Execution method of large model graph retrieval enhancement system oriented to software and hardware monitoring operation and maintenance

Abstract

The invention relates to the technical field of intelligent operation and maintenance, in particular to an execution method of a large model graph retrieval enhancement system oriented to software and hardware monitoring operation and maintenance, which comprises the following steps: S1, inputting fault information to the graph retrieval enhancement system; s2, a graph construction and updating module receives and processes the fault information, generates a triple, and writes the triple into an operation and maintenance / fault knowledge graph; s3, the fault information is input into a graph retrieval enhancement module for two-stage filtering retrieval, and sub-graph information is screened out; s4, the prompt word construction module converts the fault information and the screened sub-graph information into structured natural language prompt segments; and S5, a reasoning generation module performs natural language question and answer to generate a fault analysis result. Based on the above scheme, the execution method enhances the adaptive capacity of knowledge reasoning and fault positioning, gives play to the generalization reasoning capacity of a large language model while ensuring the accuracy, and enhances the practical value.

Description

Technical Field

[0001] The present invention relates to the technical field of intelligent operation and maintenance, and specifically to an execution method of a large model graph retrieval enhancement system for software and hardware monitoring and operation and maintenance. Background Art

[0002] In modern IT systems, with the continuous expansion of business complexity and scale, the adaptation and migration work of new-generation information technologies faces complex and changeable fault scenarios. It is necessary to monitor the running states of various IT resources such as servers, databases, and applications during the adaptation process, so that when a fault occurs, the cause of the fault can be quickly and accurately located, a solution can be formulated, and the repair process can be executed, thereby ensuring the stable operation of the system during the migration of new-generation information technologies. With the rapid development of large language models (LLMs), researchers combine domain knowledge bases with the knowledge bases precipitated in the fields of IT monitoring and operation and maintenance, and use Retrieval-Augmented Generation (RAG) technology to guide the solution of problems in the adaptation process of new-generation information technologies. However, traditional document-based RAG architectures have problems such as knowledge redundancy and difficulty in structuring, which lead to difficulties in reasoning, and it is difficult to meet the real-time and interpretability requirements in IT systems.

[0003] In recent years, knowledge graph technology has been widely used in multiple fields. Through structured knowledge representation and powerful reasoning capabilities, it provides new ideas for solving complex problems. In the fields of system adaptation, monitoring and operation and maintenance, the integration of knowledge graphs and large models has the following advantages: 1) Improve interpretability: The combination of the explicit knowledge of the knowledge graph and the implicit knowledge of the large model can improve the interpretability of knowledge application.

[0004] 2) Achieve cross-verification: The combination of the output of the knowledge graph and the output of the large model can provide a means of cross-verification / comparison for knowledge application and improve the reliability of the service.

[0005] 3) Optimize knowledge storage: The combination of the structured information storage of the knowledge graph and the unstructured information processing of the large model can optimize the knowledge storage and retrieval efficiency.

[0006] 4) Improve decision-making ability: The combination of the reasoning results of the knowledge graph and the reasoning results of the large model can further enrich the knowledge background for auxiliary decision-making and provide more accurate decision-making suggestions.

[0007] In the process of migrating to the new generation of information technology, the knowledge graph can integrate knowledge such as software and hardware, application asset information, failure modes, and solutions to form a comprehensive knowledge system. However, how to efficiently retrieve knowledge related to the current problem from the knowledge graph and apply it to intelligent question answering, fault location, and automatic process formulation and execution remains an urgent problem to be solved.

[0008] The graph retrieval enhanced generation GraphRAG (Graph-based Retrieval-Augmented-Generation) can achieve the deep integration of large language models and knowledge graphs, and then more efficiently and accurately realize the functions of intelligent question answering, IT fault location, and automatic process formulation and execution. This framework enhances the reasoning ability of LLMs by integrating relevant information from external knowledge graphs.

[0009] However, currently, GraphRAG also faces problems such as high computing power costs, a lot of noise and redundancy in the knowledge base, which seriously affect the efficiency and accuracy of the reasoning process.

[0010] In summary, the existing technologies still have the following disadvantages: 1) Low knowledge retrieval efficiency: When facing large-scale knowledge graphs, the existing knowledge graph retrieval technologies have high computing power requirements and low retrieval efficiency, making it difficult to quickly locate relevant knowledge.

[0011] 2) Inaccurate retrieval results: The existing technologies lack a deep understanding of context information during the retrieval process, resulting in insufficient relevance of the retrieval results.

[0012] 3) Lack of a dynamic update mechanism: The update of the knowledge graph is not timely, resulting in the inability to guarantee the timeliness and accuracy of the retrieval results.

[0013] 4) Low degree of automation in the fault handling process: The existing fault handling processes rely on manual operations, with a low degree of automation, low efficiency, and are prone to errors. Summary of the Invention

[0014] To solve the above technical problems, the present invention discloses an execution method for a large model graph retrieval enhanced system for software and hardware monitoring and operation and maintenance.

[0015] The present invention discloses an execution method for a large model graph retrieval enhanced system for software and hardware monitoring and operation and maintenance. Among them, the graph retrieval enhanced system includes a graph construction and update module, a graph retrieval enhancement module, a prompt word construction module, an inference generation module, a process parsing module, and a process execution module; the graph construction and update module is used to construct an operation and maintenance / fault knowledge graph and update the operation and maintenance / fault knowledge graph; the graph retrieval enhanced system is used to execute and process the fault information of a fault event. The execution method of the graph retrieval enhancement system includes the following steps: Step S1: Input the fault information of the fault event into the graph retrieval enhancement system; Step S2: The graph construction and update module receives and processes the fault information of the fault event, generates triples, writes the triples into the operation and maintenance / fault knowledge graph, and updates the operation and maintenance / fault knowledge graph; Step S3: Input the fault information into the graph retrieval enhancement module; the graph retrieval enhancement module performs two-stage filtering retrieval based on the operation and maintenance / fault knowledge graph, and filters out the sub-graph information corresponding to the fault information; Step S4: The prompt word construction module converts the fault information and the filtered sub-graph information into a structured natural language prompt fragment; Step S5: The inference generation module calls the large language model to perform natural language Q&A in combination with the structured natural language prompt fragment, and generates a fault analysis result.

[0016] A further improvement of the present invention is that the graph retrieval enhancement system further includes a process parsing module and a process execution module; the execution method further includes Step S6 and Step S7; Step S6: The process parsing module parses the fault analysis result generated by the large language model into a structured task flow; Step S7: The process execution module sequentially calls the corresponding scripts to schedule and execute the structured task flow, and records the execution result.

[0017] A further improvement of the present invention is that the graph construction and update module constructs the operation and maintenance / fault knowledge graph based on the ontology model; the ontology model is modeled based on the semantic relationship between software and hardware components, fault time, monitoring metrics, and operation and maintenance actions in the IT system; the ontology model can be divided into entities, relationships, and attributes; The process of constructing the operation and maintenance / fault knowledge graph based on the ontology model is as follows: perform field standardization processing on the original data in the unstructured knowledge base, and then input the original data after field standardization processing into the ontology model for entity recognition and semantic mapping to obtain the operation and maintenance / fault knowledge graph.

[0018] A further improvement of the present invention is that Step S3 includes the following steps: Step S31: The graph retrieval enhancement module constructs the fault information into a graph structure query statement, and then uses the graph embedding model to convert the graph structure query statement into a structured query vector; Step S32: The graph retrieval enhancement module converts the predefined sub-graphs in the operation and maintenance / fault knowledge graph into structured vector sub-graphs; Step S33: The graph retrieval enhancement module calculates the semantic similarity between the structured query vector and the structured vector subgraph based on the semantic similarity formula, and performs a preliminary screening on the structured vector subgraph based on the first threshold to obtain candidate subgraphs, and stores the candidate subgraphs in the candidate subgraph set; Step S34: Extract the structural patterns of the candidate subgraphs in the candidate subgraph set respectively to obtain the structures of the respective candidate subgraphs; Step S35: Perform a structural matching score on the structures of the respective candidate subgraphs and the predefined template structure based on the structure matching formula, and perform a refined screening based on the second threshold to obtain the final subgraph set; the final subgraph set is the subgraph information corresponding to the fault information.

[0019] A further improvement of the present invention lies in that, in step S4, the structured language prompt segment includes a first prompt segment and a second prompt segment. The first prompt segment is generated by the prompt word construction module based on the fault information, and the second prompt segment is generated by the prompt word construction module based on the fault information and the subgraph information; Step S5 includes the following steps: Step S51: The inference generation module inputs the first prompt segment into the large language model to obtain a first output; Step S52: The inference generation module inputs the second prompt segment into the large language model to obtain a second output; Step S53: The inference generation module performs weighted fusion on the first output and the second output to obtain a fusion output; Step S54: The inference generation module performs text generation based on the fusion output and obtains a probability distribution using Softmax to obtain the final response text; the final response text is the fault analysis result.

[0020] A further improvement of the present invention lies in that, in step S53, the inference generation module performs weighted fusion on the first output and the second output based on the weighted fusion formula to obtain a fusion output; The weighted fusion formula is: Logits final =α·Logits KG +(1-α)·Logits LLM ; where, Logits final is the fusion output, α is the weight coefficient, Logits KG is the second output, and Logits LLM is the first output.

[0021] A further improvement of the present invention lies in that the value of α is set based on a static method or a dynamic method; the value of α is between [0,1].

[0022] A further improvement of the present invention lies in that the static method means presetting the value of α; The dynamic method means calculating and setting the value of α based on a dynamic formula; The dynamic formula is: α = Sigmoid(β·Sim(Q, G best )); where Sim(Q, G best ) is the cosine similarity between the query vector Q and the most relevant vector sub-graph G best ; β and γ are training parameters; Sigmoid is used to constrain the value of α between [0, 1].

[0023] A further improvement of the present invention lies in that step S6 includes the following steps: Step S61: The process parsing module inputs the fault analysis result into the natural language task parser to extract task information; Step S62: The process parsing module constructs a directed acyclic graph according to the extracted task information; Step S63: The process parsing module converts the directed acyclic graph into a structured task flow.

[0024] Advantages of the present invention: The present invention has high-precision structured knowledge expression. Based on structured semantic mapping and ontology models, it accurately constructs the deployment, dependency, and fault semantic relationships among domestic operating systems, databases, middleware, and chip platforms, can cover the complex device structures and abnormal propagation paths in the domestic ecosystem, significantly improves the expression accuracy and coverage of graph knowledge, and enhances the adaptability of knowledge reasoning and fault location.

[0025] The present invention has an accurate two-stage structured graph retrieval mechanism. The present invention introduces a two-stage knowledge filtering mechanism: first, quickly screens out irrelevant sub-graphs based on semantic similarity, and then strictly performs fine-grained structure filtering according to the structure template of "component - metric - fault - repair", effectively avoiding the interference of invalid knowledge on the reasoning of large language models, and significantly improving the context fit, accuracy, and stability of the generated results.

[0026] The present invention clearly balances external knowledge and the reasoning ability of the LLM itself based on the Logits fusion strategy, and effectively improves the quality of the generated results through the dynamic weight α (adaptively adjusted according to semantic relevance). The execution method of the present invention exerts the generalization and reasoning ability of the large language model while ensuring accuracy, and significantly enhances the practical value of the results. Brief Description of the Drawings

[0027] Figure 1 It is the technical architecture of the large model graph retrieval enhancement system for software and hardware monitoring and operation and maintenance of the present invention. Specific implementation manners

[0028] The following describes clearly and completely the technical solutions in the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention. Many specific details are set forth in the following description to facilitate a thorough understanding of the present invention. However, the present invention may also be implemented in other ways different from those described herein. Those skilled in the art can make similar extensions without departing from the connotation of the present invention. Therefore, the present invention is not limited by the specific embodiments disclosed below.

[0029] The present invention discloses an execution method for a large model graph retrieval enhancement system for software and hardware monitoring and operation and maintenance.

[0030] In response to the requirements of the new generation of information technology application innovation environment, the present invention constructs an integration mechanism of ontology structure relationships and knowledge graphs based on domestic software and hardware platforms (such as Kylin operating system, DM database, Feiteng / Hygon and other chips), and supports fault feature modeling and similar event matching under diverse software and hardware combinations. Through ontology definition, the structured constraints between nodes (servers, applications, middleware, databases, etc.) and attributes are clarified to ensure data consistency and the inferability of the knowledge graph.

[0031] On this basis, the present invention proposes a graph retrieval enhancement (GraphRAG) system, which makes full use of the structured representation and efficient association capabilities of the knowledge graph to achieve low-cost and highly interpretable intelligent operation and maintenance assistance, and improve the knowledge retrieval efficiency and question answering accuracy during the retrieval enhancement generation process.

[0032] The present invention proposes a low-computing-power and high-efficiency graph retrieval enhancement (GraphRAG) system for software and hardware monitoring and operation and maintenance scenarios, especially for domestic software and hardware. The graph retrieval enhancement system innovatively integrates the technical advantages of large language models and knowledge graphs, uses the operation and maintenance / fault knowledge graphs of high-quality domestic software and hardware constructed by ontology structure constraints to support structured retrieval and semantic enhancement prompt construction, and realizes highly interpretable question answering and process generation in low-resource environments.

[0033] The current artificial intelligence (AI) technology architecture can be divided into the following four layers: 1) Infrastructure layer: The solid foundation hardware facilities, software facilities, and data resources of AI technology. In terms of hardware facilities, it includes GPU-based computing acceleration chips and intelligent chips, such as intelligent voice chips and image recognition chips. In terms of software facilities, it includes intelligent cloud platforms that provide hardware resource management (such as Alibaba Cloud, Tencent Cloud, Amazon Cloud, etc.) and big data platforms that provide general and industry data resource management.

[0034] 2) Model layer: The AI model layer is the "brain" of the AI technology architecture, mainly including algorithms and models. The choice of model directly determines the effectiveness of the technology layer. The algorithms should be customized according to business requirements.

[0035] 3) Capability layer: A multi-functional toolbox for intelligent applications. The capability layer includes the understanding, memory, logic, and generation capabilities of large models, which directly provide technical support for applications. The core capabilities involved include text processing, image generation, code generation, etc. The main technologies involved are RAG, Agent, large model fine-tuning, prompt engineering, thought chain technology, etc. In the present invention, the large model refers to the large language model.

[0036] 4) Application layer: The application layer is the ultimate landing place of the AI architecture, which can intuitively reflect the value of AI technology. R & D personnel in the application layer deeply integrate technology with specific business scenarios to solve practical problems and create business value.

[0037] The positioning of the present invention is to improve the technology of the capability layer. By improving the high-order retrieval enhanced generation framework GraphRAG in the RAG technology system, the retrieval efficiency and accuracy of the knowledge base and knowledge graph are improved. At the same time, technologies such as prompt engineering are adopted and applied to the scenarios of Xinchuang adaptation and monitoring and operation and maintenance, so as to find the optimal solutions for IT fault diagnosis and problem handling during the Xinchuang adaptation and migration process, as Figure 1 shown.

[0038] The graph retrieval enhancement system disclosed in the present invention includes a graph construction and update module, a graph retrieval enhancement module, a prompt construction module, an inference generation module, a process analysis module, and a process execution module, as Figure 1 shown.

[0039] (I) Graph construction and update module (corresponding to Figure 1 "Graph construction and update" in The graph construction and update module is used to construct an operation and maintenance / fault knowledge graph and update the operation and maintenance / fault knowledge graph when needed. The graph construction and update module constructs nodes, attributes, relationships, and semantic paths of entities that conform to the ontology structure in the domestic software and hardware field based on the original data in the unstructured knowledge base, forms a unified semantics, inferable, and extensible operation and maintenance / fault knowledge graph, and supports dynamic incremental updates, version control, and graph state backtracking.

[0040] 1) The ontology model is the basic semantic framework for the construction and reasoning of operation and maintenance / fault knowledge graphs, which determines the "concept granularity", "entity organization method" in the operation and maintenance / fault knowledge graphs, as well as the interpretability of subsequent retrieval and generation. For the new generation of information technology innovation software and hardware environment, the present invention designs an ontology model for intelligent operation and maintenance. The ontology model is oriented to domestic software and hardware platforms and supports intelligent and interpretable fault handling and operation and maintenance processes. The ontology model is modeled based on the semantic relationships among software and hardware components, fault events, monitoring metrics, and operation and maintenance actions in the IT system, and is the basis for the subsequent construction of operation and maintenance / fault knowledge graphs, graph retrieval, and reasoning generation. As shown in Table 1, the core entity classes (Classes), relationships (Object Properties), and attributes (Data Properties) of the ontology model are listed, which can cover domestic mainstream software and hardware platforms (such as Kylin OS, DM Database, Feiteng / Loongson / Zhaoxin / Kunpeng, etc.), and can represent information such as component hierarchy, fault type, metric information, configuration dependency, and operation process. The entity class has multiple entities.

[0041] Table 1: Entity Classes of Operation and Maintenance Ontology in the New Generation of Information Technology Environment

[0042] The relationships between entities are as follows: a. DeployedOn: Used to describe on which operating system or physical device software such as application services and middleware are deployed, reflecting the system topology dependency structure. For example, DM Database is deployedOn Kylin V10.

[0043] b. BelongsTo: Indicates that a certain component belongs to a specific platform or architecture, and is used for platform-level analysis and localization of domestic adaptation problems. Feiteng CPU belongsTo the domestic platform, and Feiteng xx CPU belongsTo the ARM architecture.

[0044] c. Causes: Expresses that a certain abnormal monitoring metric or the state of the underlying component may trigger a certain fault type, which is the core edge of the reasoning chain. For example, network latency causes database connection failure.

[0045] d. DependsOn: Used to represent the configuration dependency or communication dependency between services, which helps to identify cascading faults and propagation paths. For example, Web service dependsOn Redis.

[0046] e. SolvedBy: Indicates that a certain fault type can be solved by a certain operation and maintenance operation, and is used to generate repair process suggestions. Database connection timeout is solvedBy restarting the connection pool service.

[0047] f. The metric is (hasMetric): It indicates that a certain component or fault is bound to a specific monitoring metric, and is used for conditional triggering and matching similar cases (events). For service exceptions, hasMetric connection_count = 0.

[0048] Attributes are designed for entities. As shown in Table 2 below, attributes can be embedded into the nodes of entities as first-order attributes of the operation and maintenance / fault knowledge graph, providing background information for subsequent large language model prompt construction and rule matching.

[0049] Table 2

[0050] 2) The graph construction and update module processes the raw data in the unstructured knowledge base through field standardization (cleaning, word segmentation, format conversion), and performs entity recognition and semantic mapping according to the constructed ontology model of domestic software and hardware to obtain triples based on the raw data. Raw data refers to data such as the operation logs, metrics of each monitoring node (hosts, servers, databases, middleware, application software, etc.) collected by the current operation and maintenance system, as well as documents of fault events accumulated after review and collation.

[0051] 3) According to the rules of the ontology structure, the ontology model constructs the triples based on the raw data into an operation and maintenance / fault knowledge graph with high consistency and high inferability. Specifically, the triples are organized as nodes and edges in the graph database according to the ontology structure, establishing deployment dependencies between components, causal relationships between metrics and faults, and solution relationships between faults and operations, etc. Finally, an operation and maintenance / fault knowledge graph that supports multi-hop reasoning and subgraph query is constructed. All node types and edge types in the operation and maintenance / fault knowledge graph inherit from the ontology model, preventing semantic conflicts or redundancies, thereby dividing subgraph namespaces for different hosts / platforms / subsystems and improving query efficiency. For example: A Service node cannot be connected to an illegal edge other than a Metric. The constructed operation and maintenance / fault knowledge graph contains multiple subgraphs. When encountering a new fault event, its fault information is input into the operation and maintenance / fault knowledge graph for retrieval of relevant subgraphs.

[0052] (4) Event chain subgraph In traditional knowledge graph construction methods, a static triple (entity-relationship-attribute) extraction mode is usually adopted to process operation and maintenance data. This method has deficiencies in dealing with continuous events and dynamic association information, and it is easy to cause isolated knowledge points to lack context association. In addition to adopting traditional triples to construct the operation and maintenance / fault knowledge graph, the present invention also designs an "instance-driven event chain modeling" mechanism. By instantiating and modeling continuous fault events generated during the actual operation and maintenance process, it can more effectively capture the causal association and dynamic evolution relationship between fault events, and construct a dynamic knowledge graph with stronger semantic expression and fault tracking capabilities.

[0053] The process of constructing an event chain subgraph based on the instance-driven event chain modeling mechanism is as follows: a. Fault event instantiation: Instantiate and extract continuous fault events to generate event chain nodes (such as: "server CPU utilization is too high", "database response latency", etc.).

[0054] b. Identification and modeling of event chain relationships: Based on the associated attributes of continuous fault events (the same alarm metric / component ID / alarm time / host IP), the following method is used to automatically establish the logical relationship (event chain relationship) between fault events: Associated analysis of time: Identify fault events that occur continuously within a time window (10-minute window) and have the same or similar component identifiers, and automatically merge them into a higher-level event chain (for example: "server CPU utilization is high" → "database response becomes slow" → "service is unavailable", and there is a causal or inferential logical connection relationship between these three fault events).

[0055] Associated analysis of metrics and components: Based on component types and operation and maintenance metrics (CPU utilization, disk I / O, network latency, etc.), dynamically identify possible associated fault events, and automatically construct causal paths or metric association relationship chains.

[0056] c. Dynamic graph modeling method based on time series First, construct an event chain subgraph based on the time series dynamic relationship: Add clear timestamp attributes to the relationships between event chain nodes, and dynamically sort the relationships through timestamps to retrospectively trace the historical fault event chain. Store the event chain as a special subgraph (event chain subgraph) in the operation and maintenance / fault knowledge graph.

[0057] In addition, the present invention implements a dynamic incremental update mechanism: by introducing an "incremental update + historical version control" method, each time a new event instance chain is added, an incremental merge algorithm is used to update the operation and maintenance / fault knowledge graph, and at the same time, the historical versions of the operation and maintenance / fault knowledge graph and snapshots of the event chain subgraphs are recorded to facilitate subsequent backtracking or evolution trend analysis.

[0058] d. Optimization strategies for graph storage and indexing Optimization of the event chain storage structure: At the storage level of the operation and maintenance / fault knowledge graph, taking the event chain as a unit, path compression and subgraph indexing (such as subgraph indexing in Neo4j) are used to improve the subsequent fast query efficiency.

[0059] Versioning and state chain maintenance: For each event chain, an operation log of incremental updates is recorded to maintain the historical version information of the event chain nodes and relationships, ensuring the historical data query and traceability capabilities.

[0060] An event chain is a storable and retrievable knowledge graph, which is a subgraph structure (event chain subgraph) with a time order and clear causality composed of the above-mentioned event instance nodes (nodes) and causal relationship chains (edges), representing the evolution path of an actual fault. In the present invention, the event chain is stored in the operation and maintenance / fault knowledge graph in the form of a subgraph (event chain subgraph).

[0061] The following are some examples of the operation and maintenance / fault knowledge graph. A certain enterprise uses domestic software and hardware platforms, including Feiteng servers, Kylin operating systems, DM databases, TongTech middleware, and enterprise financial system applications. During daily operation and maintenance, it is necessary to monitor the running status of these components and quickly locate and handle faults.

[0062] The nodes of the operation and maintenance / fault knowledge graph represent entities, such as Feiteng D2000 servers, Kylin V10 operating systems, DM databases, TongTech middleware, enterprise financial system applications, etc.; the edges represent the relationships between entities, such as deployedOn, causes, dependsOn, solvedBy, hasMetric, etc.

[0063] Partial graph structure description of the operation and maintenance / fault knowledge graph: Server and operating system: There is a deployedOn edge between the Feiteng D2000 server node and the Kylin V10 operating system node; there is also a deployedOn edge between the Haiguang server node and the Kylin V10 operating system node.

[0064] Operating System and Database / Middleware: There is a deployedOn edge between the Kylin V10 (Feiteng D2000 server) node and the DM database node; there is a deployedOn edge between the Kylin V10 (Hygon server) node and the KingbaseES database node; there is a deployedOn edge between the Kylin V10 (Feiteng D2000 server) node and the TongTech middleware node.

[0065] Middleware and Application Service: There is a deployedOn edge between the TongTech middleware node and the enterprise financial system application node.

[0066] Monitoring Metric and Fault Type: There is a causes edge between the node with high CPU occupancy rate and the node with database connection failure; there is a causes edge between the node with high memory occupancy rate and the node with middleware communication timeout; there is a causes edge between the node with high network latency and the node with application service response latency.

[0067] Application Service and Database / Middleware: There is a dependsOn edge between the enterprise financial system application node and the DM database node; there is a dependsOn edge between the enterprise financial system application node and the TongTech middleware node.

[0068] Fault Type and Solution: There is a solvedBy edge between the node with database connection failure and the node of restarting the database connection pool service; there is a solvedBy edge between the node with middleware communication timeout and the node of increasing middleware memory allocation; there is a solvedBy edge between the node with application service response latency and the node of optimizing network configuration.

[0069] Component and Monitoring Metric: There is a hasMetric edge between the DM database node and the CPU occupancy rate node; there is a hasMetric edge between the TongTech middleware node and the memory occupancy rate node; there is a hasMetric edge between the enterprise financial system application node and the network latency node.

[0070] The operation and maintenance / fault knowledge graph shows the relationships between components in the operation and maintenance scenarios of domestic software and hardware, as well as the associations between fault types, monitoring metrics, and solutions. The operation and maintenance / fault knowledge graph can provide a clearer understanding of the system architecture and fault handling processes, and support intelligent operation and maintenance.

[0071] (5)Update of the Operation and Maintenance / Fault Knowledge Graph The present invention designs an operation and maintenance / fault knowledge graph update mechanism that takes into account real-time performance, evolvability, consistency, and traceability, and is particularly applicable to complex operation and maintenance scenarios that handle high-frequency alarms and metric fluctuations. This update mechanism includes three key functions: dynamic incremental update, version control, and graph state backtracking. The specific technical implementation paths are as follows: a. Event chain dynamic update strategy An event chain is a clear causal path or time sequence path composed of a series of logically or temporally related fault events. The present mechanism uses the following methods to dynamically update the event chain: Identification of new fault events and link construction: When a new fault event enters the system, the system matches the nodes of the event chain based on node identifiers (such as host IP, service name, device ID). If there are existing event chain nodes, but the event type is different from the node types recorded in the operation and maintenance / fault knowledge graph (such as from "memory overload" to "network timeout"), the system identifies it as a new event chain node, creates a new event chain node separately, and adds a new causal relationship (as an edge) to link to the event chain node, forming a clear "event chain" structure.

[0072] Independence of event chain nodes: Event chain nodes are stored according to the instantiation principle. Each event chain node represents a specific alarm or fault event. Instead of overwriting the existing nodes, new event chain nodes are added and linked into the event path, clearly recording the time point when it occurred. Only the attributes of the existing event chain nodes are supplemented and updated (such as historical attribute values, duration, etc.), but the fault type represented by the event chain node itself cannot be modified, ensuring that the historical event chain structure is not damaged.

[0073] Incremental update and expiration mechanism of link relationships: When a new event chain node forms a new relationship with an existing event chain node, a new edge (relationship) is clearly created and the start timestamp is recorded. If, due to the evolution of the event chain, the old causal path (old edge) is no longer valid, only the expiration time of the old edge is marked, and the old edge (relationship) is not deleted, maintaining the traceability of the historical evolution path.

[0074] b. Association update mechanism between event chain and global knowledge graph Clearly distinguish the "event chain subgraph" from the overall "operation and maintenance / fault knowledge graph" to avoid misoperation of the original nodes. The specific mechanism is as follows: Independent storage of event chain subgraphs: Each event chain is stored in the operation and maintenance / fault knowledge graph in the form of an independent subgraph (event chain subgraph), and is clearly identified and distinguished from ordinary node entities. The nodes within the event chain subgraph are distinguished by the event instance naming method (such as "CPU alarm @ 2024-05-07 14:05") to prevent node overwriting.

[0075] Cross-chain and Cross-event Relationship Maintenance: For complex relationships involving multiple event chains or multiple devices, the system creates edges with clearly marked relationship types to maintain the global causal or associative relationships without destroying the independence of individual event chains.

[0076] c. Incremental Update Implementation Process Receive New Fault Data: Collect and parse new fault events (such as CPU overload, network timeout) and their associated attributes (host, timestamp, component identifier).

[0077] Node Instantiation and Link Judgment: Determine whether the event chain nodes already exist based on the host IP, component identifier, and event type. If it is a new event type, create new event chain nodes with the timestamp and event type as attributes.

[0078] Update Logic of Event Chain: Clearly add new event chain nodes to the end or suitable position of the existing event chain. If it is clearly determined that there is a logical or causal relationship between the new event and the previous event, automatically generate a new edge, and clearly record the relationship type (such as "causes", "occurs immediately after") and start time.

[0079] Maintenance of Attribute History of Event Chain Nodes: When the attributes of event chain nodes change (such as an increase in duration), only update the attribute history and do not modify the event type to maintain the consistency of the event chain.

[0080] d. Version Control and Management of Historical States of Event Chains When each event chain changes (such as adding nodes or relationships), automatically generate a subgraph snapshot or record an incremental change log, recording the clear timestamp of each change for subsequent backtracking.

[0081] Separation of Operation and Maintenance / Fault Knowledge Graph and Event Chain Snapshot: The operation and maintenance / fault knowledge graph and event chain subgraphs are separately snapshotted and incrementally logged. A clear snapshot management service is responsible for recording the time and identification number of each snapshot version.

[0082] e. Historical Event Chain Backtracking Method Based on the version management function of the operation and maintenance / fault knowledge graph, it is possible to implement the backtracking of the event chain state at a specified time: retrieve the nearest event chain snapshot through a clear time point.

[0083] Apply the incremental change log after the snapshot in chronological order to reconstruct the accurate historical state of the event chain.

[0084] Differential Analysis of Event Chain Paths: Support the differential analysis of event chain paths between two versions, provide a clear comparison of event chain node and relationship differences, and highlight the key node changes in fault evolution.

[0085] (2) Graph Retrieval Enhancement Module The graph retrieval enhancement module (corresponding to " Figure 1 "Graph Retrieval Enhancement" in Figure 1 ) receives a fault event (corresponding to " Figure 1 "Alarm / Fault Information" in Figure 1 ), performs a two-stage retrieval in the operation and maintenance / fault knowledge graph, extracts the "sub-picture segments" and "historical similar case sub-graphs" most relevant to the fault event (query problem), and constructs a knowledge embedding context. On this basis, the inference generation module uses the language understanding and generation capabilities of LLMs to output natural language questions and answers (corresponding to " Figure 1 "Output Intelligent Dialogue" in Figure 1 ) or structured task flow suggestions (corresponding to " Figure 1 "Fault Handling Task Flow Recommendation" output in

[0086] ). The input received by the graph retrieval enhancement module is the fault information of the fault event. The fault information can be triggered by the operation and maintenance system or a query problem manually input by the user. Based on the graph structure relationship, sub-graphs similar to the fault information and the most relevant sub-graphs are retrieved from the operation and maintenance / fault knowledge graph. Specifically, the retrieval process is divided into retrieval for semantic consistency and filtering for structural consistency.

[0087] For the fault information, the graph retrieval enhancement module first performs query enhancement. Query enhancement means identifying entities from the fault information, extracting the relationships between entities and aligning them with the entities and relationships in the ontology model, and extracting entity attributes from the fault context corresponding to the fault information to enrich the semantics of the entities, so as to ensure consistency, accuracy, and comprehensiveness during subsequent retrieval in the operation and maintenance / fault knowledge graph. After the fault information is query-enhanced (corresponding to " Figure 1 "query enhancement" in

[0088] ), the fault information is constructed as a graph structure query statement as a query statement.

[0088] Specifically, the fault information q is constructed as a graph structure query statement Q g , and it is transformed into a structured query vector Q using a pre-trained graph embedding model: ; The predefined sub-graphs (sub-graphs of fault events) Subgraph i in the operation and maintenance / fault knowledge graph are transformed into a structured vector sub-graph G i : ; where i is the number of the sub-graph; where, represents the graph embedding model.

[0089] To prevent excessive retrieval from introducing noise, the present invention uses enhanced graph queries to perform graph retrieval based on double-layer knowledge filtering in the operation and maintenance / fault knowledge graph, which can improve the retrieval accuracy. At the same time, based on structural template matching, the logic and causality of fault diagnosis are ensured, making it easier for subsequent automated task processing. This mechanism is particularly applicable to operation and maintenance diagnosis scenarios with high complexity, which can effectively reduce redundant sub-graph retrieval and improve the system response efficiency and user experience. The retrieval of the graph retrieval enhancement module is divided into two stages: Stage 1: Semantic consistency retrieval. Calculate the semantic similarity between the query vector Q and the vector sub-graph G i based on the semantic similarity formula, and filter out the vector sub-graph G i whose semantic similarity is lower than the set first threshold. Through this stage, vector sub-graphs G i that do not match the semantics of the query vector Q can be initially excluded, reducing the burden of subsequent processing.

[0090] Semantic similarity formula:

[0091] Each sub-graph G is represented as a vector sub-graph G i after passing through the semantic graph embedding encoder TransE (TransE model). Input the query vector Q, calculate its cosine similarity, and filter out the vector sub-graph G i whose similarity exceeds the first threshold θ by setting the first threshold θ. The filtered vector sub-graphs are called candidate sub-graphs, and the candidate sub-graphs are stored in the candidate sub-graph set. Then, the candidate sub-graphs in the candidate sub-graph set are subject to fine screening in the second stage.

[0092] Stage 2: Structural consistency filtering. To further improve the filtering accuracy, in this stage, a predefined template structure "component-metric-fault-repair" is used to perform refined structural matching on the candidate sub-graphs in the candidate sub-graph set.

[0093] (1) Predefined template structure Define the standard template structure M standard , which is expressed as follows: [Monitoring object]---has_metric--->[Metric]---causes-->[Fault event]--do--->[Repair operation] Its formal representation is as follows: Node combination: V M = {C, I, F, R} Among them, C (Component) is the monitored component, I (Indicator) is the monitoring metric, F (Fault) is the fault event, and R (Repair) is the repair operation.

[0094] Set of edge relations E M ={(C, I), (I, F), (F, R)}

[0095] (2)Extraction of the structural pattern of the candidate subgraph For the candidate subgraphs in the candidate subgraph set in the first stage, the subgraph structure is extracted by classifying the node and edge types. The structure of the candidate subgraph is represented as: V Subgraph = {C, I, F, R} E Subgraph ={(C, I), (I, F), (F, R)} (3)Matching score The structure matching formula between the structure of the candidate subgraph and the predefined template structure:

[0096] If the matching is successful, it is recorded as 1, otherwise it is 0; at the same time, considering the relationship integrity and node integrity, where: is the number of the same relations between the structure of the candidate subgraph and the predefined template structure, is the number of the same node types between the structure of the candidate subgraph and the template structure, is the total number of all nodes and edges in the predefined template structure (in this embodiment, it is 4 nodes + 3 edges = 7).

[0097] Based on the structure matching formula, the structure matching score of each candidate subgraph is obtained, and then the structure matching score is compared with the second threshold θ struct for comparison:

[0098] Thus, the final subgraph set is accurately screened. The final subgraph set is the subgraph information corresponding to the fault information.

[0099] Through the processing of semantic preliminary screening (stage one) and structural accurate screening (stage two), the present invention effectively reduces the false positive results, significantly improves the retrieval accuracy of the operation and maintenance / fault knowledge graph; at the same time, based on the template structure matching, the structure of the event chain is clearly defined, ensuring the logic and causality of the fault diagnosis, and laying a foundation for subsequent automated fault handling. This mechanism is especially applicable to high-complexity operation and maintenance diagnosis scenarios, and can effectively reduce redundant subgraph retrieval, improving the system response efficiency and user experience.

[0100] (III)Prompt construction module and inference generation module (corresponding to Figure 1 "prompt construction and inference generation" in The inference generation module performs subgraph recombination based on semantic fusion on the final subgraph set. During the training process of the large language model (LLM), a part of the training data is already in the operation and maintenance field. This stage is to ensure the utilization of external knowledge while avoiding over-reliance on retrieval results, retain the parameterized operation and maintenance knowledge of the LLM itself, and give play to the inference advantage.

[0101] The recombination is based on the Logits-Based Integration strategy. To balance external knowledge and the inference ability of the large language model (LLM) itself, the Logits-Based Integration strategy is adopted, that is, the output Logits of the LLM (in this invention, the distilled DistilQwen2.5-7b, that is, the large language model with 2.5 billion and 7 billion parameters of Qianwen) are obtained respectively in the cases of without external knowledge and combined with the retrieved subgraph information, and the two Logits are fused by weighting to generate the final response text.

[0102] The prompt construction module provides the inference generation module with structured natural language prompt fragments obtained by processing the fault information. In this application, the structured natural language prompt fragments include the first prompt fragment and the second prompt fragment.

[0103] (1) Input the fault information into the prompt construction module to obtain the first prompt fragment Prompt query , and the first prompt fragment Prompt query is input into the large language model to obtain the first output Logits LLM . The first output Logits LLM does not contain additional external knowledge and is only obtained by the inference of the LLM itself: Logits LLM = LLM DistilQwen (Prompt query ).

[0104] (2) Input the fault information and the subgraph information retrieved from the operation and maintenance / fault knowledge graph (such as the event chain path) into the prompt construction module to obtain the second prompt fragment Prompt combined . The second prompt fragment Prompt combined is input into the large language model to obtain the second output Logits KG . Therefore, the second output Logits KG is obtained by prompt inference by combining the subgraph information retrieved in two stages of the operation and maintenance / fault knowledge graph: Prompt combined = Prompt query + Prompt Retrieved_Subgraph Logits KG = LLM DistilQwen(Prompt combined )。

[0105] (3) Logits Weighted Fusion Strategy: Based on the weighted fusion formula, perform weighted fusion on the first output Logits LLM and the second output Logits KG to obtain the fused output.

[0106] Weighted Fusion Formula: Logits final = α · Logits KG + (1 - α) · Logits LLM where Logits final is the fused output, and α is the weight coefficient.

[0107] The weight coefficient α determines the influence degree of external knowledge. The closer α is to 1, the stronger the influence of external knowledge. The closer α is to 0, the more dominant the LLM's own reasoning is. Among them, the present invention supports two setting methods for α: the static method and the dynamic method. The static method is to manually set it to a value between [0, 1]. The dynamic method adaptively sets α according to the semantic relevance between the query question and the subgraph, that is, the higher the relevance of the retrieved content, the more valuable the retrieved subgraph is considered, then the weight of the second output Logits KG is higher. The dynamic formula of the dynamic method is: α = Sigmoid(β · Sim(Q, G best ) - γ) where Sim(Q, G best ) is the cosine similarity between the query vector Q and the most relevant vector subgraph G best retrieved; Sim is the cosine function; β and γ are training parameters; Sigmoid is used to constrain α to [0, 1].

[0108]

[0109] (4) Text Generation Based on the Fused Output Use the fused output Logits final to generate text, and use Softmax to obtain the probability distribution, thereby obtaining the final response text.

[0110]

[0111] where is the output probability of the k-th word (token) in the generated response.

[0112]

[0113] Then, the final response text is generated according to the maximum output probability path of each word (token). , and the final response text is the result of the fault analysis.

[0114] The fusion output of the present invention has strong controllability, and can accurately regulate the influence of external knowledge and the self - reasoning of the large - language model through the weight parameter α. The regulation method of the weight parameter α can be adaptively adjusted according to semantic relevance, effectively improving the generation quality, and better weighing accuracy and generalization at the same time: external knowledge improves the accuracy, and the self - reasoning ability of the LLM is fully utilized to ensure generalization, and the fusion strategy balances the two.

[0115] (4) Process parsing module and process execution module (corresponding to Figure 1 "process parsing and process execution" in The goal of the process parsing module is to automatically and accurately transform the final response text (fault analysis result) generated by the large - language model (LLM) based on operation and maintenance / fault knowledge graph retrieval (including event chain construction and dynamic update mechanism), two - stage graph retrieval filtering, and Logits fusion strategy into an executable structured task flow. The task flow realizes the closed - loop processing of faults through the process execution module calling the underlying operation and maintenance interfaces (such as automated script platforms, remote command systems, etc.). The process parsing module receives the fault analysis results (including fault diagnosis analysis, repair suggestions, operation steps, etc.) from the inference generation module, automatically parses them, and then performs structured natural - language output, constructs a directed acyclic graph for task execution (also called "task graph", represented by DAG), and automatically maps it with the predefined operation and maintenance operation templates to improve the automation, generalization ability and task execution efficiency. The process parsing module supports the manual confirmation mechanism for key tasks to ensure system security, and can feedback the processing results to the operation and maintenance / fault knowledge graph to realize the precipitation and traceable management of operation and maintenance knowledge.

[0116] The basic principle of the process parsing module can be divided into the following three stages: a. Conversion from natural language to task graph (DAG) In this stage, a dedicated natural - language task parser is designed to automatically parse the fault analysis results (including diagnosis, repair suggestions, operation steps) generated by the LLM into clear structured task nodes and DAG graphs.

[0117] (1) Text structured parsing (based on a lightweight parser) Using templates and lightweight natural - language task parsers (such as regular expressions, pattern matching, or lightweight RNN parsers), clear task information is extracted from the fault analysis results generated by the LLM, including: Task Nodes: Define the task types, such as alarm confirmation, service restart, configuration update, and script invocation.

[0118] Input Parameters: Include hostname, IP address, component name, service name, operation instruction, parameter value, etc.

[0119] Dependency Relationship: Identify the clear sequential dependency relationship between tasks (e.g., "Restart the database first, then resume the service").

[0120] (2) Construct the task graph Based on the extracted task nodes and dependency relationships, construct a complete directed acyclic graph (DAG) to clearly represent the execution order and logical relationship between tasks.

[0121] b. Automatic mapping and execution scheduling of the task flow In this stage, through the automatic mapping of task nodes to predefined operation templates for operation and maintenance, the DAG is transformed into an actually executable structured task flow: (1) Predefined operation templates for operation and maintenance (Operation Template) The operation templates for operation and maintenance predefined by the system clearly define the underlying execution methods corresponding to each task type: For example: Service restart: → systemctl restart {service name} Configuration modification: → Call the API to modify the configuration item Alarm confirmation: → Confirm through the alarm management platform API Execute the repair script: → Call the Bash / Python script Template example: templates: - task_type: service_restart cmmmand: “systemctl restart {service_name}” - task_type: config_update api_call:“POST / api / config / update” - task_type: alert_confirm api_call:“POST / api / alert / confirm” - task_type: run_script cmmmand:“ / scripts / {script_name}.sh{params}” (2) Automatic mapping of task nodes and instruction generation Based on the automatic mapping of task node information and operation and maintenance operation templates, executable instructions or API calls at the underlying layer are dynamically generated to form a complete task execution instruction sequence (i.e., a structured task flow).

[0122] (3) Execution feedback of the process execution module and knowledge graph writing-back mechanism The process execution module (execution engine) calls relevant scripts to implement the automatic closed-loop knowledge precipitation for fault handling. After the execution is completed, the alarm status and fault closed-loop information are automatically updated. After confirmation by the operation and maintenance engineer, the operation path is recorded in the operation and maintenance / fault knowledge graph to form an event link for quick positioning and recommendation of similar faults next time.

[0123] (1) Automatic update of status and closed-loop information: After successful execution, the relevant status is automatically updated to resolved, and after confirmation by the engineer, it is updated to confirmed. Clearly record the task execution path, operation details and results of this time.

[0124] (2) Writing-back to the operation and maintenance / fault knowledge graph: After confirmation by the operation and maintenance engineer, the executed task nodes and execution path are written back to the operation and maintenance / fault knowledge graph, and a new closed-loop event sub-graph is added.

[0125] The task parsing and orchestration method proposed by the present invention has a high degree of automation. Through the parser and automatic task mapping mechanism, the fault handling task can be efficiently executed without manual intervention. The method has strong generalization ability and can be widely applied to different types of faults and operation and maintenance scenarios through operation and maintenance operation templates and automatic mapping logic. The method has a closed-loop knowledge precipitation, supports writing back the execution results to the operation and maintenance / fault knowledge graph to form a closed-loop knowledge base, and continuously improves the operation and maintenance efficiency.

[0126] The graph retrieval enhancement module of the present invention structures the current system input fault information (such as "component = DM database, event = connection failure, metric = connection_count = 0"), retrieves relevant subgraphs in the operation and maintenance / fault knowledge graph, and uses a two-stage knowledge filtering mechanism (semantic retrieval + structural filtering) to remove irrelevant and redundant subgraphs, only retaining content with high context relevance. Then, the retrieval results are transformed into a structured prompt template and input into the locally deployed large language model to generate natural language Q&A or process suggestions. The key mechanisms for graph retrieval and generation include: using GraphSAGE + TransE as the graph embedding model to calculate the semantic distance between the query statement and the subgraph; introducing a two-stage filtering mechanism during graph retrieval and screening based on cosine similarity and graph structure matching degree; using a structured template to construct a prompt input with semantic paths; adopting a Logits fusion mechanism to balance the model's native reasoning ability and the effect of external knowledge injection; and relying on the locally deployed DistilQwen2.5-7B to implement the model generation process.

[0127] The process parsing module of the present invention parses the natural language results generated by the large language model into a structured task flow and realizes automatic execution through an execution engine (such as Ansible, a customized command scheduler, etc.). For sensitive operations involving core components, the system supports an approval process and a manual confirmation mechanism to ensure the controllability and security of the operations. After execution, the system writes back the entire process path of the fault information, operation process, and recovery effect to the operation and maintenance / fault knowledge graph to form a high-value subgraph for subsequent matching and recommendation.

[0128] The present invention further clarifies the knowledge write-back mechanism after the system executes tasks, forming a closed-loop knowledge precipitation and reuse of "fault - operation - result", highlighting that this is different from the one-way processing method of existing solutions.

[0129] In the embodiments of the present invention, the overall solution has the following technical advantages in technical implementation: High customization: Build a semantic ontology around the domestic software and hardware ecosystem, support multi-platform component modeling for Feiteng, Loongson, Kirin, DM, etc., and have the ability to fuse cross-platform fault semantics; combine the domestic software and hardware deployment structure, service topology, and operation and maintenance semantic features to customize and build a multi-level, highly consistent operation and maintenance / fault knowledge graph to ensure that the graph structure is inferable and extensible, meeting the actual domestic operation and maintenance environment requirements.

[0130] Strong semantic relevance and high retrieval accuracy: The present invention adopts a two-stage knowledge filtering mechanism. First, it calculates semantic similarity, and then filters out noisy subgraphs based on structural path matching. Finally, only the graph structures with high context relevance are retained for constructing Prompts, significantly improving the pertinence, accuracy, and interpretability of the output content of large language models.

[0131] High inference efficiency and low computing power requirements: The present invention selects a lightweight graph embedding model combination (TransE for relationship modeling and GraphSAGE for neighbor aggregation), and uses the domestic local large language model DistilQwen2.5-7b as the inference engine. After optimization based on INT4 quantization deployment, the video memory requirement does not exceed 8GB, and it can run stably under the Feiteng / Kunpeng / ARM architecture, meeting the edge computing and private deployment scenarios.

[0132] High process automation and strong closed-loop execution ability: The output of the large language model is parsed semantically and transformed into a structured task flow. Combined with a standardized operation and maintenance operation template, it automatically triggers a complete processing flow including network diagnosis, service restart, and metric inspection. The system supports a manual confirmation mechanism and task execution feedback to be written back to the operation and maintenance / fault knowledge graph, constructing a knowledge closed-loop of "fault-operation-result" to improve operation and maintenance intelligence and knowledge reuse ability.

[0133] Modules are pluggable and the system is evolvable: The system architecture adopts a modular design. The construction of the operation and maintenance / fault knowledge graph, graph retrieval, and large language model call are decoupled from each other, and can be flexibly adapted to existing operation and maintenance platforms (such as log alarm systems and task scheduling systems). The content of the knowledge graph supports continuous learning and dynamic update, and the model prompts can be iteratively evolved to continuously enhance the fault identification and handling capabilities.

[0134] The execution method of the graph retrieval enhanced system includes the following steps: Step S1: Input the fault information of the fault event into the graph retrieval enhanced system; the fault information includes content such as host IP, component type, fault phenomenon, and associated metrics.

[0135] Step S2: The graph construction and update module standardizes the fields of the fault information, performs entity recognition and semantic mapping based on the ontology model to generate triples, and then writes the triples into the operation and maintenance / fault knowledge graph, executes the operation and maintenance / fault knowledge graph update strategy, and maintains the historical version and event chain; Step S3: Input the fault information into the graph retrieval enhanced module for filtering and retrieval; the graph retrieval enhanced module performs two-stage filtering and retrieval based on the operation and maintenance / fault knowledge graph to screen out the subgraph information corresponding to the fault information. Specifically, step S3 includes the following steps: Step S31: The graph retrieval enhancement module constructs the fault information into a graph-structured query statement, and then uses a graph embedding model to transform the graph-structured query statement into a structured query vector; Step S32: The graph retrieval enhancement module uses a graph embedding model to transform the predefined subgraphs in the operation and maintenance / fault knowledge graph into structured vector subgraphs; Step S33: The graph retrieval enhancement module calculates the semantic similarity between the structured query vector and the structured vector subgraph based on a semantic similarity formula, and performs a preliminary screening on the structured vector subgraph based on a first threshold to obtain candidate subgraphs, which are stored in a candidate subgraph set; Step S34: Perform structural pattern extraction on the candidate subgraphs in the candidate subgraph set respectively to obtain the structures of the respective candidate subgraphs; Step S35: Perform a structural matching score on the structures of the respective candidate subgraphs and a predefined template structure based on a structure matching formula, and perform a refined screening on the candidate subgraphs in the candidate subgraph set based on a second threshold to obtain a final subgraph set; the final subgraph set is the subgraph information corresponding to the fault information.

[0136] Step S4: The prompt word construction module transforms the fault information and the screened subgraph information into structured natural language prompt fragments (for example: "The number of connections to the DM database on host A is 0, and the historical processing path is to restart the connection pool"). The structured language prompt fragments include a first prompt fragment and a second prompt fragment. The first prompt fragment is generated by the prompt word construction module based on the fault information, and the second prompt fragment is generated by the prompt word construction module based on the fault information and the subgraph information.

[0137] Step S5: The inference generation module calls a large language model (DistilQwen2.5-7b) to perform natural language question answering in combination with the structured natural language prompt fragments to generate a fault analysis result. The fault analysis result includes a fault analysis, possible causes, and task process recommendations, as well as the original text link retrieved from the operation and maintenance / fault knowledge graph. The specific implementation steps of this step are as follows: Step S51: The inference generation module inputs the first prompt fragment into the large language model to obtain a first output; Step S52: The inference generation module inputs the second prompt fragment into the large language model to obtain a second output; Step S53: The inference generation module performs weighted fusion on the first output and the second output to obtain a fused output; Step S54: The inference generation module performs text generation on the fused output and uses Softmax to obtain a probability distribution to obtain a final response text; the final response text is the fault analysis result.

[0138] Step S6: The process parsing module parses the fault analysis result generated by the large language model into a structured task flow (including information such as operation instructions, execution order, and dependency relationships), identifies high-risk operations in the structured task flow, and determines whether the high-risk operations require user confirmation.

[0139] Step S6 includes the following steps: Step S61: The process parsing module inputs the fault analysis result into the natural language task parser to extract task information; Step S62: The process parsing module constructs a directed acyclic graph based on the extracted task information; Step S63: The process parsing module converts the directed acyclic graph into a structured task flow, identifies high-risk operations in the structured task flow, and determines whether the high-risk operations require user confirmation.

[0140] Step S7: The process execution module (execution engine) sequentially calls corresponding scripts (such as ping, restart service, check metrics) to schedule and execute the structured task flow, thereby completing the actual operation and maintenance process; during this period, the execution status, error code, and result information are recorded in real time.

[0141] Step S8: After the process execution module finishes execution, the graph retrieval and enhancement system writes the whole process of "fault input - reasoning analysis - operation execution - recovery result" back to the operation and maintenance / fault knowledge graph as a reusable knowledge path for matching in the next similar fault event.

[0142] Step S9: If the graph retrieval and enhancement system receives new fault information, it returns to Step S1 to restart the processing flow; if there is no input, it enters the standby state.

[0143] The present invention has the ability of automated closed-loop task execution and generalization. Through a specially designed natural language task parser, the present invention automatically parses the text result generated by the large language model into clear task nodes and task graphs, and automatically maps them to predefined operation and maintenance operation templates to achieve automatic scheduling and execution, with significantly higher dynamic response ability and multi-step operation and maintenance operation generalization ability than the traditional static template recommendation method.

[0144] The present invention has a sustainable self-evolving knowledge closed-loop mechanism. The system automatically writes the process and result of task execution back to the operation and maintenance / fault knowledge graph after manual confirmation, forming a closed-loop knowledge chain in the structure of "fault - operation - result" to realize the precipitation and continuous reuse of operation and maintenance experience, ensuring that the operation and maintenance / fault knowledge graph and the degree of operation and maintenance intelligence can continuously improve over time.

[0145] The present invention has the advantages of deployment and adaptation on domestic platforms with low computing power, realizes the INT4 quantization deployment of a lightweight large language model (DistilQwen2.5-7B), controls the video memory overhead within 4GB, ensures stable and efficient operation on domestic CPU platforms such as Feiteng, Kunpeng, and Haiguang, and edge computing environments, has strong environmental adaptability, engineering practicability, and scalability, significantly reduces the deployment cost, and meets the actual deployment requirements of domestic software and hardware environments.

[0146] Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts fall within the scope of protection of the present invention.

Claims

1. Execution method of a large model graph retrieval enhancement system for software and hardware monitoring and operation and maintenance, characterized in that The graph retrieval enhancement system includes a graph construction and update module, a graph retrieval enhancement module, a prompt construction module, an inference generation module, a process parsing module, and a process execution module; the graph construction and update module is used to construct an operation and maintenance / fault knowledge graph and update the operation and maintenance / fault knowledge graph; The graph retrieval enhancement system is used to execute and process the fault information of a fault event; The execution method of the graph retrieval enhancement system includes the following steps: Step S1: Input the fault information of the fault event into the graph retrieval enhancement system; Step S2: The graph construction and update module receives and processes the fault information of the fault event, generates triples, writes the triples into the operation and maintenance / fault knowledge graph, and updates the operation and maintenance / fault knowledge graph; Step S3: Input the fault information into the graph retrieval enhancement module; the graph retrieval enhancement module performs two-stage filtering retrieval based on the operation and maintenance / fault knowledge graph to screen out sub-graph information corresponding to the fault information; Step S4: The prompt construction module converts the fault information and the screened sub-graph information into a structured natural language prompt segment; Step S5: The inference generation module calls a large language model to perform natural language Q&A in combination with the structured natural language prompt segment to generate a fault analysis result.

2. The execution method of the large model graph retrieval enhancement system for software and hardware monitoring and operation and maintenance according to claim 1, characterized in that, The graph retrieval enhancement system also includes a process parsing module and a process execution module; the execution method also includes Step S6 and Step S7; Step S6: The process parsing module parses the fault analysis result generated by the large language model into a structured task flow; Step S7: The process execution module sequentially calls corresponding scripts to schedule and execute the structured task flow and records the execution result.

3. The execution method of the large model graph retrieval enhancement system for software and hardware monitoring and operation and maintenance according to claim 2, characterized in that, The graph construction and update module constructs an operation and maintenance / fault knowledge graph based on an ontology model; the ontology model is modeled based on the semantic relationships among software and hardware components, fault time, monitoring metrics, and operation and maintenance actions in an IT system; the ontology model can be divided into entities, relationships, and attributes; The process of constructing an operation and maintenance / fault knowledge graph based on the ontology model is as follows: perform field standardization processing on the original data in the unstructured knowledge base, and then input the original data after field standardization processing into the ontology model for entity recognition and semantic mapping to obtain the operation and maintenance / fault knowledge graph.

4. The execution method of the large model graph retrieval enhancement system for software and hardware monitoring and operation and maintenance according to claim 1, characterized in that, Step S3 includes the following steps: Step S31: The graph retrieval enhancement module constructs the fault information into a graph structure query statement, and then uses a graph embedding model to convert the graph structure query statement into a structured query vector; Step S32: The graph retrieval enhancement module converts the predefined sub-graphs in the operation and maintenance / fault knowledge graph into structured vector sub-graphs; Step S33: The graph retrieval enhancement module calculates the semantic similarity between the structured query vector and the structured vector sub-graph based on a semantic similarity formula, and performs a preliminary screening on the structured vector sub-graph based on a first threshold to obtain candidate sub-graphs, and stores the candidate sub-graphs in a candidate sub-graph set; Step S34: Extract the structural patterns of the candidate sub-graphs in the candidate sub-graph set respectively to obtain the structures of the respective candidate sub-graphs; Step S35: Perform structural matching scoring on the structures of each candidate subgraph and a predefined template structure based on a structural matching formula, and conduct fine screening based on a second threshold to obtain a final set of subgraphs; the final set of subgraphs is the subgraph information corresponding to the fault information.

5. The execution method of the large model graph retrieval enhancement system for software and hardware monitoring and operation and maintenance according to claim 4, characterized in that, In step S4, the structured language prompt segment includes a first prompt segment and a second prompt segment. The first prompt segment is generated by the prompt word construction module based on the fault information, and the second prompt segment is generated by the prompt word construction module based on the fault information and the subgraph information. Step S5 includes the following steps: Step S51: The inference and generation module inputs the first prompt segment into the large language model to obtain a first output. Step S52: The inference and generation module inputs the second prompt segment into the large language model to obtain a second output. Step S53: The inference and generation module performs weighted fusion on the first output and the second output to obtain a fused output. Step S54: The inference and generation module generates text based on the fused output and uses Softmax to obtain a probability distribution to get the final response text; the final response text is the fault analysis result.

6. The execution method of the large model graph retrieval enhancement system for software and hardware monitoring and operation and maintenance according to claim 5, characterized in that, In step S53, the inference and generation module performs weighted fusion on the first output and the second output based on a weighted fusion formula to obtain a fused output. The weighted fusion formula is: Logits final = α · Logits KG + (1 - α) · Logits LLM ; Among them, Logits final is the fusion output, α is the weight coefficient, Logits KG is the second output, and Logits LLM is the first output.

7. The execution method of the large model graph retrieval enhancement system for software and hardware monitoring and operation and maintenance according to claim 6, characterized in that, The value of α is set based on a static method or a dynamic method; the value of α is within the range of [0, 1].

8. The execution method of the large model graph retrieval enhancement system for software and hardware monitoring and operation and maintenance according to claim 7, characterized in that, The static method means setting the value of α in advance. The dynamic method means calculating and setting the value of α based on a dynamic formula. The dynamic formula is: α = Sigmoid(β·Sim(Q, G best ) - γ); where Sim(Q, G best ) is the cosine similarity between the query vector Q and the most relevant vector subgraph G best ; β and γ are training parameters; Sigmoid is used to constrain the value of α between [0, 1].

9. The execution method of the large model graph retrieval enhancement system for software and hardware monitoring and operation and maintenance according to claim 2, characterized in that, Step S6 includes the following steps: Step S61: The process analysis module inputs the fault analysis result into the natural language task parser to extract task information. Step S62: The process analysis module constructs a directed acyclic graph according to the extracted task information. Step S63: The process analysis module converts the directed acyclic graph into a structured task flow.

Images