Fault analysis method and device based on large model, computer equipment and readable storage medium

Abstract

The invention relates to a fault analysis method and device based on a large model, computer equipment and a computer readable storage medium. The method comprises the following steps: receiving fault information; retrieving the initial analysis data to obtain target analysis data corresponding to the fault information; inputting the target analysis data into a pre-trained large model, and generating call chain atlas information and key index information corresponding to the fault information, the call chain atlas information is generated by the large model based on a tracking identifier of a call chain corresponding to each piece of initial analysis data and a stage identifier of each stage in the call chain; the key index information is obtained by performing performance analysis and anomaly detection on each stage in the call chain through the large model. According to the method, a large model technology is applied to the field of fault analysis and early warning, so that the stability and the operation and maintenance efficiency of the system are improved.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence technology, and in particular to a fault analysis method, apparatus, computer equipment and computer-readable storage medium based on a large model. Background Art

[0002] With the widespread use of cloud computing and microservice architecture, complex applications are composed of a large number of interdependent microservices. When an application fails or anomalies occur, traditional fault location methods often have difficulty in quickly and accurately determining the root cause because there may be multiple related microservices and components. Traditional monitoring and log analysis tools provide a large amount of data, but lack a comprehensive understanding of the interaction between business logic and microservices, resulting in inefficient fault analysis and increased false positives.

[0003] In recent years, artificial intelligence and big data technologies have made significant progress, especially large models (such as GPT, Bloom) have shown strong performance in many fields such as natural language processing and image recognition. The Bloom language model is a deep learning network architecture based on the self-attention mechanism. It has powerful language understanding and generation capabilities and can capture more data features and patterns.

[0004] Despite the significant progress made in artificial intelligence and big data technologies, traditional monitoring and alarm systems still dominate in application system failure analysis and early warning. The application of big model technology in system failure analysis and early warning is still in the exploratory stage, and there is great potential for development and application. Therefore, there is an urgent need for a solution that can apply big model technology to the field of failure analysis and early warning to improve system stability and operation and maintenance efficiency. Summary of the invention

[0005] Based on this, it is necessary to provide a big model-based fault analysis method, device, computer equipment and computer-readable storage medium that can apply big model technology to the field of fault analysis and early warning to improve the stability and operation and maintenance efficiency of the system in response to the above technical problems.

[0006] In a first aspect, the present application provides a fault analysis method based on a large model, the method comprising:

[0007] Receive fault information;

[0008] Retrieving initial analysis data to obtain target analysis data corresponding to the fault information;

[0009] The target analysis data is input into a pre-trained big model to generate call chain graph information and key indicator information corresponding to the fault information. The call chain graph information is generated by the big model based on the tracking identifiers of the call chains corresponding to the initial analysis data and the stage identifiers of each stage in the call chain. The key indicator information is obtained by performing performance analysis and anomaly detection on each stage in the call chain through the big model.

[0010] In one embodiment, the method further comprises:

[0011] Determine the call chain to be analyzed based on the call chain graph information and the key indicator information;

[0012] Determine the dimensions and parameters of the drill-down analysis corresponding to the call chain to be analyzed;

[0013] The large model is used to analyze the call chain to be analyzed based on the dimensions and parameters of the drill-down analysis to obtain the drill-down analysis results and the result explanation and optimization suggestions corresponding to the drill-down analysis results;

[0014] The drill-down analysis results are displayed in a visual manner, and result explanations and optimization suggestions corresponding to the drill-down analysis results are output.

[0015] In one embodiment, determining the dimension and parameter of the drill-down analysis corresponding to the call chain to be analyzed includes:

[0016] Output the dimensions and parameters corresponding to the call chain to be analyzed;

[0017] A selection instruction for the dimensions and parameters is received through a user interface or an interface, and the dimensions and parameters for the drill-down analysis corresponding to the call chain to be analyzed are determined based on the selection instruction.

[0018] In one embodiment, the method further comprises:

[0019] Acquiring source analysis data, and preprocessing the source analysis data to obtain initial analysis data;

[0020] Annotating the initial analysis data to obtain annotated call chain data and business analysis data;

[0021] Based on the labeled call chain data and business analysis data, as well as the pre-defined big model processes and tasks, the big model is trained to obtain a trained big model.

[0022] In one embodiment, the method further comprises:

[0023] Obtain system module information corresponding to each business system;

[0024] Perform call chain analysis based on the system module information to obtain a call chain corresponding to each business;

[0025] Processing the dimensions and parameters of the drill-down analysis based on the system module information to obtain the dimensions and parameters of the drill-down analysis corresponding to each call chain;

[0026] The marking of the initial analysis data to obtain the marked call chain data and business analysis data includes:

[0027] Based on the call chains and the dimensions and parameters of the drill-down analysis corresponding to the call chains, the initial analysis data is annotated to obtain annotated call chain data and business analysis data.

[0028] In one embodiment, the method further comprises:

[0029] Output the call chain graph information and key indicator information;

[0030] receiving an expert adjustment instruction for the call chain graph information and the key indicator information, and adjusting the call chain graph information and the key indicator information based on the expert adjustment instruction;

[0031] The fault analysis result is obtained based on the adjusted call chain graph information and key indicator information.

[0032] In one embodiment, the labeling of the initial analysis data to obtain the labeled call chain data and business analysis data further includes:

[0033] Based on the adjusted call chain graph information and key indicator information, the annotated call chain data and business analysis data are updated.

[0034] In a second aspect, the present application further provides a fault analysis device based on a large model, the device comprising:

[0035] A receiving module, used for receiving fault information;

[0036] A retrieval module, used to retrieve initial analysis data to obtain target analysis data corresponding to the fault information;

[0037] A fault analysis module is used to input the target analysis data into a pre-trained large model to generate call chain graph information and key indicator information corresponding to the fault information. The call chain graph information is generated by the large model based on the tracking identifiers of the call chains corresponding to each of the initial analysis data and the stage identifiers of each stage in the call chain. The key indicator information is obtained by performing performance analysis and anomaly detection on each stage in the call chain through the large model.

[0038] In a third aspect, the present application further provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the above method when executing the computer program.

[0039] In a fourth aspect, the present application also provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program implements the steps of the above method when executed by a processor.

[0040] The above-mentioned big model-based fault analysis method, device, computer equipment and computer-readable storage medium, after receiving fault information, first retrieve the target analysis data corresponding to the fault information, and then use the big model to analyze the target analysis data to obtain the call chain graph information and key indicator information corresponding to the fault information. Specifically, the call chain graph information is generated by the big model based on the tracking identifier of the call chain corresponding to each of the initial analysis data and the stage identifier of each stage in the call chain. The key indicator information is obtained by performing performance analysis and anomaly detection on each stage in the call chain through the big model. In this way, the big model technology can be applied to the field of fault analysis and early warning to improve the stability and operation and maintenance efficiency of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0042] Figure 1 is an application environment diagram of a fault analysis method based on a large model in one embodiment;

[0043] Figure 2 A schematic diagram of a process of a fault analysis method based on a large model in an embodiment;

[0044] Figure 3 A schematic diagram of a flow chart of a fault analysis method based on a large model in another embodiment;

[0045] Figure 4 A flowchart of a model training step in one embodiment;

[0046] Figure 5 A flowchart of a model training step in another embodiment;

[0047] Figure 6is a structural block diagram of a fault analysis device based on a large model in one embodiment;

[0048] Figure 7 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0049] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0050] The large model-based fault analysis method provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown, the terminal 102 communicates with the server 104 through a network. The data storage system can store data that the server 104 needs to process. The data storage system can be integrated on the server 104, or placed on the cloud or other network servers.

[0051] Terminal 102 can receive fault information and send it to server 104. Server 104 retrieves initial analysis data to obtain target analysis data corresponding to the fault information. The target analysis data is input into the pre-trained big model to generate call chain graph information and key indicator information corresponding to the fault information. The call chain graph information is generated by the big model based on the tracking identifier of the call chain corresponding to each initial analysis data and the stage identifier of each stage in the call chain. The key indicator information is obtained by the big model performing performance analysis and anomaly detection on each stage in the call chain. In this way, the big model technology can be applied to the field of fault analysis and early warning to improve the stability and operation and maintenance efficiency of the system.

[0052] The terminal 102 may be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, IoT devices, and portable wearable devices. The IoT devices may be smart speakers, smart TVs, smart air conditioners, smart car devices, projection devices, etc. Portable wearable devices may be smart watches, smart bracelets, head-mounted devices, etc. Head-mounted devices may be virtual reality (VR) devices, augmented reality (AR) devices, smart glasses, etc. The server 104 may be an independent physical server, a server cluster or distributed system consisting of multiple physical servers, or a cloud server that provides cloud computing services.

[0053] In an exemplary embodiment, Figure 2 As shown in the figure, a fault analysis method based on a large model is provided. Figure 1The server in the example is used to illustrate, including the following steps 202 to 206. Among them:

[0054] S202: Receive fault information.

[0055] Fault information can be understood as fault description information, which can be expressed in natural language.

[0056] S204: Retrieve initial analysis data to obtain target analysis data corresponding to the fault information.

[0057] The initial analysis data is obtained after cleaning the data of the data source. Optionally, the server may include a data source connection module and a preprocessing module. The data source connection module is responsible for connecting and collecting data with various data sources (such as monitoring logs, API call logs, etc.) in the distributed system. The preprocessing module cleans, converts and aggregates the collected raw data to form a data format suitable for model processing.

[0058] Compare the fault information with the initial analysis data to obtain target analysis data that matches the fault information.

[0059] Optionally, in other embodiments, all fault information can be analyzed, so that various types of data such as monitoring logs and API call logs are collected from the distributed system only when needed. Then the preprocessing module performs comprehensive and detailed cleaning, precise conversion, and efficient aggregation on the collected raw data, and accurately extracts key information closely related to the call chain and multi-dimensional drill-down analysis as the target analysis data. Therefore, this application supports the analysis of all fault information, and also supports the analysis of single or multiple fault information specified by the user.

[0060] Log collection can be achieved by using ELK and Prometheus. ELK (Elasticsearch, Logstash, Kibana) is a solution for log collection, storage, retrieval, and visualization. Prometheus is an open source system monitoring and alert toolkit for storing and analyzing time series data.

[0061] S206: Input the target analysis data into the pre-trained big model to generate call chain graph information and key indicator information corresponding to the fault information. The call chain graph information is generated by the big model based on the tracking identifier of the call chain corresponding to each initial analysis data and the stage identifier of each stage in the call chain. The key indicator information is obtained by performing performance analysis and anomaly detection on each stage in the call chain through the big model.

[0062] The pre-trained large model can be trained based on the Bloom model, GPT model or LangChain model. The specific model training process can be found below. Bloom model: Bloom is a deep learning model based on the self-attention mechanism. It has powerful text understanding and generation capabilities and can capture complex data patterns and relationships. The Bloom model is usually used in natural language processing (NLP) tasks such as text classification, sentiment analysis, machine translation, etc. GPT (Generative Pre-trained Transformer): GPT is a pre-trained generative model, also based on the self-attention mechanism. It performs well in a variety of NLP tasks, including but not limited to text generation, summarization, question and answer, etc. The GPT model has a strong transfer learning ability through a large amount of data pre-training. LangChain: It provides a variety of modules and components, such as LLM, ChatModel, PromptTemplate, OutputParser, etc. Through these functions, LangChain can be used in a variety of application scenarios such as intelligent customer service, text generation, and knowledge graph construction.

[0063] Among them, call trace (Call Trace / Trace) is a technology used to track the mutual call relationship between services in microservices or distributed systems. Through the call chain, you can clearly understand which services or components a request passes through from the beginning to the end.

[0064] The call chain graph information in this application is generated by the big model based on the tracking identifiers of the call chains corresponding to each initial analysis data and the stage identifiers of each stage in the call chain. Specifically, the big model connects the complete call chain in the distributed system based on key information such as the tracking identifier TraceID and the stage identifier SpanID. The big model is used to perform comprehensive performance analysis and anomaly detection on the call chain, accurately identify performance bottlenecks and abnormal call situations, and obtain key indicator information.

[0065] The above-mentioned fault analysis method based on the big model, after receiving the fault information, first retrieves the target analysis data corresponding to the fault information, and then uses the big model to analyze the target analysis data to obtain the call chain graph information and key indicator information corresponding to the fault information. Specifically, the call chain graph information is generated by the big model based on the tracking identifier of the call chain corresponding to each initial analysis data and the stage identifier of each stage in the call chain. The key indicator information is obtained by performing performance analysis and anomaly detection on each stage in the call chain through the big model. In this way, the big model technology can be applied to the field of fault analysis and early warning to improve the stability and operation and maintenance efficiency of the system.

[0066] In one of the optional embodiments, the method also includes: determining the call chain to be analyzed based on the call chain graph information and the key indicator information; determining the dimensions and parameters of the drill-down analysis corresponding to the call chain to be analyzed; analyzing the call chain to be analyzed based on the dimensions and parameters of the drill-down analysis through the big model to obtain the drill-down analysis results and the result explanations and optimization suggestions corresponding to the drill-down analysis results; displaying the drill-down analysis results in a visual manner, and outputting the result explanations and optimization suggestions corresponding to the drill-down analysis results.

[0067] Among them, the call chain to be analyzed can be selected by the user or automatically determined by the system according to the rules. The determined rules can be configured by the user, so that the call chain to be analyzed can be selected from the output call chain graph information, wherein the call chain to be analyzed is a call chain that may have faults. Therefore, the above rules can include identification rules for faulty call chains. Since the corresponding dimensions and parameters of the drill-down analysis of each call chain are determined in advance, the large model can be called directly based on the dimensions and parameters of the drill-down analysis automatically determined by the system to analyze the call chain to be analyzed to obtain the drill-down analysis results and the result explanations and optimization suggestions corresponding to the drill-down analysis results.

[0068] In one of the optional embodiments, determining the dimensions and parameters of the drill-down analysis corresponding to the call chain to be analyzed includes: outputting the dimensions and parameters corresponding to the call chain to be analyzed; receiving selection instructions for the dimensions and parameters through a user interface or interface, and determining the dimensions and parameters of the drill-down analysis corresponding to the call chain to be analyzed based on the selection instructions.

[0069] Specifically, after determining the call chain to be analyzed, the call chain to be analyzed can be output, and then the dimensions and parameters of the drill-down analysis corresponding to the call chain to be analyzed can be output, so that the user can select the dimensions and parameters for drill-down analysis as needed, and finally call the big model to analyze the call chain to be analyzed to obtain the drill-down analysis results and the result explanations and optimization suggestions corresponding to the drill-down analysis results.

[0070] Specifically, the big model agent identifies possible faults in the call chain and intelligently selects the call chain for analysis. Users can also select the dimensions and parameters that need to be drilled down for analysis as needed through the user interface or API interface provided by the big model agent. The big model agent uses the big model to perform multi-dimensional drill-down analysis on the call chain data and generate detailed analysis results.

[0071] The visualization method is to improve the readability of the results. The large model presents the analysis results to users in an intuitive and visual way, such as call chain graphs, performance indicator reports, drill-down analysis results, etc. At the same time, it provides a result interpretation function to help users deeply understand the analysis results and formulate corresponding optimization strategies.

[0072] For ease of understanding, combined Figure 3 As shown, data collection is first performed, that is, monitoring logs, API call logs and other data are collected from the distributed system in real time, and then the collected data is preprocessed to accurately extract key information closely related to the call chain and multi-dimensional drill-down analysis. The large model is then called to perform call chain analysis, and the call chain is connected in series based on key information. Performance analysis and anomaly detection are performed based on the call chain. Multi-dimensional drill-down analysis is then performed, including user selection of dimensions and parameters, and drill-down analysis through the large model. After the results are obtained, they are displayed. The result display includes visually displaying the results, and providing result explanations and optimization suggestions.

[0073] In the above embodiments, the call chain analysis algorithm is combined with the intelligent fault analysis of the large model to efficiently identify business associations and component dependencies, achieve accurate modeling and analysis, and have a unique multi-dimensional drill-down strategy, providing fast and accurate fault location capabilities, greatly reducing the troubleshooting time and false alarm rate. Based on the intelligent fault analysis of the large model, the large model has powerful learning and reasoning capabilities, which helps to accurately locate the root cause of the fault and optimize the fault analysis process. This greatly improves the speed and accuracy of fault location, shortens the business recovery time, reduces losses, and reduces redundant information interference, allowing operation and maintenance and developers to focus on key issues and significantly improve system operation and maintenance efficiency. With the interactive capabilities of the large model, the fault analysis process is continuously optimized and improved to adapt to the changing business environment, and compared with the traditional machine learning method, it has stronger flexibility and availability and can better deal with complex faults. Provide strong guarantees for the stable operation of the cloud computing microservice architecture, enhance system reliability and stability, reduce business interruptions and customer complaints, and improve the company's IT operation and maintenance level and user experience.

[0074] Based on machine learning and deep learning technologies, we design and train intelligent large-model agents suitable for large-scale complex systems. This large-model agent can monitor and analyze call chain data in real time and quickly identify abnormal patterns and root causes of failures. By monitoring and analyzing call chains in applications, we can identify and model business associations and dependencies between microservices. We combine graph theory and artificial skills technology to build dynamic business models.

[0075] In one of the optional embodiments, in combination Figure 4 As shown, Figure 4 Flow chart of a model training step in one embodiment, the method further includes a model training step, the model training step includes:

[0076] S402: Acquire source analysis data, and pre-process the source analysis data to obtain initial analysis data.

[0077] The source analysis data is obtained from the data source, which can be historical data. For example, the data source connection module is responsible for connecting and collecting data with various data sources in the distributed system (such as monitoring logs, API call logs, etc.). The preprocessing module cleans, converts and aggregates the collected raw data to form a data format suitable for model processing, which is the initial analysis data.

[0078] S404: Annotate the initial analysis data to obtain annotated call chain data and business analysis data.

[0079] S406: Based on the annotated call chain data and business analysis data, as well as the pre-defined big model processes and tasks, the big model is trained to obtain a trained big model.

[0080] In this application, a large language model (LLM) is selected as the core reasoning engine, such as the GPT series or Bloom. The model is trained using labeled call chain data and business analysis data so that it can accurately understand and process tasks related to call chains and multi-dimensional drill-down analysis.

[0081] In one of the optional embodiments, the method also includes: obtaining system module information corresponding to each business system; performing call chain analysis based on the system module information to obtain the call chain corresponding to each business; performing dimension and parameter processing of drill-down analysis based on the system module information to obtain the dimension and parameters of drill-down analysis corresponding to each call chain; annotating the initial analysis data to obtain annotated call chain data and business analysis data, including: annotating the initial analysis data based on each call chain and the dimension and parameters of the drill-down analysis corresponding to each call chain to obtain annotated call chain data and business analysis data.

[0082] Combination Figure 5 As shown in the figure, the large model Agent integrates the call chain analysis function, and connects the complete call chain in the distributed system through key information such as TraceID and SpanID. The reasoning ability of the large model is used to analyze key information such as performance bottlenecks and abnormal calls in the call chain. The large model Agent uses the Retrievers function of LangChain to retrieve call chain data related to the input information from the preprocessed data, and passes the retrieved data to the trained large model through the Chains module of LangChain for reasoning analysis to generate a call chain map and key indicator report.

[0083] The large model Agent supports multi-dimensional drill-down analysis, allowing users to select different dimensions (such as time, service, interface, etc.) to conduct in-depth analysis of call chain data according to business needs. Users can enter natural language descriptions or select relevant parameters through the Agent interface provided by LangChain to trigger the drill-down analysis function. Through the reasoning and aggregation capabilities of the large model, drill-down analysis results can be quickly generated, such as the call status of a service in a specific time period, the call frequency of a certain interface, etc.

[0084] In the above embodiment, when an anomaly is detected, the intelligent big model agent can quickly perform multi-dimensional drill-down analysis to locate the specific microservice or component that caused the failure, and provide real-time solution suggestions through the automated decision model and rule engine.

[0085] In one of the optional embodiments, the method also includes: outputting call chain graph information and key indicator information; receiving expert adjustment instructions for the call chain graph information and key indicator information, and adjusting the call chain graph information and key indicator information based on the expert adjustment instructions; and obtaining fault analysis results based on the adjusted call chain graph information and key indicator information.

[0086] In order to ensure the accuracy of fault analysis results, when there are errors or challenges in fault location, the intelligent large model agent can interact with expert experience to adjust the analysis direction and optimize the subsequent in-depth analysis process, thereby improving the accuracy and efficiency of fault location.

[0087] Specifically, after outputting the call chain graph information and key indicator information, an expert adjustment instruction can be received to adjust the call chain graph information and key indicator information through the expert adjustment instruction to obtain accurate fault analysis results. This not only improves processing efficiency with the help of a large model, but also improves accuracy with the help of expert intervention.

[0088] In one of the optional embodiments, the initial analysis data is annotated to obtain annotated call chain data and business analysis data, and also includes: updating the annotated call chain data and business analysis data based on the adjusted call chain graph information and key indicator information.

[0089] In this embodiment, the call chain graph information and key indicator information adjusted by the experts can be utilized, that is, used for the subsequent generation of the big model. Specifically, the labeled call chain data and business analysis data are updated based on the call chain graph information and key indicator information adjusted by the experts, so that the big model can be updated subsequently. The update of the big model utilizes the updated labeled call chain data and business analysis data, thereby making the prediction results of the big model more and more accurate.

[0090] In the above embodiment, the intelligent large model Agent can interact with expert experience to adjust the analysis direction and optimize the subsequent in-depth analysis process, thereby improving the accuracy and efficiency of fault location.

[0091] In summary, this application can quickly identify and analyze complex business associations and component dependencies by building a large model Agent. This method can not only quickly locate the root cause when a fault occurs, but also reduce redundant information generated by multiple businesses alerting at the same time, improving operation and development efficiency. At the same time, by utilizing the interactive capabilities of the large model and combining expert experience to make effective adjustments and in-depth analysis, we can further optimize fault location and solution proposals.

[0092] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0093] Based on the same inventive concept, the embodiment of the present application also provides a large model-based fault analysis device for implementing the large model-based fault analysis method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more large model-based fault analysis device embodiments provided below can refer to the limitations of the large model-based fault analysis method above, and will not be repeated here.

[0094] In an exemplary embodiment, Figure 6 As shown, a fault analysis device based on a large model is provided, comprising: a receiving module 601, a retrieval module 602 and a fault analysis module 603, wherein:

[0095] Receiving module 601, used for receiving fault information;

[0096] A retrieval module 602 is used to retrieve initial analysis data to obtain target analysis data corresponding to the fault information;

[0097] The fault analysis module 603 is used to input the target analysis data into the pre-trained big model to generate call chain graph information and key indicator information corresponding to the fault information. The call chain graph information is generated by the big model based on the tracking identifier of the call chain corresponding to each initial analysis data and the stage identifier of each stage in the call chain. The key indicator information is obtained by performing performance analysis and anomaly detection on each stage in the call chain through the big model.

[0098] In one of the optional embodiments, the above-mentioned device also includes: a drill-down analysis module, which is used to determine the call chain to be analyzed based on the call chain graph information and the key indicator information; determine the dimensions and parameters of the drill-down analysis corresponding to the call chain to be analyzed; analyze the call chain to be analyzed based on the dimensions and parameters of the drill-down analysis through the big model to obtain the drill-down analysis results and the result explanation and optimization suggestions corresponding to the drill-down analysis results; display the drill-down analysis results in a visual manner, and output the result explanation and optimization suggestions corresponding to the drill-down analysis results.

[0099] In one of the optional embodiments, the above-mentioned drill-down analysis module is specifically used to output dimensions and parameters corresponding to the call chain to be analyzed; receive selection instructions for dimensions and parameters through a user interface or interface, and determine the dimensions and parameters of the drill-down analysis corresponding to the call chain to be analyzed based on the selection instructions.

[0100] In one of the optional embodiments, the above-mentioned device also includes: a training module, which is used to obtain source analysis data and pre-process the source analysis data to obtain initial analysis data; annotate the initial analysis data to obtain annotated call chain data and business analysis data; based on the annotated call chain data and business analysis data, as well as the pre-defined big model processes and tasks, perform big model training to obtain a trained big model.

[0101] In one of the optional embodiments, the device further includes: a drill-down dimension and parameter determination module, which is used to obtain system module information corresponding to each business system; perform call chain analysis based on the system module information to obtain a call chain corresponding to each business; perform drill-down analysis dimension and parameter processing based on the system module information to obtain a drill-down analysis dimension and parameter corresponding to each call chain;

[0102] The above training module is also specifically used to annotate the initial analysis data based on each call chain and the dimensions and parameters of the drill-down analysis corresponding to each call chain, so as to obtain the annotated call chain data and business analysis data.

[0103] In one of the optional embodiments, the above-mentioned device also includes: an expert adjustment module, which is used to output call chain graph information and key indicator information; receive expert adjustment instructions for the call chain graph information and key indicator information, and adjust the call chain graph information and key indicator information based on the expert adjustment instructions; obtain fault analysis results based on the adjusted call chain graph information and key indicator information.

[0104] In one of the optional embodiments, the above-mentioned training module is also specifically used to update the annotated call chain data and business analysis data based on the adjusted call chain graph information and key indicator information.

[0105] Each module in the above-mentioned large model-based fault analysis device can be implemented in whole or in part by software, hardware, or a combination thereof. Each of the above-mentioned modules can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute the operations corresponding to each of the above modules.

[0106] In an exemplary embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. Figure 7 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a fault analysis method based on a large model is implemented.

[0107] Those skilled in the art will understand that Figure 7 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0108] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the following steps when executing the computer program: receiving fault information; retrieving initial analysis data to obtain target analysis data corresponding to the fault information; inputting the target analysis data into a pre-trained large model to generate call chain graph information and key indicator information corresponding to the fault information, wherein the call chain graph information is generated by the large model based on the tracking identifier of the call chain corresponding to each initial analysis data and the stage identifier of each stage in the call chain, and the key indicator information is obtained by performing performance analysis and anomaly detection on each stage in the call chain through the large model.

[0109] In one embodiment, when the processor executes the computer program, the following steps are also implemented: determining the call chain to be analyzed based on the call chain graph information and the key indicator information; determining the dimensions and parameters of the drill-down analysis corresponding to the call chain to be analyzed; analyzing the call chain to be analyzed based on the dimensions and parameters of the drill-down analysis through the large model to obtain the drill-down analysis results and the result explanations and optimization suggestions corresponding to the drill-down analysis results; displaying the drill-down analysis results in a visual manner, and outputting the result explanations and optimization suggestions corresponding to the drill-down analysis results.

[0110] In one embodiment, the determination of dimensions and parameters of a drill-down analysis corresponding to a call chain to be analyzed implemented when a processor executes a computer program includes: outputting dimensions and parameters corresponding to the call chain to be analyzed; receiving selection instructions for dimensions and parameters through a user interface or interface, and determining the dimensions and parameters of the drill-down analysis corresponding to the call chain to be analyzed based on the selection instructions.

[0111] In one embodiment, when the processor executes the computer program, it also implements the following steps: obtaining source analysis data, and preprocessing the source analysis data to obtain initial analysis data; annotating the initial analysis data to obtain annotated call chain data and business analysis data; based on the annotated call chain data and business analysis data, as well as the pre-defined big model processes and tasks, performing big model training to obtain a trained big model.

[0112] In one embodiment, the processor further implements the following steps when executing the computer program: obtaining system module information corresponding to each business system; performing call chain analysis based on the system module information to obtain the call chain corresponding to each business; performing dimension and parameter processing of drill-down analysis based on the system module information to obtain the dimension and parameters of drill-down analysis corresponding to each call chain; the processor implements the labeling of initial analysis data when executing the computer program to obtain labeled call chain data and business analysis data, including: labeling the initial analysis data based on each call chain and the dimension and parameters of the drill-down analysis corresponding to each call chain to obtain labeled call chain data and business analysis data.

[0113] In one embodiment, when the processor executes the computer program, it also implements the following steps: outputting call chain graph information and key indicator information; receiving expert adjustment instructions for the call chain graph information and key indicator information, and adjusting the call chain graph information and key indicator information based on the expert adjustment instructions; and obtaining fault analysis results based on the adjusted call chain graph information and key indicator information.

[0114] In one embodiment, the processor executes a computer program to annotate the initial analysis data to obtain annotated call chain data and business analysis data, and also includes: updating the annotated call chain data and business analysis data based on adjusted call chain graph information and key indicator information.

[0115] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the following steps are implemented: receiving fault information; retrieving initial analysis data to obtain target analysis data corresponding to the fault information; inputting the target analysis data into a pre-trained large model to generate call chain graph information and key indicator information corresponding to the fault information. The call chain graph information is generated by the large model based on the tracking identifiers of the call chains corresponding to each initial analysis data and the stage identifiers of each stage in the call chain. The key indicator information is obtained by performing performance analysis and anomaly detection on each stage in the call chain through the large model.

[0116] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: determining the call chain to be analyzed based on the call chain graph information and the key indicator information; determining the dimensions and parameters of the drill-down analysis corresponding to the call chain to be analyzed; analyzing the call chain to be analyzed based on the dimensions and parameters of the drill-down analysis through the big model to obtain the drill-down analysis results and the result explanations and optimization suggestions corresponding to the drill-down analysis results; displaying the drill-down analysis results in a visual manner, and outputting the result explanations and optimization suggestions corresponding to the drill-down analysis results.

[0117] In one embodiment, the computer program implemented when executed by a processor to determine the dimensions and parameters of the drill-down analysis corresponding to the call chain to be analyzed includes: outputting the dimensions and parameters corresponding to the call chain to be analyzed; receiving selection instructions for the dimensions and parameters through a user interface or interface, and determining the dimensions and parameters of the drill-down analysis corresponding to the call chain to be analyzed based on the selection instructions.

[0118] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: acquiring source analysis data, and preprocessing the source analysis data to obtain initial analysis data; annotating the initial analysis data to obtain annotated call chain data and business analysis data; and training the big model based on the annotated call chain data and business analysis data, as well as the predefined big model processes and tasks, to obtain a trained big model.

[0119] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: obtaining system module information corresponding to each business system; performing call chain analysis based on the system module information to obtain the call chain corresponding to each business; performing dimension and parameter processing of drill-down analysis based on the system module information to obtain the dimension and parameters of drill-down analysis corresponding to each call chain; the computer program implemented when the processor is executed is labeled with the initial analysis data to obtain labeled call chain data and business analysis data, including: labeling the initial analysis data based on each call chain and the dimension and parameters of the drill-down analysis corresponding to each call chain to obtain labeled call chain data and business analysis data.

[0120] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: outputting call chain graph information and key indicator information; receiving expert adjustment instructions for the call chain graph information and key indicator information, and adjusting the call chain graph information and key indicator information based on the expert adjustment instructions; and obtaining fault analysis results based on the adjusted call chain graph information and key indicator information.

[0121] In one embodiment, the computer program implemented when executed by the processor labels the initial analysis data to obtain labeled call chain data and business analysis data, and also includes: updating the labeled call chain data and business analysis data based on the adjusted call chain graph information and key indicator information.

[0122] In one embodiment, a computer program product is provided, including a computer program, which implements the following steps when executed by a processor: receiving fault information; retrieving initial analysis data to obtain target analysis data corresponding to the fault information; inputting the target analysis data into a pre-trained large model to generate call chain graph information and key indicator information corresponding to the fault information, wherein the call chain graph information is generated by the large model based on the tracking identifiers of the call chains corresponding to each initial analysis data and the stage identifiers of each stage in the call chain, and the key indicator information is obtained by performing performance analysis and anomaly detection on each stage in the call chain through the large model.

[0123] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: determining the call chain to be analyzed based on the call chain graph information and the key indicator information; determining the dimensions and parameters of the drill-down analysis corresponding to the call chain to be analyzed; analyzing the call chain to be analyzed based on the dimensions and parameters of the drill-down analysis through the big model to obtain the drill-down analysis results and the result explanations and optimization suggestions corresponding to the drill-down analysis results; displaying the drill-down analysis results in a visual manner, and outputting the result explanations and optimization suggestions corresponding to the drill-down analysis results.

[0124] In one embodiment, the computer program implemented when executed by a processor to determine the dimensions and parameters of the drill-down analysis corresponding to the call chain to be analyzed includes: outputting the dimensions and parameters corresponding to the call chain to be analyzed; receiving selection instructions for the dimensions and parameters through a user interface or interface, and determining the dimensions and parameters of the drill-down analysis corresponding to the call chain to be analyzed based on the selection instructions.

[0125] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: acquiring source analysis data, and preprocessing the source analysis data to obtain initial analysis data; annotating the initial analysis data to obtain annotated call chain data and business analysis data; and training the big model based on the annotated call chain data and business analysis data, as well as the predefined big model processes and tasks, to obtain a trained big model.

[0126] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: obtaining system module information corresponding to each business system; performing call chain analysis based on the system module information to obtain the call chain corresponding to each business; performing dimension and parameter processing of drill-down analysis based on the system module information to obtain the dimension and parameters of drill-down analysis corresponding to each call chain; the computer program implemented when the processor is executed is labeled with the initial analysis data to obtain labeled call chain data and business analysis data, including: labeling the initial analysis data based on each call chain and the dimension and parameters of the drill-down analysis corresponding to each call chain to obtain labeled call chain data and business analysis data.

[0127] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: outputting call chain graph information and key indicator information; receiving expert adjustment instructions for the call chain graph information and key indicator information, and adjusting the call chain graph information and key indicator information based on the expert adjustment instructions; and obtaining fault analysis results based on the adjusted call chain graph information and key indicator information.

[0128] In one embodiment, the computer program implemented when executed by the processor labels the initial analysis data to obtain labeled call chain data and business analysis data, and also includes: updating the labeled call chain data and business analysis data based on the adjusted call chain graph information and key indicator information.

[0129] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0130] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0131] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0132] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A fault analysis method based on a large model, characterized in that: The method comprises: Receive fault information; Retrieving initial analysis data to obtain target analysis data corresponding to the fault information; The target analysis data is input into a pre-trained big model to generate call chain graph information and key indicator information corresponding to the fault information. The call chain graph information is generated by the big model based on the tracking identifiers of the call chains corresponding to the initial analysis data and the stage identifiers of each stage in the call chain. The key indicator information is obtained by performing performance analysis and anomaly detection on each stage in the call chain through the big model.

2. The method according to claim 1, characterized in that The method further comprises: Determine the call chain to be analyzed based on the call chain graph information and the key indicator information; Determine the dimensions and parameters of the drill-down analysis corresponding to the call chain to be analyzed; The large model is used to analyze the call chain to be analyzed based on the dimensions and parameters of the drill-down analysis to obtain the drill-down analysis results and the result explanation and optimization suggestions corresponding to the drill-down analysis results; The drill-down analysis results are displayed in a visual manner, and result explanations and optimization suggestions corresponding to the drill-down analysis results are output.

3. The method according to claim 2, characterized in that The determining of the dimensions and parameters of the drill-down analysis corresponding to the call chain to be analyzed includes: Output the dimensions and parameters corresponding to the call chain to be analyzed; A selection instruction for the dimensions and parameters is received through a user interface or an interface, and the dimensions and parameters for the drill-down analysis corresponding to the call chain to be analyzed are determined based on the selection instruction.

4. The method according to any one of claims 1 to 3, characterized in that: The method further comprises: Acquiring source analysis data, and preprocessing the source analysis data to obtain initial analysis data; Annotating the initial analysis data to obtain annotated call chain data and business analysis data; Based on the labeled call chain data and business analysis data, as well as the pre-defined big model processes and tasks, the big model is trained to obtain a trained big model.

5. The method according to claim 4, characterized in that The method further comprises: Obtain system module information corresponding to each business system; Perform call chain analysis based on the system module information to obtain a call chain corresponding to each business; Processing the dimensions and parameters of the drill-down analysis based on the system module information to obtain the dimensions and parameters of the drill-down analysis corresponding to each call chain; The marking of the initial analysis data to obtain the marked call chain data and business analysis data includes: Based on the call chains and the dimensions and parameters of the drill-down analysis corresponding to the call chains, the initial analysis data is annotated to obtain annotated call chain data and business analysis data.

6. The method according to claim 4, characterized in that The method further comprises: Output the call chain graph information and key indicator information; Receiving an expert adjustment instruction for the call chain graph information and the key indicator information, and adjusting the call chain graph information and the key indicator information based on the expert adjustment instruction; The fault analysis result is obtained based on the adjusted call chain graph information and key indicator information.

7. The method according to claim 6, characterized in that The labeling of the initial analysis data to obtain the labeled call chain data and business analysis data also includes: Based on the adjusted call chain graph information and key indicator information, the annotated call chain data and business analysis data are updated.

8. A fault analysis device based on a large model, characterized in that: The device comprises: A receiving module, used for receiving fault information; A retrieval module, used to retrieve initial analysis data to obtain target analysis data corresponding to the fault information; A fault analysis module is used to input the target analysis data into a pre-trained large model to generate call chain graph information and key indicator information corresponding to the fault information. The call chain graph information is generated by the large model based on the tracking identifiers of the call chains corresponding to each of the initial analysis data and the stage identifiers of each stage in the call chain. The key indicator information is obtained by performing performance analysis and anomaly detection on each stage in the call chain through the large model.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images