Fault detection method based on multi-modal attention mechanism

Abstract

The invention relates to a fault detection method based on a multi-modal attention mechanism. The method comprises the following steps: performing data fusion on multiple data sources in an IT system; wherein the multiple data sources comprise log data, monitoring data and user behavior data; inputting the fused data into a fault detection model to obtain a fault detection result; wherein the fault detection model is constructed based on a GRU neural network and a multi-head attention mechanism. According to the invention, by introducing the large language model, the GRU neural network, the multi-head attention mechanism and the multi-modal data fusion technology, the accuracy and reliability of system fault detection can be effectively improved.

Description

Technical Field

[0001] The present invention relates to the technical field of fault detection and diagnosis, and in particular to a fault detection method based on a multimodal attention mechanism. Background Art

[0002] With the development of modern information technology, complex IT systems have become an important pillar of enterprise and organizational operations. These systems are usually composed of multiple modules and components, including servers, databases, network equipment, etc. In order to ensure the stability and availability of the system, fault detection and abnormal log analysis have become key tasks to ensure the normal operation of the system. However, existing fault detection methods face many challenges in the practical application of complex systems and cannot fully meet actual needs. Existing methods often rely on a single data source (such as log data) or traditional machine learning models, and have problems such as insufficient detection accuracy, insufficient utilization of time series features, and poor model robustness. Therefore, an innovative fault detection method is urgently needed to improve the detection effect. Summary of the invention

[0003] The purpose of the present invention is to propose a fault detection method based on a multimodal attention mechanism, which effectively improves the comprehensiveness of fault detection, the ability to capture temporal features, the detection accuracy and the system robustness by combining multimodal data fusion, a large language model, a GRU neural network, a multi-head attention mechanism and a small sample tuning technology, so as to solve the problems existing in the above-mentioned prior art.

[0004] To achieve the above object, the present invention provides the following solutions:

[0005] A fault detection method based on a multimodal attention mechanism, comprising:

[0006] Perform data fusion on multiple data sources in the IT system; wherein the multiple data sources include: log data, monitoring data and user behavior data;

[0007] The fused data is input into the fault detection model to obtain the fault detection result; wherein, the fault detection model is constructed based on the GRU neural network and the multi-head attention mechanism.

[0008] Optionally, data fusion of multiple data sources in the IT system includes:

[0009] Extracting semantic features, template information, and timestamp information from the log data;

[0010] Extracting time series data of system performance indicators from the monitoring data;

[0011] Collecting statistics on user requests and interactive behaviors in the user behavior data to extract user operation mode features;

[0012] The feature information extracted from log data, monitoring data and user behavior data is integrated into a unified feature representation.

[0013] Optionally, inputting the fused data into a fault detection model includes:

[0014] Based on the GRU neural network, the fused data is modeled with time series features to obtain time series modeling features;

[0015] Based on the multi-head attention mechanism, the fused data and time series modeling features are subjected to fault behavior feature focusing processing to obtain fault behavior features.

[0016] Optionally, performing time series feature modeling on the fused data includes:

[0017] Through the recurrent structure of the GRU neural network, the temporal dependency relationship in the fused data is obtained;

[0018] Through the structure of the bidirectional GRU neural network, both the forward time series and the reverse time series can be processed simultaneously.

[0019] Optionally, performing fault behavior feature focusing processing on the fused data and time series modeling features includes:

[0020] Based on the multi-head attention mechanism, the attention weight between each input feature and other features in the time series modeling feature is calculated to identify features related to abnormal behavior; wherein the multi-head attention mechanism is embedded after the GRU layer and embedded between GRU layers;

[0021] Based on the attention score, the identified features are focused to obtain preset high-relevance features.

[0022] Optionally, extracting semantic features, template information, and timestamp information from the log data includes:

[0023] Preprocessing the log data;

[0024] Using a large language model, parsing the preprocessed log data to obtain the semantic features and timestamp information;

[0025] The template information is extracted by parsing the pattern of the log data.

[0026] Optionally, constructing the fault detection model includes:

[0027] A small sample tuning method is used to perform model training to obtain the fault detection model.

[0028] Optionally, a small sample tuning method is used to train the model including:

[0029] Pre-training the model using the unlabeled multiple data sources;

[0030] The pre-trained model is fine-tuned using the multiple data sources with a small amount of preset annotations.

[0031] The beneficial effects of the present invention are:

[0032] This invention improves the accuracy of system fault detection, sensitivity to time series and multimodal data, enhances the ability to focus on key features, adapts to small sample data scenarios, enhances the global understanding of complex systems, and reduces data and annotation costs. This technical solution provides a powerful solution for fault detection in modern complex IT systems, with strong innovation, practicality and market application prospects. The specific effects are as follows:

[0033] 1. The accuracy of fault detection is significantly improved

[0034] The present invention integrates data from multiple sources such as logs, monitoring data, and user behavior data through multi-data source data fusion technology to form a more comprehensive and multi-dimensional system perspective. This enables the system to capture the global characteristics of the system through multi-source information when a single data source cannot effectively reflect the system status, thereby enhancing the accuracy of fault detection. In addition, by introducing a large language model to perform semantic analysis on log data, the noise and redundant information in the log data are greatly reduced, key information is extracted, and the accuracy of the detection results is further improved.

[0035] 2. Enhanced fault identification capability for timing dependency

[0036] The GRU neural network is used to model the time series features in the system, especially the bidirectional GRU network, which considers the context information of the previous and next sequences at the same time, significantly improving the model's ability to identify abnormal patterns in time series data. For those fault modes that depend on the time context, the GRU neural network can more accurately identify abnormal events by capturing long-term and short-term dependencies, thus enhancing the model's ability to perceive fault modes in complex systems.

[0037] 3. Improved ability to focus on key features

[0038] By introducing a multi-head attention mechanism, the present invention can automatically identify and focus on key features related to faults in multimodal data with more redundancy and noise. This mechanism can effectively ignore irrelevant features and focus on potential abnormal patterns by calculating the attention weights of multiple subspaces in parallel, greatly reducing the impact of noise interference on fault detection results. The introduction of this mechanism allows the model to remain efficient when processing complex data, thereby improving detection accuracy.

[0039] 4. Adapt to the detection needs of small amounts of data scenarios

[0040] In many practical application scenarios, fault sample data is often scarce and the labeling cost is high. The present invention uses small sample tuning technology to quickly adapt to new fault detection tasks by fine-tuning the pre-trained model with a small amount of labeled data. This technology reduces the need for a large amount of labeled data, allowing the system to maintain a high detection accuracy rate even in the case of small samples, and has strong practicality and robustness.

[0041] 5. Increased sensitivity to abnormal patterns in complex systems

[0042] By combining multimodal data fusion and temporal feature modeling, the present invention can capture various types of abnormal patterns in complex IT systems. After fusing data from different sources, the system can perceive changes in system status from multiple dimensions, and the GRU neural network further enhances the ability to identify complex and hidden abnormal patterns by modeling temporal dependencies. This enables the system to effectively detect potential faults when faced with complex system structures and operating environments.

[0043] 6. Improved global understanding of system operation

[0044] Traditional fault detection technology is often limited to a single or a few data sources, but the present invention uses multimodal data fusion and large language model analysis technology to enable the system to monitor the system operation status from a global perspective. Through the comprehensive integration of multi-source data such as logs, monitoring, and user behavior, the system can better understand the global state changes in complex IT systems, have a more comprehensive system fault detection capability, and significantly improve the overall detection effect.

[0045] 7. Reduce the cost of model training and deployment

[0046] Since the present invention uses small sample tuning technology to fine-tune the model, it reduces the reliance on a large amount of fault annotation data, thereby reducing the cost of model training. In addition, the multimodal fusion architecture of the model enables the system to quickly adapt to different system environments and data sources, with high versatility and flexibility. This means that this technology can not only reduce the cost of data collection and annotation, but also accelerate the model training and deployment process, significantly improving the practicality of the application.

[0047] 8. Improved the generalization and robustness of the model

[0048] The present invention greatly improves the model's generalization ability for different types of abnormal patterns by combining a large language model, a GRU neural network, and a multi-head attention mechanism. In actual application scenarios, the system may face a variety of abnormal patterns and data environments. This fusion of multiple technologies enables the model to maintain efficient anomaly detection capabilities in a variety of scenarios. In addition, the model also has strong robustness and can adapt to complex environments with more noise and irrelevant data. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0050] Figure 1 A schematic flow chart of a fault detection method based on a multimodal attention mechanism according to an embodiment of the present invention. DETAILED DESCRIPTION

[0051] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0052] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0053] like Figure 1 As shown, this embodiment proposes a fault detection method based on a multimodal attention mechanism, including:

[0054] Data fusion of multiple data sources in IT systems, including log data, monitoring data, and user behavior data;

[0055] The fused data is input into the fault detection model to obtain the fault detection results; the fault detection model is built based on the GRU neural network and multi-head attention mechanism.

[0056] Specifically, in a large-scale distributed cloud platform, the system's log data, monitoring data, network traffic data, and user behavior data together constitute the multimodal data source of this embodiment. In this embodiment, multimodal data collection is first performed: system event logs are collected from the log management system, node resource usage (CPU, memory, disk, etc.) data is obtained from monitoring tools (such as Prometheus), traffic data is obtained from the network monitoring system, and user operation behavior logs are obtained from the user management system. Then, a large language model is used to parse the log: a pre-trained large language model (such as GPT) is used to perform semantic analysis on the collected log data, extract log templates and key events, and combine them with timestamp information to form structured data. Secondly, multimodal data fusion and feature extraction are performed: the above multimodal data is preprocessed and feature extracted, a unified multimodal feature representation is constructed, and combined with log template data. Then the time series model (GRU+multi-head attention mechanism) is input: the fused multimodal features are input into the GRU neural network, and the features at different time points are weighted by the multi-head attention mechanism, focusing on the information at the critical abnormal moment. Small sample tuning was also performed: in the initial deployment of the cloud platform, a small amount of historical failure data was used to fine-tune the model to adapt to the operating environment of the specific platform.

[0057] The purpose of this embodiment is: 1. Improve the comprehensiveness of system global state perception and fault detection: A core purpose of this embodiment is to introduce multimodal data fusion technology to integrate multi-source information such as log data, monitoring data, and user behavior data to comprehensively capture the global operating state of the system. This method can make up for the limitations of a single data source and enable the fault detection system to have richer contextual information, thereby improving detection coverage and reliability.

[0058] 2. Enhance the in-depth understanding of time series features: This embodiment introduces the GRU neural network to focus on improving the system's ability to process time series data. The GRU network can effectively capture the time series dependencies in logs and monitoring data, thereby more accurately identifying the time series features of abnormal behavior. At the same time, combined with the multi-head attention mechanism, this embodiment can focus on important time series features and ignore irrelevant or insignificant noise data, thereby significantly improving the accuracy of anomaly detection.

[0059] 3. Improve the generalization and robustness of the model: To solve the problem of insufficient generalization of the model in the prior art, this embodiment introduces a large language model for log template extraction, so that the model can extract high-quality semantic features from complex logs. Through the multi-head attention mechanism, the model can process information in different feature subspaces in parallel, avoid over-reliance on a single mode, and enhance the generalization ability of the model. In addition, this embodiment uses small sample tuning technology to enable the model to quickly adapt to different system environments, thereby improving the robustness of the system.

[0060] 4. Better capture of complex abnormal patterns: In view of the shortcomings of existing technologies that are difficult to identify complex abnormal patterns, this embodiment uses multimodal data fusion and large language model to parse log templates, combined with the deep time series modeling capabilities of GRU and multi-head attention mechanisms, so that the model can capture complex time series features and abnormal behaviors. At the same time, the attention mechanism can effectively filter noise and redundant information to ensure that key abnormal patterns are fully learned and detected.

[0061] 5. Realize real-time detection and model expansion: This embodiment designs a real-time detection architecture that can analyze and process new log data and monitoring data generated in the system in real time to ensure timely discovery and response to faults. In addition, this embodiment uses online learning and small sample tuning technology to support the model to quickly adapt and expand when facing new types of abnormal patterns, thereby enhancing the real-time and scalability of the model.

[0062] The purpose of this embodiment is to address the shortcomings of existing fault detection technologies, such as the limitation of a single data source, insufficient capture of temporal features, poor model robustness, difficulty in identifying complex anomalies, and poor real-time performance. Through innovative methods such as multimodal data fusion, GRU neural networks, multi-head attention mechanisms, and large language models, the accuracy, real-time performance, and adaptability of system fault detection are significantly improved, providing a more effective fault detection solution for modern complex IT systems.

[0063] The technical solution of this embodiment revolves around how to perform efficient and accurate fault detection in complex IT systems by combining data source fusion, GRU neural network, multi-head attention mechanism and large language model. The key to the technical solution is to solve the problems of single data source limitation, insufficient time series feature processing, poor robustness and noise interference in the existing technology, and propose a fault detection architecture that integrates multiple innovative technologies to improve the system's global perception ability, time series feature capture ability and detection accuracy.

[0064] Furthermore, data fusion of multiple data sources in the IT system includes:

[0065] Extracting semantic features, template information, and timestamp information from the log data of the present invention;

[0066] Extracting time series data of system performance indicators in the monitoring data of the present invention;

[0067] Collect statistics on user requests and interactive behaviors in the user behavior data of the present invention, and extract user operation mode features;

[0068] The feature information extracted from log data, monitoring data and user behavior data is integrated into a unified feature representation.

[0069] Specifically, in this embodiment, the specific steps of multi-data source data fusion are:

[0070] In complex IT systems, a single data source (such as log data) cannot fully reflect the global status of the system. In order to capture the complete status of system operation, data from multiple different sources (such as logs, monitoring data, user behavior data, etc.) must be integrated. Multi-data source data fusion can integrate information from different data sources to provide more comprehensive context and background information for system fault detection.

[0071] The multi-data source data fusion module is responsible for collecting data from multiple data sources and preprocessing each type of data through the feature extractor. The specific feature extraction process is as follows:

[0072] Log data: Convert the timestamps of the logs into numerical form, such as the discretization of hours and minutes, or calculate the time interval between events. Then use the large language model to parse the logs and extract the semantic features, template information, and timestamp information in the logs. Use an embedding model (such as Word2Vec) to convert the extracted event templates into dense vector representations to capture the semantics of the event. Finally, arrange the logs in chronological order to form an event sequence so that they can be input into the GRU neural network to process time correlation.

[0073] Monitoring data: Extract time series data of system performance indicators (such as CPU, memory, disk usage, etc.) from the monitoring system, and perform feature scaling and normalization on these time series data. For time series features, directly retain the original numerical sequence of monitoring data, such as changes in CPU utilization, changes in memory usage, etc., as time series input. Perform sliding window operations on the monitoring data, and calculate statistical features such as average, standard deviation, maximum, and minimum values ​​as auxiliary inputs. At the same time, normalize the numerical features to the range of 0-1 to eliminate dimensional differences between different features. For certain specific monitoring indicators (such as CPU usage exceeding 90%), binary encoding (0 / 1) can be directly set to prompt abnormal signals.

[0074] User behavior data: User behavior data includes click operations, page visits, system calls, etc., and usually has the following characteristics: unstructured, sparsely distributed events, etc. First, serialize the event features and organize the user behavior events in chronological order to form a user operation sequence. Then classify the user behavior (such as "login", "download", "operation failure", etc.) and convert it into a vector using One-Hot encoding or embedding representation. Then extract the user's historical behavior features, such as login frequency, page dwell time, key operation path, etc., and represent them as dense vectors. At the same time, model the time intervals between user behaviors to capture the user operation frequency and timing characteristics.

[0075] After data preprocessing is completed, different data are fused through the feature fusion layer. A deep learning-based fusion technology (such as co-training model, tensor fusion, etc.) is used to integrate the features of different modalities into a unified feature representation, ensuring that the features of each data source data can work together and provide richer context information.

[0076] Furthermore, the fused data is input into the fault detection model including:

[0077] Based on the GRU neural network, the fused data is modeled with time series features to obtain time series modeling features;

[0078] Based on the multi-head attention mechanism, the fault behavior feature focusing processing is performed on the fused data and time series modeling features of the present invention to obtain the fault behavior features.

[0079] Furthermore, the time series feature modeling of the fused data includes:

[0080] Through the recurrent structure of the GRU neural network, the temporal dependency relationship in the fused data is obtained;

[0081] Through the structure of the bidirectional GRU neural network, both the forward time series and the reverse time series can be processed simultaneously.

[0082] Specifically, in this embodiment, the specific steps of using the GRU neural network for time series feature modeling include:

[0083] Traditional machine learning methods have limitations when processing time series data, especially when faced with complex time series features, and cannot accurately identify abnormal behavior. This patent introduces the GRU neural network, which is specifically used for modeling time series features. The GRU (Gated Recurrent Unit) neural network is a deep learning model that specifically processes time series data. It can effectively capture long-term dependencies in time series through a "gating mechanism".

[0084] Combining the template features extracted by the large model with the time series model (such as the GRU network) can form a hybrid model architecture for efficiently capturing the time series features and abnormal patterns in the logs. Although the large language model performs well in semantic understanding, its processing ability for time dependencies is limited. For this reason, the GRU network can play its advantages in processing time series log data. Through the gating mechanism, the GRU can effectively capture long-term dependencies and identify abnormal patterns from the time sequence of the logs. The log template or feature processed by the large model is input into the GRU network, so that it can learn the time series relationship in the log. For example, some abnormal behaviors are only triggered when multiple specific events occur in succession, and the GRU network can help identify such time series dependencies.

[0085] The GRU network processes input data through the following steps:

[0086] 1. Input time series data: The fusion features generated by the multi-data source data fusion module include the timestamp information of the system log, the time series of the monitoring data, etc. All these data serve as the input of the GRU network.

[0087] 2. Time series feature extraction: GRU captures the time series dependencies in the data through its cyclic structure. The hidden states in the network are continuously updated to retain the historical information of the time series, allowing the model to identify the time points that need to be focused on and their related events.

[0088] 3. Bidirectional GRU: In order to enhance the model's understanding of contextual information, the GRU network adopts a bidirectional structure (Bidirectional GRU), which can simultaneously consider the forward and backward information in the time series and improve the ability to capture complex time series features.

[0089] Furthermore, the fault behavior feature focusing processing of the fused data and time series modeling features of the present invention includes:

[0090] For the time series modeling features of the present invention, the attention weight between each input feature and other features is calculated to identify key features related to abnormal behavior;

[0091] Based on the attention score, focus on the preset high-relevance features.

[0092] Specifically, in this embodiment, the processing steps of the multi-head attention mechanism are:

[0093] Abnormal logs and monitoring data in IT systems often contain a lot of noise or irrelevant information. Traditional deep learning models find it difficult to focus on key features in a large amount of redundant data. This patent introduces a multi-head attention mechanism to enable the model to automatically focus on important features, helping the model to more comprehensively analyze important information in log sequences, ignore noise, and improve the accuracy of abnormality detection.

[0094] When processing time series data, the GRU neural network may give equal weight to the data of all time steps, making it difficult to highlight the information of key time points. The multi-head attention mechanism can automatically focus on important time steps and give them higher weights, thereby improving the ability to capture abnormal patterns. In addition, the multi-head attention mechanism allows parallel calculation of attention in multiple subspaces, capturing the multi-level correlation of time series data and enhancing feature expression. The following describes in detail the fusion method and specific connection structure of the multi-head attention mechanism and the GRU neural network.

[0095] 1. Input data: The multi-head attention mechanism is usually embedded in the output stage of each time step of the GRU network. The feature sequence after multimodal fusion is input into the GRU network, and the GRU gradually processes the time series features to generate the hidden state h of each time step. t .

[0096] 2. Multi-head attention processing: GRU's hidden states h1,h2,…,h T As the input of multi-head attention. Through multiple attention heads (each head corresponds to a subspace), the attention weights Attention(Q, K, V) are calculated respectively (where Q (query) is the hidden state h of the current time step t ; K (key) and V (value) are the hidden states at all time steps. By calculating Get the weighted output at different time steps), and finally the output features of each head are summarized into a unified representation through splicing and linear transformation.

[0097] 3. Fusion and feedback: Combine the output features of the multi-head attention with the GRU hidden state (for example, by weighted summation or concatenation) as the final representation of the time step for processing in subsequent layers.

[0098] The multi-head attention mechanism can be nested in the following two locations in the GRU network. GRU layer post-embedding (post-processing): First use GRU to extract the hidden states of all time steps, and then use these states as the input of the multi-head attention. This method retains the complete processing ability of GRU for time series data, while introducing the attention mechanism to enhance feature selection. GRU inter-layer embedding (intermediate processing): In the multi-layer structure of GRU, a multi-head attention mechanism is inserted between each layer to globally adjust the output of each layer and enhance the attention to the features of different layers.

[0099] The core idea of ​​the multi-head attention mechanism is to calculate attention in parallel in different feature subspaces to capture richer and more diverse features. The specific implementation process is as follows:

[0100] 1. Input features from multiple data sources: The features after fusion of data from multiple data sources and the temporal features extracted by the GRU network are used as the input of the multi-head attention mechanism.

[0101] 2. Calculate attention scores: The multi-head attention mechanism identifies key features related to abnormal behavior and ignores irrelevant features by calculating the correlation between each input feature and other features (attention weight).

[0102] 3. Focus on important features: Based on the attention scores, the model focuses on those features with high relevance, thereby improving the detection of abnormal patterns.

[0103] Through the multi-head attention mechanism, the system can automatically focus on key features in complex and redundant log and monitoring data, thereby improving the accuracy of fault detection.

[0104] Furthermore, extracting semantic features, template information, and timestamp information from the log data of the present invention includes:

[0105] Preprocessing the log data of the present invention;

[0106] Using a large language model, the preprocessed log data is parsed to obtain the semantic features and timestamp information of the present invention;

[0107] By parsing the pattern of the log data, the template information of the present invention is extracted.

[0108] Specifically, in this embodiment, the steps of using the large language model to perform log parsing are:

[0109] Log data is usually an important data source generated by the system, but it contains a lot of redundant information. Traditional log analysis tools based on keywords or rules cannot fully understand the semantic information in the log. This patent introduces a large language model to parse log data, which can effectively extract log templates and semantic features.

[0110] Large language models (such as GPT and BERT) can understand natural language and parse the semantics of log data. Large language models input raw log data, automatically generate log templates, and identify key information such as system events, error messages, timestamps, etc. These log templates can simplify log data, reduce the interference of redundant information, and provide high-quality feature input for subsequent anomaly detection.

[0111] The big language model is good at processing natural language and can extract core information by understanding the contextual semantics of the log. Important features in the log (such as error code, module name, exception description, etc.) can be parsed by the big model and converted into a standardized log template. The following are the detailed steps:

[0112] 1. Log preprocessing: basic cleaning and formatting of raw log data, including deleting redundant information (such as timestamps, IP addresses, etc.) and unifying the log format.

[0113] 2. Large model analysis: The large model analyzes the pre-processed log data. It can identify keywords, error messages, exception descriptions, etc. in the logs and understand the contextual semantic relationships of different log types.

[0114] 3. Log template extraction: By parsing the fixed pattern of the log, a standardized log template is extracted. For example, similar contents of different logs are abstracted into a fixed structure to generate a universal log template. This template process helps the subsequent model to perform efficient log matching and anomaly detection.

[0115] In addition, the large language model can also perform preliminary identification of abnormal patterns in logs, extract potential abnormal patterns, and provide more targeted feature information for subsequent deep learning modules. Then perform template matching and abnormal log identification. Based on the standardized log structure extracted by the large model, a template library is built to cover all log patterns under normal operating conditions. The large model can automatically generate these templates from historical log data to cover common normal log behaviors. Match the log entries generated in real time with the log templates in the template library. If the match is low, it indicates that the log entry may be abnormal.

[0116] Furthermore, constructing the fault detection model of the present invention includes:

[0117] A small sample tuning method is used to perform model training to obtain the fault detection model of the present invention.

[0118] Furthermore, a small sample tuning method is used to train the model including:

[0119] Pre-training the model using unlabeled multiple data sources of the present invention;

[0120] The pre-trained model is fine-tuned using the multi-data source of the present invention with a small amount of preset annotations.

[0121] Specifically, this embodiment also uses few-shot tuning and model optimization, including:

[0122] Fault data of IT systems is often scarce, with few labeled samples. Traditional machine learning models require a large amount of data for training and are difficult to function in small sample scenarios. This patent uses small sample tuning technology to enable the model to be effectively trained with a small amount of labeled data and have strong generalization capabilities. Especially in practical applications, labeled exception logs are often very limited, especially in some newer or uncommon systems. Therefore, through small sample tuning, the model can learn efficiently based on a small amount of labeled data and improve detection performance.

[0123] Small sample tuning uses a small amount of labeled data to fine-tune the model based on the pre-trained model. First, the model is pre-trained on large-scale unlabeled data (such as log history data and monitoring data) to learn basic patterns and features. Subsequently, the model is fine-tuned using a small amount of labeled data. Since the model has learned a wealth of common features during the pre-training phase, it can quickly adapt to specific anomaly detection tasks even with a small number of samples.

[0124] Finally, data enhancement and adversarial training are performed to generate similar but different log samples through a large model to expand the existing abnormal log data set. Data enhancement technology can help the model gain stronger generalization capabilities under limited training data. During the model training process, adversarial samples (i.e. intentionally generated abnormal logs) are used to test the robustness of the model to ensure that the model can cope with various types of anomalies.

[0125] This small sample tuning method greatly reduces the annotation cost and ensures that the model can quickly adapt to new abnormal patterns in practical applications, improving its practicality and robustness.

[0126] The overall process of this embodiment is as follows:

[0127] 1. Data collection: Collect data from multiple data sources such as logs, monitoring, user behavior, etc., and perform preliminary feature extraction and preprocessing.

[0128] 2. Large language model log parsing: Use a large language model to perform semantic parsing on log data, extract key log templates, and reduce redundant information.

[0129] 3. Data fusion from multiple data sources: Fusion of template features after log parsing with features from multiple data sources such as monitoring and user behavior.

[0130] 4. GRU time series modeling: The GRU neural network is used to perform time series modeling on the fused features to extract dependencies and important events in the time series.

[0131] 5. Multi-head attention mechanism: The multi-head attention mechanism focuses on key features, ignores noise data, and improves the model's detection accuracy for abnormal patterns.

[0132] 6. Small sample tuning: Use small sample tuning technology to fine-tune the model to enhance its adaptability and generalization ability in different application scenarios.

[0133] 7. Anomaly detection output: The final output of the fault detection results identifies the abnormal patterns in the system and provides fault location information.

[0134] This embodiment proposes an innovative fault detection method based on a multimodal attention mechanism, which utilizes the combination of multi-data source data fusion, GRU neural network, multi-head attention mechanism and large language model to solve the shortcomings of the existing technology in data fusion, time series modeling, noise processing and small sample scenarios, and greatly improves the accuracy, robustness and practicality of fault detection.

[0135] This embodiment has made many innovations based on the existing technology, which are mainly reflected in the following aspects:

[0136] Innovative application of multimodal data fusion: Existing fault detection methods often rely on only a single data source, such as log data or monitoring data, which makes it impossible to fully capture the operating status of the system. This patent fuses information from multiple data sources (such as logs, monitoring, user behavior, etc.) so that the model can comprehensively analyze the global state of the system, thereby improving the accuracy of fault detection. This multimodal data fusion not only improves the comprehensiveness of system fault detection, but also provides richer data support for the identification of abnormal patterns.

[0137] Introducing a large language model for log template extraction: Traditional abnormal log analysis mainly relies on rule matching or shallow machine learning models, which cannot fully understand the semantic information in the log. The large language model has powerful natural language processing capabilities, and can extract the key templates of the log through deep semantic analysis and filter out redundant or noisy information. This patent applies the large language model to the extraction of log templates, so that the model can more accurately locate the key features in the abnormal log, solving the shortcomings of existing methods in log semantic understanding.

[0138] Deep time series modeling combining GRU and multi-head attention mechanism: Existing anomaly detection methods are often not deep enough when processing time series features, and it is difficult to capture the temporal dependencies of abnormal behaviors. This patent combines the time series modeling capabilities of the GRU neural network with the feature focusing capabilities of the multi-head attention mechanism, allowing the model to effectively capture complex patterns in time series, ignore unimportant features, and improve the accuracy and robustness of anomaly detection. This combination is significantly innovative in the field of time series anomaly detection.

[0139] This embodiment proposes a new fault detection method, which has significant differences compared with the prior art, mainly in the following aspects:

[0140] Multimodal data fusion: Traditional fault detection methods usually rely on a single data source or simple data integration, lacking a comprehensive perception of the global state of the system. This patent uses multimodal data fusion technology to integrate multi-source data such as logs, monitoring data, and user behavior data to achieve a comprehensive analysis of the system state. Compared with the single perspective of the prior art, the present invention provides a more comprehensive and accurate fault detection solution.

[0141] Large language model for log parsing: Existing log analysis tools mainly rely on rules or keyword matching, lacking a deep understanding of log semantics. This patent introduces a large language model for log template extraction and semantic analysis, making log feature extraction more accurate and context-dependent. This novel log parsing method provides a deeper source of information for anomaly detection, solving the bottleneck of existing technologies that cannot deeply understand log content.

[0142] Combination of multi-head attention mechanism and GRU: In existing time series anomaly detection methods, the application of GRU or other recurrent neural networks is already common, but it is still relatively rare to combine multi-head attention mechanism with GRU to improve the model's feature focusing ability. Through this innovative combination, this patent enables the model to process multiple feature subspaces in parallel, extract key anomaly information, and significantly improve the performance of anomaly detection.

[0143] This embodiment is designed with full consideration of the requirements for fault detection in an actual system and has significant practicality, which is mainly reflected in the following aspects:

[0144] Adapt to complex system environments: Modern IT systems are often highly complex, including multiple subsystems, different data sources, and various user interactions. Existing fault detection methods often have difficulty adapting to such complex environments, resulting in insufficient detection accuracy. This embodiment can adapt to different types of complex system environments through multimodal data fusion and time series feature modeling to ensure the comprehensiveness and accuracy of fault detection. In practical applications, this technology can help enterprises and organizations effectively reduce business interruptions and economic losses caused by system failures.

[0145] Enhanced detection accuracy and robustness: By introducing the GRU neural network, multi-head attention mechanism and large language model, this embodiment significantly improves the accuracy of anomaly detection, and can ignore noise information, reduce false positive rate and false negative rate. In addition, this embodiment can optimize the model performance under limited annotated data through small sample tuning technology, ensuring its robustness and wide applicability in practical application scenarios.

[0146] Real-time monitoring and online learning: The patented technology supports real-time fault detection, can quickly respond to abnormal behaviors in system operation, and continuously optimize the model through online learning mechanisms to adapt to new patterns and new types of abnormalities that appear in system operation. This feature makes the technology extremely practical and continuously adaptable, and can maintain high detection efficiency in long-term operation.

[0147] This embodiment improves the accuracy and reliability of system fault detection through innovations in multimodal data fusion, log template analysis, deep time series modeling, etc. This patented technology is novel, can solve many defects in the existing technology, has significant creativity, and can be effectively applied in complex system environments, with extremely high practical value.

[0148] The obvious effects brought by the technology of this embodiment are reflected in: improving the accuracy of system fault detection, sensitivity to time series and multimodal data, enhancing the ability to focus on key features, adapting to small sample data scenarios, enhancing the global understanding of complex systems, and reducing data and annotation costs. This technical solution provides a powerful solution for fault detection in modern complex IT systems, with strong innovation, practicality and market application prospects. The specific effects are as follows:

[0149] 1. The accuracy of fault detection is significantly improved

[0150] This embodiment integrates data from multiple sources such as logs, monitoring data, and user behavior data through multi-data source data fusion technology to form a more comprehensive and multi-dimensional system perspective. This enables the system to capture the global characteristics of the system through multi-source information when a single data source cannot effectively reflect the system status, thereby enhancing the accuracy of fault detection. In addition, by introducing a large language model to perform semantic analysis on log data, the noise and redundant information in the log data are greatly reduced, key information is extracted, and the accuracy of the detection results is further improved.

[0151] 2. Enhanced fault identification capability for timing dependency

[0152] The GRU neural network is used to model the time series features in the system, especially the bidirectional GRU network, which considers the context information of the previous and next sequences at the same time, significantly improving the model's ability to identify abnormal patterns in time series data. For those fault modes that depend on the time context, the GRU neural network can more accurately identify abnormal events by capturing long-term and short-term dependencies, thus enhancing the model's ability to perceive fault modes in complex systems.

[0153] 3. Improved ability to focus on key features

[0154] By introducing a multi-head attention mechanism, this embodiment can automatically identify and focus on key features related to faults in multimodal data with more redundancy and noise. This mechanism can effectively ignore irrelevant features and focus on potential abnormal patterns by calculating the attention weights of multiple subspaces in parallel, greatly reducing the impact of noise interference on fault detection results. The introduction of this mechanism allows the model to remain efficient when processing complex data, thereby improving detection accuracy.

[0155] 4. Adapt to the detection needs of small amounts of data scenarios

[0156] In many practical application scenarios, fault sample data is often scarce and the labeling cost is high. This embodiment uses small sample tuning technology to quickly adapt to new fault detection tasks by fine-tuning the pre-trained model with a small amount of labeled data. This technology reduces the need for a large amount of labeled data, allowing the system to maintain a high detection accuracy rate even in the case of small samples, and has strong practicality and robustness.

[0157] 5. Increased sensitivity to abnormal patterns in complex systems

[0158] By combining multimodal data fusion and temporal feature modeling, this embodiment can capture various types of abnormal patterns in complex IT systems. After fusing data from different sources, the system can perceive changes in system status from multiple dimensions, and the GRU neural network further enhances the ability to identify complex and hidden abnormal patterns by modeling temporal dependencies. This enables the system to effectively detect potential faults when faced with complex system structures and operating environments.

[0159] 6. Improved global understanding of system operation

[0160] Traditional fault detection technology is often limited to a single or a few data sources, but this embodiment uses multimodal data fusion and large language model analysis technology to enable the system to monitor the system operation status from a global perspective. Through the comprehensive integration of multi-source data such as logs, monitoring, and user behavior, the system can better understand the global state changes in complex IT systems, have more comprehensive system fault detection capabilities, and significantly improve the overall detection effect.

[0161] 7. Reduce the cost of model training and deployment

[0162] Since this embodiment uses small sample tuning technology to fine-tune the model, it reduces the reliance on a large amount of fault annotation data, thereby reducing the cost of model training. In addition, the multimodal fusion architecture of the model enables the system to quickly adapt to different system environments and data sources, with high versatility and flexibility. This means that this technology can not only reduce the cost of data collection and annotation, but also accelerate the model training and deployment process, significantly improving the practicality of the application.

[0163] 8. Improved the generalization and robustness of the model

[0164] This embodiment greatly improves the model's generalization ability for different types of abnormal patterns by combining a large language model, a GRU neural network, and a multi-head attention mechanism. In actual application scenarios, the system may face a variety of abnormal patterns and data environments. This fusion of multiple technologies enables the model to maintain efficient anomaly detection capabilities in a variety of scenarios. In addition, the model is also highly robust and can adapt to complex environments with more noise and irrelevant data.

[0165] This embodiment overcomes the limitations of a single data source in traditional fault detection by introducing multi-data source data fusion technology. In modern complex IT systems, a single data source cannot fully reflect the global status of the system. In order to detect system failures more accurately and comprehensively, this embodiment forms a unified feature representation of multiple data sources by fusing multiple data sources such as log data, monitoring data, and user behavior data. Through this technology, the system can combine the features of different data sources, improve the system's global perception capabilities, and ensure the comprehensiveness and accuracy of fault detection.

[0166] This embodiment uses a large language model to parse log data. Traditional log analysis methods have difficulty capturing complex semantics and patterns in logs, while large language models can automatically extract log templates, identify key system events and timestamp information, and reduce redundant information interference in logs through natural language processing technology. This technology not only improves the utilization efficiency of log data, but also provides higher quality feature input for subsequent models.

[0167] This embodiment combines the GRU neural network with the multi-head attention mechanism for modeling time series features and extracting key features. The GRU network is good at processing time series data. It captures long-term dependencies in log and monitoring data through a gating mechanism, allowing the model to better identify complex time series patterns. In addition, this embodiment enhances the model's ability to process information in parallel in different feature subspaces by introducing a multi-head attention mechanism. The multi-head attention mechanism can automatically focus on key features, filter out noise data, and ensure that the model can maintain efficient anomaly detection performance in complex data environments.

[0168] In actual application scenarios, labeled fault data is often scarce, so this embodiment introduces small sample tuning technology, which enables the model to achieve efficient training and rapid adaptation with a small amount of labeled data. Small sample tuning enables the model to have strong generalization ability through pre-training and fine-tuning of a small number of samples, and can maintain high-precision fault detection even with a small number of samples.

[0169] This embodiment inputs the features of multimodal data fusion and time series information into the GRU neural network, and uses the attention mechanism to focus on the features of key time points. The system can more effectively identify complex abnormal patterns. This method has higher accuracy and robustness when dealing with system fault detection tasks with strong time series dependence.

[0170] The key points of this embodiment are focused on data fusion from multiple data sources, log parsing with a large language model, the combination of GRU and multi-head attention mechanism, small sample optimization technology, and joint modeling of multimodal and time series information. These innovations provide the system with powerful fault detection capabilities and can effectively solve various problems in existing technologies.

[0171] The embodiments described above are only descriptions of the preferred embodiments of the present invention and are not intended to limit the scope of the present invention. Without departing from the design spirit of the present invention, various modifications and improvements made to the technical solutions of the present invention by ordinary technicians in this field should all fall within the protection scope determined by the claims of the present invention.

Claims

1. A fault detection method based on a multimodal attention mechanism, characterized in that: include: Perform data fusion on multiple data sources in the IT system; wherein the multiple data sources include: log data, monitoring data and user behavior data; The fused data is input into the fault detection model to obtain the fault detection result; wherein, the fault detection model is constructed based on the GRU neural network and the multi-head attention mechanism.

2. The fault detection method based on the multimodal attention mechanism according to claim 1, characterized in that: Data fusion of multiple data sources in IT systems includes: Extracting semantic features, template information, and timestamp information from the log data; Extracting time series data of system performance indicators from the monitoring data; Collecting statistics on user requests and interactive behaviors in the user behavior data to extract user operation mode features; The feature information extracted from log data, monitoring data and user behavior data is integrated into a unified feature representation.

3. The fault detection method based on the multimodal attention mechanism according to claim 1, characterized in that: The fused data is input into the fault detection model including: Based on the GRU neural network, the fused data is modeled with time series features to obtain time series modeling features; Based on the multi-head attention mechanism, the fused data and time series modeling features are subjected to fault behavior feature focusing processing to obtain fault behavior features.

4. The fault detection method based on the multimodal attention mechanism according to claim 3 is characterized in that: The time series feature modeling of the fused data includes: Through the recurrent structure of the GRU neural network, the temporal dependency relationship in the fused data is obtained; Through the structure of the bidirectional GRU neural network, both the forward time series and the reverse time series can be processed simultaneously.

5. The fault detection method based on multimodal attention mechanism according to claim 3, characterized in that: Performing fault behavior feature focusing processing on the fused data and time series modeling features includes: Based on the multi-head attention mechanism, the attention weight between each input feature and other features in the time series modeling feature is calculated to identify features related to abnormal behavior; wherein the multi-head attention mechanism is embedded after the GRU layer and embedded between the GRU layers; Based on the attention score, the identified features are focused to obtain preset high-relevance features.

6. The fault detection method based on the multimodal attention mechanism according to claim 2, characterized in that: Extracting semantic features, template information, and timestamp information from the log data includes: Preprocessing the log data; Using a large language model, parsing the preprocessed log data to obtain the semantic features and timestamp information; The template information is extracted by parsing the pattern of the log data.

7. The fault detection method based on multimodal attention mechanism according to claim 1, characterized in that: Constructing the fault detection model includes: A small sample tuning method is used to perform model training to obtain the fault detection model.

8. The fault detection method based on multimodal attention mechanism according to claim 7, characterized in that: Using the small sample optimization method, model training includes: Pre-training the model using the unlabeled multiple data sources; The pre-trained model is fine-tuned using the multiple data sources with a small amount of preset annotations.

Images