of the new rules, and the re-execution process is more complicated, which also occupies a large amount of memory and cannot smoothly complete the switching of related content; the decision-making process of the rule engine often relies on preset rules and algorithms, which makes its decision-making process lack transparency.

[0033] 2. When the scale of event fault warning is large and there is only a separate rule engine, the rule engine itself may be under great pressure during execution; the relevant configuration of the rule engine is complex and more difficult for people who are not familiar with the relevant technology; when processing large amounts of data or complex business logic, the performance of the rule engine may be affected to a certain extent, which may cause the system response speed to slow down or the processing capacity to decrease.

[0034] 3. When using rule engines to process complex systems such as natural language, their capabilities may be limited. Due to the ambiguity, context dependence, and implicit information in the language, it is difficult for the rule engine to fully and accurately understand and interpret the language. In a rapidly changing business environment, the rule engine may find it difficult to quickly adapt to changes in business rules.

[0035] In view of this, an early warning method based on a large model is proposed in the embodiment of the present disclosure, such as Figure 1 As shown, including:

[0036] S101, obtaining the to-be-processed information of the target service.

[0037] Among them, the target service is any of the existing types of cloud servers. Each service can use the monitoring system, such as ES (Elasticsearch, full-text search engine), logs, etc. The information to be processed obtained by monitoring includes but is not limited to sensor data, log records, operation records, etc. Since multiple monitoring platforms do not have the ability to uniformly configure early warnings, a platform is needed to integrate the information data to be processed for unified management. A platform for executing the large model-based early warning method of the embodiment of the present disclosure can be provided to connect the non-services to the platform for unified management.

[0038] S102, processing the information to be processed based on the big model to obtain at least one information analysis rule screened by the big model for the information to be processed.

[0039] Among them, the large model can be a large language model (LLMs). Large language models refer to a specific type of large model that is specifically used to process text data. This type of model is a natural language processing model based on a neural network, which can be used to generate, understand and process text data. Large language models can have tens of billions of parameters, can generate high-quality text, and can be used for various natural language processing tasks, such as question answering, text generation, dialogue systems, etc.

[0040] The large language model has good reasoning ability and small sample learning ability. The large language model can understand the model on a large scale or can be trained on a large number of samples. Based on the large model, accurate semantic understanding can be achieved.

[0041] In addition, the large model can also be a multimodal large language model (MLLM) to facilitate processing of multimodal information provided by the target service and screen out appropriate information analysis rules.

[0042] The rules include a series of conditions and the actions to be taken when the conditions are met, such as the content of the message notification object.

[0043] S103: Process the information to be processed based on at least one information analysis rule to analyze potential risks and / or failures in the target service.

[0044] During implementation, when the information analysis rules are obtained, the information to be processed can be processed based on the information analysis rules to obtain potential risks and / or failures in the target service.

[0045] S104: When potential risks and / or failures are found in the target service, a corresponding early warning strategy is executed.

[0046] Based on potential risks and / or failures and the logic in the information analysis rules, relevant personnel are warned. Exemplary warning channels may include sending emails, text messages, phone calls, and three-party notification interfaces, etc. The specific warning strategies are described in detail later and the embodiments of the present disclosure are not repeated here.

[0047] In the embodiment of the present disclosure, a large model is used instead of a rule engine, so that with the help of the powerful reasoning ability of the large model, the appropriate information analysis rules screened out by the large model from the rule base are used to improve the analysis ability of the information to be processed. Among them, the rules in the rule base are only used as input information of the large model for analysis and processing by the large model, so the rule base can be updated at any time, and it does not affect the large model replacing the rule engine for alignment and analysis. The large model does not need to be updated with the update of the rule base. Therefore, the method provided by the embodiment of the present disclosure does not require a hot update process like the rule engine. The new rules can take effect immediately, and there is no time difference required for the rules to take effect. Moreover, the input and output of the large model are clear, which can improve the transparency of decision-making. At the same time, the large model is a large-scale model that can process large-scale rules without causing additional pressure on the service. In addition, the big model can accurately capture features such as ambiguity, context dependence, and implicit information in the language, achieve a comprehensive and accurate understanding and interpretation of natural language, and be more adaptable to rule changes in natural language situations. Compared with the rule engine that uses a fixed expression method, the big model is more flexible and can adapt to the rapidly changing business environment. In addition, when potential risks and / or failures are identified, the corresponding early warning strategy is executed to promptly notify relevant personnel to handle the incident.

[0048] In some embodiments, obtaining the to-be-processed information of the target service may be implemented as follows:

[0049] Step A1, receiving the original information sent by the target service.

[0050] The original information includes but is not limited to sensor data, log records, operation records, etc. sent by the target service.

[0051] Step A2: extract key information from the original information.

[0052] During implementation, key information can be extracted by using regular string matching.

[0053] The key information includes at least one of the following information: receiving object, key title, key content, key status, etc.

[0054] In addition, what kind of information the key information specifically includes may be determined based on the specific service and the content that needs to be monitored and managed, and the embodiments of the present disclosure do not limit this.

[0055] In some embodiments, the extracting of the key information from the original information may be implemented as follows: performing identity verification on the target service; and extracting the key information from the original information when the target service passes the verification.

[0056] During implementation, a blacklist or a whitelist may be established. Taking the whitelist as an example, identity verification of the target service may be implemented as determining whether the target service is in the whitelist. When it is determined that the target service is in the whitelist, it is determined that the identity verification of the target service has passed, and then key information is extracted from the original information corresponding to the target service. When it is determined that the target service is not in the whitelist, it is determined that the identity verification of the target service has failed, and the information sent by the target service is not processed.

[0057] The blacklist and whitelist of a service is a mechanism for restricting or authorizing specific IP (Internet Protocol) addresses or users to access a server. A blacklist refers to prohibiting certain IPs or users from accessing a server, while a whitelist refers to allowing only certain IPs or users to access a server. The use of blacklists and whitelists can play a role in many aspects. First, the security of the large model can be enhanced. By putting trusted IP addresses or users in the whitelist, it can be ensured that only authorized users can use the large model of the disclosed embodiment for analysis. At the same time, the blacklist can exclude known malicious IP addresses or users from the large model to prevent them from unauthorized access.

[0058] In the disclosed embodiment, the big model needs to consume more computing resources to execute corresponding tasks. By verifying the identity of the target service, it is ensured that only legitimate services can use the big model, avoiding interference of malicious traffic to the big model, so as to ensure that legitimate services can use the big model for risk assessment and fault prediction.

[0059] Step A3: When the key information includes preset necessary fields, the key information is used as the information to be processed.

[0060] When implementing, the more complex the operation logic of the service is, the greater the amount of information it generates. For example, when a business system in the target service fails, other management services in the target service may also send out information, and there is a lot of related information, so that key information may be submerged in the ocean of information. If each piece of original information is processed separately, it will not only lead to a huge amount of information and low processing efficiency, but also the interference of a large amount of useless information will cause the accuracy of the large model to screen reasonable information processing rules to be impaired.

[0061] The information to be processed may include some fixed expressions, such as "name" representing the status change notification and "auseId" representing the receiving object. In this case, "name" represents the key status; "auseId" represents the receiving object; then the "name" and "auseId" can be preset necessary fields.

[0062] In addition, the large model in the embodiment of the present disclosure not only supports one service, but can also provide services for multiple services at the same time. In the face of a large amount of information, in order to improve the early warning efficiency, the embodiment of the present disclosure removes redundant or invalid information through key information extraction. Therefore, the use of key information can achieve accurate capture of useful messages, so as to facilitate timely processing of the information to be processed and improve the early warning efficiency.

[0063] It is understandable that, when the key information does not include the preset necessary field, the original information is discarded.

[0064] In the disclosed embodiment, invalid information can be screened out and discarded based on preset necessary fields, so as to improve the efficiency of large model services while improving the accuracy of data operation and maintenance.

[0065] In some embodiments, the processing of the information to be processed based on the big model to obtain at least one information analysis rule screened by the big model for the information to be processed may be implemented as follows:

[0066] Step B1, obtaining the latest rule list from the rule base corresponding to the target service; the rule base supports real-time updating of the rule list.

[0067] During implementation, the target service will be adaptively adjusted according to the demand, and the target service can be continuously updated and improved, and the corresponding rules will also be continuously updated and improved. In the disclosed embodiment, the rule base can be updated at any time, and the big model can directly obtain the latest rule list from the rule base corresponding to the target service, without using the hot update method to obtain the latest rule list. With the help of the big model, the entire process can be more concise, reducing the time difference between its effectiveness process and the actual effectiveness effect.

[0068] Step B2: when the length of the rule list is less than or equal to a preset length, construct a first prompt word based on the rule list, the information to be processed and a prompt word template.

[0069] During implementation, in order to ensure the accuracy of the information analysis rules screened out by the big model, the constructed prompt words have a length limit to ensure that the big model can accurately and quickly understand and process the prompt words. Therefore, the preset length can be less than the length of the prompt word.

[0070] In addition, the preset length can be dynamically changed instead of being a fixed value. Since the length of the information to be processed is dynamic, the preset length can be dynamically adjusted based on the length of the information to be processed.

[0071] For example, the preset length may be dynamically determined based on the upper limit of the length of the prompt word, the length of the information to be processed, and the length of the prompt word template content.

[0072] Step B3: input the first prompt word into the large model, so that the large model can filter out the at least one information analysis rule for the information to be processed based on the first prompt word.

[0073] During implementation, the rule library may associate and store each rule ID (Identity document) and the content of each rule, and the information analysis rule output by the large model may be the rule ID corresponding to the corresponding rule.

[0074] In the disclosed embodiment, when there is an up-to-date rule list, the large model can obtain the up-to-date rule list in a timely manner by dynamically generating the first prompt word, so as to reduce the time difference in the hot update process. In addition, limiting the length of the rule list to a preset length can enable the large model to use short information to complete the reasoning process, extract effective information from it, and screen out reasonable information analysis rules.

[0075] In some embodiments, since the rule list may be too long, in order to realize the accurate reasoning process of the large model on the information to be processed, the information to be processed is processed based on the large model to obtain at least one information analysis rule selected by the large model for the information to be processed, which can also be implemented as follows:

[0076] Step C1, when the length of the rule list exceeds a preset length, divide the rule list into multiple sub-lists.

[0077] Exemplarily, when the preset length is a and the number of rules in the rule list is (3a+b), the rule list can be divided by a to obtain multiple sub-lists, where a and b are positive integers greater than or equal to 0, and b is less than a.

[0078] Step C2: constructing a plurality of second prompt words based on the plurality of sub-lists, the information to be processed and the prompt word template.

[0079] A second cue word is constructed based on each sub-list.

[0080] Continuing with the previous example, four corresponding second prompt words can be constructed based on the four sub-lists constructed in the above example.

[0081] Step C3, processing the plurality of second prompt words based on the large model to obtain a plurality of rule screening results generated by the large model based on the rule base.

[0082] During implementation, still taking the above example, four second prompt words are input into the large model in parallel to obtain the rule screening result for each second prompt word.

[0083] It can be understood as the first second prompt word obtained by constructing the first sub-list, inputting the large model, and obtaining the first rule screening result.

[0084] The second second prompt word obtained by constructing the second sub-list is input into the large model to obtain the second rule screening result.

[0085] The third second prompt word obtained by constructing the third sub-list is input into the large model to obtain the third rule screening result.

[0086] The fourth second prompt word obtained by constructing the fourth sub-list is input into the large model to obtain the fourth rule screening result.

[0087] Among them, if any of the first rule filtering results, the second rule filtering results, the third rule filtering results, and the fourth rule filtering results is that no processing rules are filtered out, then the rule filtering result is empty, indicating that there is no information analysis rule suitable for the information to be processed in the corresponding partial rules.

[0088] Step C4, combining the multiple rule screening results to obtain the at least one information analysis rule.

[0089] The first rule screening result, the second rule screening result, the third rule screening result and the fourth rule screening result are concatenated to obtain the final rule screening result.

[0090] In the disclosed embodiment, by segmenting the rule base, not only can the potential risks and / or failures of the target service be analyzed from the full rule base, but it can also adapt to rule bases of any length, so that the large model can adapt to the dynamic update of the rule base, and can provide data operation and maintenance capabilities for the target service online in real time.

[0091] In some embodiments, the prompt word template includes criteria that the large model should follow; the criteria at least require that at least one rule screened by the large model should be included in the rule base.

[0092] In addition, the criterion may also include requiring the large model not to answer questions other than the rules, so as to further limit the output scope of the large model and reduce the hallucination problem of the large model.

[0093] In the disclosed embodiment, the output of the large model is limited to the rule base based on the prompt word template to avoid the large model outputting irrelevant content or hallucinations, thereby ensuring the accuracy of the rules screened by the large model.

[0094] In some embodiments, in order to avoid the interference of a large amount of information on the large model and ensure the accuracy of the large model screening rules, such as Figure 2 As shown, the large model can also be monitored and corrected periodically, which can be implemented as follows:

[0095] S201, periodically checking the big model to determine the difference between the processing rules screened out by the big model and the processing rules screened out by the rule engine.

[0096] During implementation, a test sample set can be used for testing. For each test sample in the test sample set, the following steps can be performed: input the test sample into the rule engine to obtain a first rule list; input the test sample into the large model to obtain a second rule list. Compare the differences between the first rule list and the second rule list. Then, the test results of each test sample in the entire test sample set can be summarized to determine the differences between the processing results of the large model and the rule engine.

[0097] In the embodiment of the present disclosure, when a new rule is added, it can be determined based on the actual situation whether to write a script to assist the rule engine in adapting the new rule, so that the rule engine can assist in detecting the execution capability of the large model.

[0098] S202, when the difference between the processing rules screened out by the big model and the processing rules screened out by the rule engine meets the preset conditions, optimize the prompt word template.

[0099] The purpose of optimizing the prompt word template is to make the processing rules screened by the large model consistent with the processing rules screened by the rule engine.

[0100] During implementation, the preset condition may be that the difference between the processing rules screened by the big model and the processing rules screened by the rule engine is greater than a preset threshold, and an exemplary preset threshold may be c. If there are c different processing rules between the processing rules screened by the big model and the processing rules screened by the rule engine, it is determined that the prompt word template needs to be optimized. Wherein c is a positive integer greater than or equal to 0.

[0101] The aforementioned specific values ​​can be adjusted based on actual conditions. In more stringent cases, the preset condition can be to optimize the prompt word template when the processing rules screened out by the large model and the processing rules screened out by the rule engine are not completely consistent. The embodiments of the present disclosure do not limit this.

[0102] In other embodiments, the rules in the rule base can be classified into different levels, and for core rules, the processing results of the large model and the processing results of the rule engine must be consistent. For some non-core rules, such as the rules of early warning methods, it can be required that there are differences that do not affect the execution results.

[0103] For example, the preset condition may also be that the difference between the first score of the processing rule screened by the large model and the second score of the processing rule screened by the rule engine is greater than a preset score. In implementation, a higher weight may be given to key rules or important rules, and a lower weight may be given to ordinary rules. For key rules and non-key rules, the difference between the processing results of the large model screening and the rule engine may be weighted and summed to obtain a first score; based on the first score, it is determined whether the prompt word template needs to be optimized.

[0104] In the disclosed embodiment, the rule engine is used periodically to correct the big model so that the big model can continuously filter out accurate rules for the target service, thereby improving the accuracy of data operation and maintenance.

[0105] In addition, in other embodiments, periodic detection of the large model can also be implemented by determining the difference between the processing rules screened out by the large model and the standard processing rules corresponding to each sample rule in the test sample set; when the difference between the processing rules screened out by the large model and the standard processing rules corresponding to each sample rule in the test sample set meets the preset conditions, the prompt word template is optimized.

[0106] Based on the foregoing content, each sample rule in the test sample set can be annotated in advance to obtain a standard processing rule, and each sample rule in the test sample set can be processed based on the large model to obtain at least one processing rule screened by the large model for each sample rule in the test sample set; the processing rule is compared with the standard processing rule to obtain the difference. When the difference meets the preset conditions, the prompt word template is optimized. The preset conditions are similar to those described in the foregoing content, and the embodiments of the present disclosure will not be repeated here one by one.

[0107] For ease of understanding, the system architecture to which the early warning method based on the large model proposed in the embodiment of the present disclosure can be applied is as follows: Figure 3 As shown, it includes information integration module, key information extraction module, prompt word construction module, large model processing, and message warning module.

[0108] The information integration module is used to obtain the to-be-processed information of the target service from the three-party interface.

[0109] The key information extraction module is used to obtain key information from the information to be processed.

[0110] The prompt word construction module is used to construct prompt words based on the rule list, the information to be processed and the prompt word template. The specific construction method has been described above, and the embodiment of the present disclosure will not be repeated here.

[0111] The large model processing module is used to process the prompt words to obtain at least one information analysis rule.

[0112] The message warning module is used to determine the potential risks and / or failures of the target service based on the rule logic within at least one information analysis rule, so as to perform warning processing based on the potential risks and / or failures and the internal logic corresponding to the rule.

[0113] After obtaining the potential risks and / or failures of the target service and the corresponding information analysis rules, they can be stored in the database for subsequent user inspection.

[0114] In some embodiments, executing the corresponding early warning strategy may be implemented as follows:

[0115] Step D1, counting the duration of potential risks and / or failures.

[0116] During implementation, when an event occurs, it can be placed in the cache and the timestamp can be recorded, and then the corresponding duration can be obtained through the cache.

[0117] Step D2, matching the duration with the warning range set.

[0118] In some embodiments, the warning range set includes at least one of the following:

[0119] When the duration is between the first duration and the second duration (i.e., the first warning range in the warning range set is satisfied), a warning is sent to the target object via email;

[0120] When the duration is between the second duration and the third duration (i.e., when the second warning range in the warning range set is satisfied), a warning is issued to the target object via a text message;

[0121] When the duration is between the third duration and the fourth duration (i.e., the third warning range in the warning range set is satisfied), issuing a warning to the target object by phone;

[0122] When the duration is between the fourth duration and the fifth duration (ie, the fourth warning range in the warning range set is satisfied), a warning is issued to the target object through the three-party interface.

[0123] Among them, the order from small to large of each duration is the first duration < second duration < third duration < fourth duration < fifth duration.

[0124] Step D3, when the duration matches the target warning range, execute the warning strategy corresponding to the target warning range; wherein, the longer the duration, the larger the corresponding warning range.

[0125] During implementation, when the duration is between the first duration and the second duration, an early warning is issued by email. If there is no response within the second duration, it is determined whether the duration is between the second duration and the third duration. If it is within this time period, an early warning is issued to the target object via text message; and so on, until the incident is responded to by relevant personnel.

[0126] In the embodiment of the present disclosure, matching is performed based on duration, and the warning range is gradually increased to enable timely issuance of warnings to relevant personnel.

[0127] The overall flow chart of the early warning method based on the large model proposed in the embodiment of the present disclosure is as follows: Figure 4 As shown, including:

[0128] S401, obtaining information to be processed;

[0129] S402, extracting key information from the information to be processed;

[0130] S403, obtaining the latest rule list from the rule library corresponding to the target service;

[0131] S404, constructing prompt words based on the rule list, the information to be processed and the prompt word template;

[0132] S405, inputting the prompt word into the large model to obtain at least one information analysis rule;

[0133] S406, processing the information to be processed based on at least one information analysis rule to analyze potential risks and / or failures in the target service;

[0134] S407, executing an early warning strategy based on potential risks and / or failures in the target service and the logic corresponding to the rule, with specific reference to the following steps;

[0135] S408, determining whether the conditions for sending by email are met, if the conditions for sending by email are met, executing S409, if the conditions for sending by email are not met or there is no response within the preset time for sending the email, executing S410;

[0136] The condition for email sending not being met may be, for example, that the relevant person does not have an email address or the email address cannot be found.

[0137] S409, email sending;

[0138] S410, determining whether the conditions for using SMS sending are met, if the conditions for using SMS sending are met, executing S411, if the conditions for using SMS sending are not met or the SMS sending is not responded to within the preset time, executing S412;

[0139] S411, SMS sending;

[0140] S412, determining whether the conditions for using telephone notification are met, if the conditions for using telephone notification are met, executing S413, if the conditions for using telephone notification are not met or the telephone notification is not responded to within the preset time, executing S414;

[0141] S413, telephone notification;

[0142] S414, calling other third-party interfaces for notification. If the other third-party interfaces can notify the staff, execute S415. If the other third-party interface notification is not satisfied or the other third-party interface notification is not responded to within the preset time, execute S416.

[0143] S415, other three-party interface notification;

[0144] S416, expands the scope of notification for the means of notifying relevant persons;

[0145] As described above, it is also necessary to periodically test the large model, and the execution steps are shown in S417-S419:

[0146] S417, determining the difference between the processing rules screened by the large model and the processing rules screened by the rule engine;

[0147] S418, when the difference between the processing rules screened by the big model and the processing rules screened by the rule engine meets the preset conditions, execute S419; when the difference between the processing rules screened by the big model and the processing rules screened by the rule engine does not meet the preset conditions, execute S404.

[0148] S419, optimizing the prompt word template.

[0149] In summary, the main function of event fault warning is to play the role of operation and maintenance in the current services. It can collect various logs and abnormal information generated by various services for secondary processing. Secondary processing is used to extract key information, classify based on key information, analyze rules based on key information and information filtered out from the rule base, and determine the types of target services corresponding to events, faults, and alarms, and perform different logical warning processing based on different types.

[0150] An alarm is a notification issued by a system or device when an abnormal situation occurs or may cause an abnormal situation. An alarm usually indicates that there is a potential problem, but it may not have caused a failure. Alarms require appropriate measures to clear the fault, otherwise it may affect the normal operation of the business.

[0151] When the alarms in the receiving log are distributed according to the rule conditions and the triggered rule type is determined to be an event, the relevant records in the log are considered to be an event. Events are mainly used to manage the automatic triggering of flow rules and manually added event tasks. The events in the operation and maintenance event center support flexible task flow, and key events are responded to and processed first. At the same time, events with greater impact are upgraded to faults to achieve online management of the entire life cycle of events.

[0152] When the alarms in the receiving log are distributed according to the rule conditions and the triggered rule type is determined to be an alarm, the relevant records in the log are considered to be an alarm. Alarms can be more detailed by converging noise reduction rules. Records are kept for each alarm information, mainly to help R&D and operation personnel trace, troubleshoot, and solve online problems.

[0153] Alarms in the log are distributed according to the rule conditions. If the triggered rule type is determined to be a fault, it means that the system or device cannot work normally as expected. Usually it will cause business interruption or performance degradation. This situation needs to be handled immediately to avoid a greater impact on the business. In daily operations, any phenomenon that causes business service interruption, service quality degradation, or user service experience degradation is called a fault, regardless of the reason.

[0154] In the disclosed embodiment, an event fault alarm platform service will be deployed and accessed to a large model service to provide platform access procedures and related interfaces to other services, configure related response rules, as well as alarm personnel and alarm channels.

[0155] In the disclosed embodiment, the big model is mainly used to replace the rule engine, so the service can support all the capabilities of the rule engine, can effectively detect the rule base, splice all the rules into a rule list, and summarize the key information of the collected event logs and other information, and generate prompt words through the contents of the above two parts. Then the prompt words are connected to the big model service interface, and at least one information analysis rule is obtained through the interface to analyze the potential risks and / or failures in the target service; when the target service is analyzed to have potential risks and / or failures, the corresponding early warning strategy is executed.

[0156] During implementation, the corresponding types are determined based on the potential risks and / or failures finally analyzed. The types for classification include events, failures, and alarms. Different early warning strategies can be implemented according to different types. Figure 4 As shown, the warning is performed in a way of gradually increasing and expanding the range. For example, the warning range corresponding to the alarm is the smallest, and the warning range corresponding to the fault is the largest.

[0157] In the disclosed embodiment, the large model solution service needs to configure a timeout request interface to prevent the interface response time from being too long, resulting in other requests not being able to respond quickly, and a corresponding access address whitelist to avoid interference from other external requests and impact on the results.

[0158] When the rules filtered out by the large model are obtained, the corresponding message sending configuration is executed for the rule, and the message can be sent through channels such as SMS, email, phone and three-party interface.

[0159] In the disclosed embodiment, a role is assigned to the big model through a prompt word, and the task to be performed by the role is described; by limiting the criteria for the big model to perform the task in the prompt word, it is ensured that the answer of the big model must return the result in the format of the criteria, which can facilitate subsequent logical processing of the result; in addition, the rule list in the rule library supports dynamic generation, and each generation obtains the latest rule library and then assembles it into a big model prompt, ensuring real-time update of the logic of the rule library.

[0160] Based on the same technical concept, the present disclosure also provides an early warning device 500 based on a large model, such as Figure 5 As shown, including:

[0161] The acquisition module 501 is used to acquire the to-be-processed information of the target service;

[0162] A first screening module 502, configured to process the information to be processed based on the big model to obtain at least one information analysis rule screened by the big model for the information to be processed;

[0163] A processing module 503, configured to process the information to be processed based on the at least one information analysis rule to analyze potential risks and / or failures in the target service;

[0164] The early warning module 504 is used to execute a corresponding early warning strategy when potential risks and / or failures are analyzed in the target service.

[0165] In some embodiments, the first screening module includes:

[0166] An acquisition unit, used to acquire the latest rule list from a rule base corresponding to the target service; the rule base supports real-time updating of the rule list;

[0167] a construction unit, configured to construct a first prompt word based on the rule list, the information to be processed and a prompt word template when the length of the rule list is less than or equal to a preset length;

[0168] A screening unit is used to input the first prompt word into the large model, so that the large model screens out the at least one information analysis rule for the information to be processed based on the first prompt word.

[0169] In some embodiments, the second screening module is further included, which is used to:

[0170] When the length of the rule list exceeds a preset length, dividing the rule list into a plurality of sub-lists;

[0171] constructing a plurality of second prompt words based on the plurality of sub-lists, the information to be processed and the prompt word template;

[0172] Processing the plurality of second prompt words based on the large model to obtain a plurality of rule screening results generated by the large model based on the rule base;

[0173] The plurality of rule screening results are combined to obtain the at least one information analysis rule.

[0174] In some embodiments, the prompt word template includes criteria that the large model should follow; the criteria at least require that at least one rule screened by the large model should be included in the rule base.

[0175] In some embodiments, a detection module is further included, which is used to:

[0176] Periodically testing the large model to determine the difference between the processing rules screened by the large model and the processing rules screened by the rule engine;

[0177] When the difference between the processing rules screened out by the large model and the processing rules screened out by the rule engine meets a preset condition, the prompt word template is optimized.

[0178] In some embodiments, the acquisition module includes:

[0179] A receiving unit, configured to receive the original information sent by the target service;

[0180] An extraction unit, used to extract key information from the original information;

[0181] A determining unit is used to use the key information as the information to be processed when the key information includes a preset necessary field.

[0182] In some embodiments, a discard module is further included, which is used to:

[0183] In the case that the key information does not include the preset necessary field, the original information is discarded.

[0184] In some embodiments, the extraction unit is used to:

[0185] Performing identity verification on the target service;

[0186] When the target service passes the verification, the key information is extracted from the original information.

[0187] In some embodiments, the early warning module includes:

[0188] A statistical unit, used to count the duration of the potential risk and / or failure;

[0189] A matching unit, used for matching the duration with a warning range set;

[0190] An execution unit is used to execute the warning strategy corresponding to the target warning range when the duration matches the target warning range; wherein, the longer the duration, the larger the corresponding warning range.

[0191] For the description of specific functions and examples of each module and submodule of the device in the embodiment of the present disclosure, reference can be made to the relevant description of the corresponding steps in the above method embodiment, which will not be repeated here.

[0192] In the technical solution disclosed herein, the acquisition, storage and application of user personal information involved are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0193] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device, a readable storage medium and a computer program product.

[0194] Figure 6 A schematic block diagram of an example electronic device 600 that can be used to implement an embodiment of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or required herein.

[0195] like Figure 6 As shown, the device 600 includes a computing unit 601, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 602 or a computer program loaded from a storage unit 608 into a random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the device 600 can also be stored. The computing unit 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0196] A number of components in the device 600 are connected to the I / O interface 605, including: an input unit 606, such as a keyboard, a mouse, etc.; an output unit 607, such as various types of displays, speakers, etc.; a storage unit 608, such as a disk, an optical disk, etc.; and a communication unit 609, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 609 allows the device 600 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0197] The computing unit 601 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 601 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 601 performs the various methods and processes described above, such as an early warning method based on a large model. For example, in some embodiments, the early warning method based on a large model may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit 608. In some embodiments, part or all of the computer program may be loaded and / or installed on the device 600 via ROM 602 and / or communication unit 609. When the computer program is loaded into RAM 603 and executed by the computing unit 601, one or more steps of the early warning method based on the large model described above may be performed. Alternatively, in other embodiments, the computing unit 601 may be configured to perform an early warning method based on a large model in any other appropriate manner (e.g., by means of firmware).

[0198] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0199] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0200] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0201] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0202] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0203] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship with each other. The server may be a cloud server, a server of a distributed system, or a server combined with a blockchain.

[0204] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.

[0205] The above specific implementations do not constitute a limitation on the protection scope of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the principles of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. An early warning method based on a large model, comprising: Get the pending information of the target service; Processing the information to be processed based on the big model to obtain at least one information analysis rule screened by the big model for the information to be processed; Processing the information to be processed based on the at least one information analysis rule to analyze potential risks and / or failures in the target service; When potential risks and / or failures are found in the target service, a corresponding early warning strategy is executed.

2. The method according to claim 1, wherein: The processing of the information to be processed based on the big model to obtain at least one information analysis rule screened by the big model for the information to be processed includes: Acquire the latest rule list from the rule base corresponding to the target service; the rule base supports real-time updating of the rule list; When the length of the rule list is less than or equal to a preset length, constructing a first prompt word based on the rule list, the information to be processed and a prompt word template; The first prompt word is input into the large model, so that the large model selects the at least one information analysis rule for the information to be processed based on the first prompt word.

3. The method according to claim 2, further comprising: When the length of the rule list exceeds a preset length, dividing the rule list into a plurality of sub-lists; constructing a plurality of second prompt words based on the plurality of sub-lists, the information to be processed and the prompt word template; Processing the plurality of second prompt words based on the large model to obtain a plurality of rule screening results generated by the large model based on the rule base; The plurality of rule screening results are combined to obtain the at least one information analysis rule.

4. The method according to claim 2 or 3, wherein: The prompt word template includes the criteria that the large model should follow; the criteria require that at least one rule screened by the large model should be included in the rule base.

5. The method according to claim 2 or 3, further comprising: Periodically testing the large model to determine the difference between the processing rules screened by the large model and the processing rules screened by the rule engine; When the difference between the processing rules screened out by the large model and the processing rules screened out by the rule engine meets a preset condition, the prompt word template is optimized.

6. The method according to claim 1, wherein: The obtaining of the pending information of the target service includes: Receiving original information sent by the target service; Extracting key information from the original information; In the case where the key information includes preset necessary fields, the key information is used as the information to be processed.

7. The method according to claim 6, further comprising: In the case that the key information does not include the preset necessary field, the original information is discarded.

8. The method according to claim 6, wherein: The step of extracting key information from the original information includes: Performing identity verification on the target service; When the target service passes the verification, the key information is extracted from the original information.

9. The method according to claim 1, wherein: The execution of the corresponding early warning strategy includes: Count the duration of the potential risks and / or failures; Matching the duration with the warning range set; When the duration matches the target warning range, the warning strategy corresponding to the target warning range is executed; wherein, the longer the duration, the larger the corresponding warning range.

10. An early warning device based on a large model, comprising: An acquisition module is used to obtain the pending information of the target service; A first screening module, used for processing the information to be processed based on the big model to obtain at least one information analysis rule screened by the big model for the information to be processed; A processing module, configured to process the information to be processed based on the at least one information analysis rule to analyze potential risks and / or failures in the target service; The early warning module is used to execute a corresponding early warning strategy when potential risks and / or failures are analyzed in the target service.

11. The device according to claim 10, wherein: The first screening module comprises: An acquisition unit, used to acquire the latest rule list from a rule base corresponding to the target service; the rule base supports real-time updating of the rule list; a construction unit, configured to construct a first prompt word based on the rule list, the information to be processed and a prompt word template when the length of the rule list is less than or equal to a preset length; A screening unit is used to input the first prompt word into the large model, so that the large model screens out the at least one information analysis rule for the information to be processed based on the first prompt word.

12. The device according to claim 11, further comprising a second screening module, configured to: When the length of the rule list exceeds a preset length, dividing the rule list into a plurality of sub-lists; constructing a plurality of second prompt words based on the plurality of sub-lists, the information to be processed and the prompt word template; Processing the plurality of second prompt words based on the large model to obtain a plurality of rule screening results generated by the large model based on the rule base; The plurality of rule screening results are combined to obtain the at least one information analysis rule.

13. The device according to claim 11 or 12, wherein: The prompt word template includes the criteria that the large model should follow; the criteria at least require that at least one rule screened by the large model should be included in the rule base.

14. The device according to claim 11 or 12, further comprising a detection module, configured to: Periodically testing the large model to determine the difference between the processing rules screened by the large model and the processing rules screened by the rule engine; When the difference between the processing rules screened out by the large model and the processing rules screened out by the rule engine meets a preset condition, the prompt word template is optimized.

15. The device according to claim 10, wherein: The acquisition module comprises: A receiving unit, configured to receive the original information sent by the target service; An extraction unit, used to extract key information from the original information; A determining unit is used to use the key information as the information to be processed when the key information includes a preset necessary field.

16. The apparatus according to claim 15, further comprising a discarding module, configured to: In the case that the key information does not include the preset necessary field, the original information is discarded.

17. The device according to claim 15, wherein: The extraction unit is used for: Performing identity verification on the target service; When the target service passes the verification, the key information is extracted from the original information.

18. The device according to claim 10, wherein: The early warning module comprises: A statistical unit, used to count the duration of the potential risk and / or failure; A matching unit, used for matching the duration with a warning range set; An execution unit is used to execute the warning strategy corresponding to the target warning range when the duration matches the target warning range; wherein, the longer the duration, the larger the corresponding warning range.

19. An electronic device comprising: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 9.

20. A non-transitory computer-readable storage medium storing computer instructions, wherein: The computer instructions are used to cause the computer to execute the method according to any one of claims 1-9.

21. A computer program product comprising a computer program, which, when executed by a processor, implements the method according to any one of claims 1 to 9.

Images