Root cause analysis method and device based on large language model, equipment and medium

Abstract

The invention discloses a root cause analysis method and device based on a large language model, equipment and a medium. The method comprises the steps that a target entity and a topological relation are extracted in response to a root cause analysis request; searching matched historical root cause cases in a vector database, inputting the topological relation, the historical root cause cases and cue words into a large language model to generate a doubtful point list, and extracting downstream entities in the doubtful point list; calling a detection tool to collect entity diagnosis data and identify abnormal downstream entities; returning to execute the operation of retrieving the historical root cause case until a preset iteration ending condition is met; and inputting the final doubtful point list, the abnormal diagnosis data, the topological relation and the historical root cause case into the large language model again to obtain a root cause reasoning result and generate a root cause report. According to the embodiment of the invention, through the full-chain design of natural language understanding, topological constraint, historical cases, dynamic detection and iterative reasoning, the fault positioning efficiency and the root cause accuracy are improved, and the operation and maintenance labor cost and the service fault time consumption are remarkably reduced.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence technology, and in particular to a root cause analysis method, device, equipment and medium based on a large language model. Background Art

[0002] In computer systems, the core goal of root cause analysis is to quickly locate the underlying cause of a failure or performance issue to guide repairs, improve system reliability, and prevent similar issues from recurring. However, modern system architectures present numerous challenges for root cause analysis, making intelligent root cause analysis methods that integrate causal reasoning, machine learning, and domain knowledge a research priority.

[0003] Although the current troubleshooting method that relies on GROOT supports custom events and causal rules, it relies too much on manually defined causal rules, has a limited degree of automation, lacks adaptability and analysis efficiency in complex dynamic systems, and the accuracy of causal inference is also limited by the coverage of manual rules. The method of using intelligent language models for troubleshooting relies on language instructions and historical information to infer the cause of the fault. However, due to the lack of a priori vertical operation and maintenance domain knowledge system, knowledge is only injected through prompt words. In the long process of root cause analysis, as the context of historical conversations, monitoring data, etc. continues to grow, the model's ability to follow the initial instructions is significantly reduced, and the problem of reasoning target drift is prone to occur. Summary of the Invention

[0004] Based on this, the present invention provides a root cause analysis method, device, equipment and medium based on a large language model to solve the problems in existing root cause analysis methods such as strong reliance on manual rules, easy drift of large model reasoning and poor adaptability to complex systems.

[0005] In a first aspect, an embodiment of the present invention provides a root cause analysis method based on a large language model, comprising:

[0006] In response to a root cause analysis request submitted by a user in natural language, the name of the target entity of the anomaly root cause to be located and the topological relationship of the target entity are extracted as clue information;

[0007] Retrieve historical root cause cases that match the clue information from the vector database, and input the topological relationship in the clue information, the retrieved historical root cause cases, and the preset prompt words into the large language model;

[0008] After generating a list of doubts matching the target entity through a large language model, extract the downstream entities that cause the target entity to be abnormal from the list of doubts;

[0009] Calling the detection tools corresponding to each downstream entity to collect entity diagnostic data corresponding to each downstream entity, and identifying and outputting abnormal downstream entities in each downstream entity based on the entity diagnostic data;

[0010] After generating new clue information based on each abnormal downstream entity, the process returns to searching the vector database for historical root cause cases that match the clue information until the preset iteration end condition is met.

[0011] The final list of doubts generated in the last iteration, the abnormal diagnosis data generated during the iteration, the topological relationships, and the historical root cause cases are input into the large language model again to obtain the root cause reasoning results. Based on the root cause reasoning results, a root cause report matching the root cause analysis request is generated.

[0012] In a second aspect, an embodiment of the present invention further provides a root cause analysis device based on a large language model, comprising:

[0013] A root cause analysis request response module is used to respond to a root cause analysis request submitted by a user in natural language and extract the name of the target entity of the anomaly root cause to be located and the topological relationship of the target entity as clue information;

[0014] A vector database retrieval module is used to retrieve historical root cause cases that match the clue information in the vector database, and input the topological relationship in the clue information, the retrieved historical root cause cases, and the preset prompt words into the large language model;

[0015] The downstream entity extraction module is used to generate a list of doubt points that match the target entity through a large language model, and then extract the downstream entities that cause the target entity to be abnormal from the list of doubt points;

[0016] An abnormal entity identification module is used to call the detection tools corresponding to each downstream entity to collect entity diagnostic data corresponding to each downstream entity, and identify and output abnormal downstream entities in each downstream entity based on the entity diagnostic data;

[0017] The loop iteration module is used to generate new clue information based on each abnormal downstream entity, and then return to perform the operation of searching the vector database for historical root cause cases that match the clue information until the preset iteration end condition is met;

[0018] The root cause reasoning result generation module is used to input the final doubt list generated in the last iteration, the abnormal diagnosis data generated during the iteration, the topological relationships, and the historical root cause cases into the large language model again to obtain the root cause reasoning results, and generate a root cause report that matches the root cause analysis request based on the root cause reasoning results.

[0019] In a third aspect, an embodiment of the present invention further provides an electronic device, comprising:

[0020] at least one processor; and

[0021] a memory communicatively connected to the at least one processor; wherein,

[0022] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can perform the root cause analysis method based on a large language model described in any embodiment of the present invention.

[0023] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement a root cause analysis method based on a large language model described in any embodiment of the present invention when executed.

[0024] The embodiment of the present invention uses topological relationships as reasoning constraints to ensure that the list of doubts generated by the large model conforms to the impact path from the target entity to the downstream entity, reducing invalid troubleshooting directions; gradually narrows the scope of the fault through the closed loop of "detection-analysis-redetection", improves the accuracy of root cause location, and avoids misjudgment of single-round reasoning; incremental learning of historical cases and dynamic expansion of detection tools adapt to complex scenarios and continuously improve the system's fault identification capabilities. Through the full-chain design of natural language understanding + topological constraints + historical cases + dynamic detection + iterative reasoning, the traditional manual root cause analysis experience-based and trial-and-error troubleshooting mode is transformed into an automated process driven by data and intelligent reasoning, improving fault location efficiency and root cause accuracy, and significantly reducing operation and maintenance labor costs and business failure time.

[0025] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present invention, nor is it intended to limit the scope of the present invention. Other features of the present invention will become readily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0027] Figure 1 is a flowchart of a root cause analysis method based on a large language model according to embodiment 1 of the present invention;

[0028] Figure 2 is a flowchart of another root cause analysis method based on a large language model according to embodiment 2 of the present invention;

[0029] Figure 32 is a schematic structural diagram of a root cause analysis device based on a large language model according to a third embodiment of the present invention;

[0030] Figure 4 The present invention is a schematic structural diagram of an electronic device for implementing a root cause analysis method based on a large language model according to an embodiment of the present invention. DETAILED DESCRIPTION

[0031] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of the present invention.

[0032] It should be noted that the terms "first", "second", etc. in the description and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0033] Example 1

[0034] Figure 1 This is a flowchart of a root cause analysis method based on a large language model provided in the first embodiment of the present invention. This embodiment is applicable to the situation of locating computer system failures or performance problems. The method can be performed by a root cause analysis device based on a large language model. The device can be implemented in the form of hardware and / or software. The device can be configured in a complex computer system containing multiple layers of heterogeneous components. Figure 1 As shown, the method includes:

[0035] S110 : In response to a root cause analysis request submitted by a user in natural language, extract the name of a target entity of the abnormality root cause to be located and the topological relationship of the target entity as clue information.

[0036] A natural language request submitted by a user, such as "On November 12, 2024, an exception alarm occurred on the frontend interface. What is the root cause?" is essentially an unstructured semantic description, including a specific timestamp (November 12, 2024), a vague fault symptom (the exception alarm), and a potential target entity (the frontend interface). The core of this step is to transform implicit references and vague expressions in human language into precise entities and relationships that the system can understand.

[0037] After extracting the target entity, we can use graph query to obtain its N-hop neighbor nodes and their relationship types, and construct a complete topology diagram (such as "frontend interface → load balancer → backend service → database"). This process transforms the user's unstructured problem into a structured entity-relationship network, providing a clear starting point and path constraints for subsequent root cause analysis.

[0038] Optionally, in response to a root cause analysis request submitted by a user in natural language, extracting the name of a target entity of the anomaly root cause to be located and the topological relationship of the target entity as clue information may include:

[0039] Extract the name of the target entity carried in the root cause analysis request through the named entity recognition model;

[0040] According to the name of the target entity, a topological relationship graph between entities corresponding to the target entity is obtained based on the graph database as the topological relationship of the target entity;

[0041] Convert the text features and topological relationships of the target entity into vector representations to form an abnormal feature vector;

[0042] A specified number of historical root cause cases matching the abnormal feature vector are retrieved from a vector database, wherein the historical root cause cases include abnormal entities, root cause paths describing abnormal types, and solutions.

[0043] When extracting clue information, in addition to basic entity and topology acquisition, the target entity text is converted into a semantic vector through models such as BERT, and the topological relationship graph is mapped into a structural vector using the graph neural network algorithm. The abnormal feature vector formed after fusion can simultaneously represent the problem semantics and the fault propagation path; when the vector database retrieves historical cases based on this feature vector, it will match records containing abnormal entities, root cause paths and solutions. For example, if a "user service interface anomaly" is detected, if the interface failure in historical cases mostly originates from the downstream database, the database will be directly listed as a high-priority suspicious point.

[0044] S120 , searching the vector database for historical root cause cases that match the clue information, and inputting the topological relationship in the clue information, the retrieved historical root cause cases, and the preset prompt words into the large language model.

[0045] After the clue information (including the target entity name and topological relationship) is extracted, historical root cause cases that match the clue information will be retrieved in the vector database. A vector database is a database specifically used to store and retrieve vector data. It can quickly find historical cases with similar semantics or features to the current clue information by calculating the similarity between vectors. For example, if the current clue information revolves around "frontend interface abnormality alarm", the vector database may retrieve historical root cause cases that have occurred in the past, such as "frontend interface response timeout due to traffic surge", "frontend interface and backend service connection interruption triggering alarm", etc. These cases record abnormal entities, root cause paths and solutions, which are valuable prior knowledge.

[0046] The topological relationships in the clue information are then processed and converted into structured text that can be understood by the large language model. For example, a topological relationship such as "frontend interface → load balancer → backend service → database" is encoded into JSON format or other structured formats that contain dependencies between entities. At the same time, key elements of the retrieved historical root cause cases are extracted, such as the abnormal entity (such as the backend service), the abnormality type (such as a connection interruption), and the root cause path (such as a network failure between the frontend interface and the backend service causing data transmission abnormalities), to generate a historical root cause mapping set.

[0047] Furthermore, the topological relationship in the clue information, the retrieved historical root cause cases, and the preset prompt words are input into the large language model, which may include:

[0048] Structural encoding of the topological relationship graph of the target entity to form a structured text containing the dependency relationships between entities;

[0049] Extract the abnormal entities, abnormal types, and root cause paths from historical root cause cases to generate a historical root cause mapping set;

[0050] Input structured text, historical root cause mapping set, and preset prompt words into the large language model;

[0051] Accordingly, a large language model is used to generate a list of doubts matching the target entity, including:

[0052] Through a large language model, based on the input structured text, historical root cause mapping set, and preset prompt words, a list of doubts is generated, including the target entity, exception type, and the association path between the target entity and downstream entities.

[0053] The topological relationship diagram in the graph database (such as "Service A → Service B → Database") is converted into structured text such as JSON or XML to clarify the dependency direction and weight between entities (such as "Service A calls Service B 100 times / second"), so that the model can understand the potential paths of fault propagation. From the retrieved cases, a set of triple mappings of "abnormal entity (such as database) - abnormal type (such as connection timeout) - root cause path (Service A → Service B → Database connection pool exhaustion)" is extracted to form a reusable fault pattern knowledge base. Based on the "path constraints" of the structured topology and the "pattern reference" of historical cases, the large model generates doubts containing specific abnormality types and associated paths, for example: [{"target entity": "Service A", "abnormal type": "Response timeout", "associated path": "Service A → Service B → Database I / O abnormality"}], ensuring that each doubt is supported by topological logic or historical experience.

[0054] S130: After generating a list of doubtful points matching the target entity through the large language model, extract the downstream entities that cause the target entity to be abnormal from the list of doubtful points.

[0055] After the topological relationships, historical root cause cases, and preset prompt words in the clue information are input into the large language model, the large language model will analyze the input content based on its own language understanding and reasoning capabilities to generate a list of doubts that match the target entity. The list of doubts is a set of preliminary speculations on the possible causes of abnormalities in the target entity, presented in a structured form. For example, each doubt may contain information such as the type of abnormality and the path associated with the target entity. For example, for the target entity "abnormal alarm on the frontend interface", the list of doubts may include speculations such as "backlog alarm of frontend interface requests due to slow response of backend service" and "overload alarm of frontend interface traffic due to error in load balancer allocation strategy".

[0056] In this topological relationship, a downstream entity refers to a component that has a dependency on the target entity and is located after the target entity in the direction of data flow or service call. Taking the aforementioned suspicious points as an example, the "backend service" and "load balancer" are the downstream entities of the "frontend interface." Extracting downstream entities is intended to further narrow the scope of investigation, transforming the abstract speculations of the large language model into concrete, verifiable objects. This prepares for the subsequent call of detection tools to collect diagnostic data, thereby verifying the authenticity of these suspicious points and ensuring that root cause analysis can gradually deepen from preliminary speculation to actual verification.

[0057] S140 , calling the detection tool corresponding to each downstream entity to collect entity diagnosis data corresponding to each downstream entity, and identifying and outputting abnormal downstream entities in each downstream entity according to the entity diagnosis data.

[0058] First, based on the preset "entity-detection tool" mapping, the matching tool for each downstream entity is determined. For example, if the downstream entity is "database," a SQL performance analysis tool or monitoring probe is invoked. This mapping is typically predefined based on operational domain knowledge to ensure a precise match between the tool and the entity's monitoring requirements. Second, the system dynamically generates parameter configurations for the detection tool based on different anomaly types (such as "response timeout" or "connection interruption"). For example, if the suspicion points to "slow database query," the detection parameter might be "query response time threshold set to 500ms." The diagnostic data for the downstream entity may include performance metrics (such as CPU utilization and disk I / O rate); log records (such as error stacks and slow query logs); and status information (such as number of connections and resource utilization). Each entity's diagnostic data is compared against a preset standard threshold (such as a database CPU utilization threshold of 80%). If the data exceeds the threshold, the downstream entity is identified as abnormal. For example, if "database disk I / O latency reaches 200ms" (the standard threshold is 100ms), "database" is output as an abnormal downstream entity.

[0059] S150. After generating new clue information according to each abnormal downstream entity, return to perform the operation of searching the vector database for historical root cause cases that match the clue information until the preset iteration end condition is met.

[0060] Once abnormal downstream entities are identified, they are used as new analysis targets, generating new clues containing their names and corresponding topological relationships. For example, if "database" is detected as an abnormal downstream entity, the new clues will focus on the database's topological relationship (e.g., "database → storage cluster → network switch"). This extends the scope of root cause analysis from upper-level entities (such as the frontend interface) down to lower-level components, forming a progressive logic for tracing the problem to its source.

[0061] After generating new clues, the vector database search operation is re-executed to find historical cases that match the new clues. This process is consistent with the logic of the first round of analysis, but the input information is now dynamically adjusted based on the latest abnormal entities, ensuring that the historical cases are more accurate. Through the iterative cycle of "case search → large model inference → detection and verification", the system continuously narrows down the root cause until the preset termination condition is met. In this embodiment of the present invention, the preset termination condition can be reaching a preset number of cycles.

[0062] S160: The final doubt list generated in the last iteration, the abnormal diagnosis data generated during the iteration, the topological relationships, and the historical root cause cases are input into the large language model again to obtain the root cause reasoning results, and based on the root cause reasoning results, a root cause report matching the root cause analysis request is generated.

[0063] The large language model builds causal associations based on input data. For example, by combining diagnostic data on "database disk I / O latency exceeding the standard," the topological path of "database-dependent storage system," and the historical case pattern of "storage media failure causing I / O anomalies," it generates the conclusion that the root cause of the frontend interface response anomaly is a read / write error on the storage disk of the database cluster's master node, causing a data query delay of 180ms (exceeding the standard threshold of 100ms), resulting in a backend service request backlog and ultimately an interface timeout.

[0064] Optionally, after outputting the root cause report when the root cause reasoning result meets the root cause determination condition, the following steps may also be performed:

[0065] Receive target feedback information with a confirmation mark issued by the user in response to the root cause report, and add the abnormal entity, root cause path, and solution in the target root cause report corresponding to the target feedback information to the historical root cause case library according to a preset data structure;

[0066] Based on the vector database, the target root cause report newly added to the historical root cause case library is vectorized and encoded, and a fast search index with entity name, topological relationship, and anomaly type as dimensions is established for use in the retrieval and matching of historical root cause cases.

[0067] The embodiment of the present invention uses topological relationships as reasoning constraints to ensure that the list of doubts generated by the large model conforms to the impact path from the target entity to the downstream entity, reducing invalid troubleshooting directions; gradually narrows the scope of the fault through the closed loop of "detection-analysis-redetection", improves the accuracy of root cause location, and avoids misjudgment of single-round reasoning; incremental learning of historical cases and dynamic expansion of detection tools adapt to complex scenarios and continuously improve the system's fault identification capabilities. Through the full-chain design of natural language understanding + topological constraints + historical cases + dynamic detection + iterative reasoning, the traditional manual root cause analysis experience-based and trial-and-error troubleshooting mode is transformed into an automated process driven by data and intelligent reasoning, improving fault location efficiency and root cause accuracy, and significantly reducing operation and maintenance labor costs and business failure time.

[0068] Example 2

[0069] Figure 2 This is a flowchart of another root cause analysis method based on a large language model provided in Example 2 of the present invention. This embodiment is refined based on Example 1. Specifically, Figure 2As shown, the method includes:

[0070] S210 : In response to a root cause analysis request submitted by a user in natural language, extract the name of a target entity of the abnormality root cause to be located and the topological relationship of the target entity as clue information.

[0071] S220 , searching the vector database for historical root cause cases that match the clue information, and inputting the topological relationship in the clue information, the retrieved historical root cause cases, and the preset prompt words into the large language model.

[0072] S230: After generating a list of doubtful points matching the target entity through the large language model, extract the downstream entities that cause the target entity to be abnormal from the list of doubtful points.

[0073] S240: Obtain the detection tools corresponding to each downstream entity according to the mapping relationship between the entity and the detection tool.

[0074] Based on the preset mapping between entities and detection tools, a dedicated tool is matched to each downstream entity. For example, Prometheus and Percona Toolkit are used for database master nodes, and Smartctl and iostat are used for storage disks. Prometheus is used to monitor overall server disk metrics. When an alarm is triggered, iostat is used to further analyze the I / O wait time of specific disks. If an anomaly is found, Smartctl is used to detect physical damage to the disk. After optimizing MySQL slow queries with Percona Toolkit, iostat is used to observe whether the disk I / O load has decreased due to the improved SQL efficiency.

[0075] When a downstream entity needs to be detected, the tool can be retrieved directly from the mapping table by name. The mapping relationship supports manual addition or intelligent expansion of large models based on historical cases, ensuring fast and accurate matching of detection tools and avoiding manual misselection.

[0076] S250 , generating dynamic parameters corresponding to each detection tool according to the mapping relationship between the anomaly type and the detection parameter, and calling each detection tool according to each dynamic parameter to perform a detection operation corresponding to each downstream entity.

[0077] Establish an "anomaly type-detection parameter mapping table" in advance. During detection, extract the corresponding parameters from the table based on the anomaly type. Fine-tune the analysis based on real-time scenarios and call the detection tool through the command line or API to ensure that diagnostic data is obtained with accurate parameters. For example, call Prometheus through the API to obtain the CPU usage indicator of the database node.

[0078] S260 . Identify and output abnormal downstream entities in each downstream entity based on the entity diagnostic data corresponding to each downstream entity returned by all detection tools and the standard data threshold corresponding to each downstream entity.

[0079] Preset thresholds for detection metrics for each downstream entity, such as: database CPU utilization threshold: 80%; disk I / O latency threshold: 100ms; switch port packet loss rate threshold: 0.1%. The entity diagnostic data returned by the detection tool is compared against the thresholds. If a metric exceeds the threshold, it is considered an anomaly. For example, if Prometheus returns database CPU utilization of 85% (exceeding the 80% threshold), the "database master node" is marked as an anomaly. Downstream entities exceeding the threshold are output in the format of "entity name + anomaly metric + deviation degree", for example: [Database master node, CPU utilization 85% (threshold 80%), deviation 5%].

[0080] S270. After generating new clue information according to each abnormal downstream entity, return to perform the operation of searching the vector database for historical root cause cases that match the clue information until the preset iteration end condition is met.

[0081] S280. The final doubt list generated in the last iteration, the abnormal diagnosis data generated during the iteration, the topological relationships, and the historical root cause cases are input into the large language model again to obtain the root cause reasoning results, and based on the root cause reasoning results, a root cause report matching the root cause analysis request is generated.

[0082] Optionally, based on the root cause inference results, a root cause report matching the root cause analysis request is generated, which may include:

[0083] Check whether the abnormal entity name in the root cause reasoning result completely matches the node name in the topological relationship, and whether all downstream entities of the target entity involved exist in the downstream hierarchical structure defined by the topological relationship;

[0084] If so, the abnormal entity name in the root cause reasoning result is standardized and mapped according to the node identification rules of the topological relationship graph;

[0085] Based on the root cause path in the root cause reasoning results and the abnormal entity diagnosis data, a predefined visualization template is called to automatically generate a root cause analysis report including a trend chart.

[0086] Generating a root cause analysis report involves three key steps: first, verifying whether the abnormal entity in the root cause reasoning result exactly matches the node name in the topology diagram, and confirming that all downstream entities are indeed downstream of the target entity in the topology hierarchy to avoid reverse logic errors. If the verification passes, the abnormal entity is first standardized according to the naming rules of the topology diagram. Then, based on the root cause path and diagnostic data (such as the disk latency curve), a visualization template is called to automatically generate a report containing a topology impact heat map, an I / O latency trend table, and a repair plan. This ensures that operations and maintenance personnel can accurately locate the fault through standardized entity names and quickly understand the fault propagation logic from the visualization chart.

[0087] Furthermore, after detecting whether the abnormal entity name in the root cause reasoning result completely matches the node name in the topological relationship, and whether all downstream entities of the target entity involved exist in the downstream hierarchical structure defined by the topological relationship, the following steps may also be included:

[0088] If not, generating a supplementary detection instruction for at least one supplementary detection entity through a large language model based on the entity names and topological relationships extracted in the root cause analysis request;

[0089] In response to the supplementary detection instruction, calling the matching detection tool to collect entity diagnostic data corresponding to each supplementary detection entity, and identifying and outputting abnormal supplementary entities in each supplementary detection entity based on the entity diagnostic data;

[0090] The final list of doubts generated in the last iteration, the abnormal diagnosis data generated during the iteration, the topological relationships, the historical root cause cases, and the entity diagnosis data of the abnormal supplementary entities are input into the large model again to obtain the new root cause reasoning results;

[0091] Returns the operation of checking whether the abnormal entity name in the root cause reasoning result completely matches the node name in the topological relationship, and whether all downstream entities of the target entity involved exist in the downstream hierarchical structure defined by the topological relationship, until the end iteration condition is met;

[0092] Generate a root cause analysis report based on the root cause reasoning results obtained at the end of the iteration.

[0093] If the verification finds that the name of the abnormal entity does not match the topological node, or the downstream entity is not in the hierarchy defined by the topology, a supplementary detection instruction is generated through the large language model based on the extracted entity and topological relationship. The large model will combine historical cases and topological logic to determine the scope of entities that need to be supplemented for detection. According to the supplementary detection instruction, the adapter tool is called to collect diagnostic data of the supplementary detection entity. For example, if the packet loss rate of the switch port is detected to be 5% (threshold 1%), the "core switch Switch-01" is identified as an abnormal supplementary entity and included in the analysis scope. The latest abnormal supplementary entity data is merged with the original iterative data and input into the large model to generate a new root cause reasoning result. For example, combined with the new path of "switch packet loss → server network interruption → interface timeout", the conclusion of "server itself failure" in the original reasoning is corrected.

[0094] The embodiments of the present invention achieve efficient detection of accurate calling of detection tools, dynamic adaptation of parameters, intelligent identification of anomalies and adaptive expansion of the system through mapping and matching between entities and detection tools, dynamic generation of anomaly types and detection parameters, and comparison of detection data with standard thresholds to identify abnormal downstream entities; generate supplementary detection instructions through large models, dynamically collect abnormal entity data, iteratively input multi-dimensional information and verify topological consistency, achieve accurate convergence of root cause reasoning and automatic report generation, and effectively improve the accuracy and efficiency of fault location; add abnormal entities, root cause paths and solutions in root cause reports confirmed by users to the historical case library according to a preset structure, and perform vectorized encoding and multi-dimensional index construction to achieve dynamic accumulation and efficient retrieval of historical cases, and continuously improve the accuracy and efficiency of root cause analysis.

[0095] Example 3

[0096] Figure 3 This is a schematic diagram of the structure of a root cause analysis device based on a large language model provided in the third embodiment of the present invention. Figure 3 As shown, the device includes:

[0097] The root cause analysis request response module 310 is configured to respond to a root cause analysis request submitted by a user in natural language and extract the name of the target entity of the anomaly root cause to be located and the topological relationship of the target entity as clue information;

[0098] A vector database retrieval module 320 is configured to retrieve historical root cause cases that match the clue information from the vector database, and input the topological relationships in the clue information, the retrieved historical root cause cases, and the preset prompt words into the large language model;

[0099] A downstream entity extraction module 330 is configured to generate a list of doubtful entities matching the target entity using a large language model, and then extract the downstream entities that cause the target entity to be abnormal from the list of doubtful entities;

[0100] The abnormal entity identification module 340 is used to call the detection tool corresponding to each downstream entity to collect entity diagnostic data corresponding to each downstream entity, and identify and output abnormal downstream entities in each downstream entity based on the entity diagnostic data;

[0101] The loop iteration module 350 is configured to generate new clue information based on each abnormal downstream entity and then return to the vector database to search for historical root cause cases that match the clue information until a preset iteration end condition is met;

[0102] The root cause reasoning result generation module 360 ​​is used to input the final doubt list generated in the last iteration, the abnormal diagnosis data generated during the iteration, the topological relationships, and the historical root cause cases into the large language model again to obtain the root cause reasoning results, and generate a root cause report that matches the root cause analysis request based on the root cause reasoning results.

[0103] The embodiment of the present invention uses topological relationships as reasoning constraints to ensure that the list of doubts generated by the large model conforms to the impact path from the target entity to the downstream entity, reducing invalid troubleshooting directions; gradually narrows the scope of the fault through the closed loop of "detection-analysis-redetection", improves the accuracy of root cause location, and avoids misjudgment of single-round reasoning; incremental learning of historical cases and dynamic expansion of detection tools adapt to complex scenarios and continuously improve the system's fault identification capabilities. Through the full-chain design of natural language understanding + topological constraints + historical cases + dynamic detection + iterative reasoning, the traditional manual root cause analysis experience-based and trial-and-error troubleshooting mode is transformed into an automated process driven by data and intelligent reasoning, improving fault location efficiency and root cause accuracy, and significantly reducing operation and maintenance labor costs and business failure time.

[0104] Optionally, based on the above embodiments, the root cause analysis request response module 310 may include:

[0105] An entity name recognition unit, configured to extract the name of a target entity carried in a root cause analysis request using a named entity recognition model;

[0106] A topology relationship acquisition unit is used to acquire, based on the name of the target entity and based on the graph database, an entity topology relationship graph corresponding to the target entity as the topology relationship of the target entity;

[0107] A vector representation unit is used to convert the text features and topological relationships of the target entity into vector representations to form an abnormal feature vector;

[0108] A historical root cause case retrieval unit is used to retrieve a specified number of historical root cause cases that match the abnormal feature vector in the vector database, wherein the historical root cause cases include abnormal entities, root cause paths describing the abnormal types, and solutions.

[0109] Optionally, based on the above embodiments, the vector database search module 320 may include:

[0110] The topological relationship structuring unit is used to perform structural encoding on the topological relationship graph of the target entity to form a structured text containing the dependency relationship between entities;

[0111] A historical root cause mapping set construction unit is used to extract abnormal entities, abnormal types, and root cause paths from historical root cause cases to generate a historical root cause mapping set;

[0112] A large model input unit, used to input structured text, a historical root cause mapping set, and preset prompt words into the large language model;

[0113] Accordingly, a list of doubts matching the target entity is generated through a large language model, which may include:

[0114] The doubt list generation unit is used to generate a doubt list containing the target entity, exception type, and the association path between the target entity and downstream entities based on the input structured text, historical root cause mapping set, and preset prompt words through a large language model.

[0115] Optionally, based on the above embodiments, the abnormal entity identification module 340 may include:

[0116] A detection tool matching unit, configured to obtain a detection tool corresponding to each downstream entity according to a mapping relationship between the entity and the detection tool;

[0117] A detection tool execution unit, configured to generate dynamic parameters corresponding to each detection tool based on a mapping relationship between anomaly types and detection parameters, and to call each detection tool to perform a detection operation corresponding to each downstream entity according to the dynamic parameters;

[0118] The entity diagnosis unit is used to identify and output abnormal downstream entities in each downstream entity based on the entity diagnosis data corresponding to each downstream entity returned by all detection tools and the standard data threshold corresponding to each downstream entity.

[0119] Optionally, based on the above embodiments, the root cause reasoning result generating module 360 ​​may include:

[0120] The entity and node matching unit is used to detect whether the abnormal entity name in the root cause reasoning result completely matches the node name in the topological relationship, and whether all downstream entities of the target entity involved exist in the downstream hierarchical structure defined by the topological relationship;

[0121] An entity mapping unit is used to perform standardized mapping on the abnormal entity name in the root cause reasoning result according to the node identification rule of the topological relationship graph;

[0122] The root cause analysis report generation unit is used to call a predefined visualization template based on the root cause path in the root cause reasoning result and the abnormal entity diagnosis data to automatically generate a root cause analysis report including a trend chart.

[0123] Optionally, based on the above embodiments, the system may further include: a supplementary diagnosis unit for detecting whether the abnormal entity name in the root cause reasoning result completely matches the node name in the topological relationship, and whether all downstream entities of the target entity involved exist in the downstream hierarchical structure defined by the topological relationship; if not, then generating a supplementary detection instruction for at least one supplementary detection entity through a large language model based on the entity name and topological relationship extracted in the root cause analysis request;

[0124] In response to the supplementary detection instruction, calling the matching detection tool to collect entity diagnostic data corresponding to each supplementary detection entity, and identifying and outputting abnormal supplementary entities in each supplementary detection entity based on the entity diagnostic data;

[0125] The final list of doubts generated in the last iteration, the abnormal diagnosis data generated during the iteration, the topological relationships, the historical root cause cases, and the entity diagnosis data of the abnormal supplementary entities are input into the large model again to obtain the new root cause reasoning results;

[0126] Returns the operation of checking whether the abnormal entity name in the root cause reasoning result completely matches the node name in the topological relationship, and whether all downstream entities of the target entity involved exist in the downstream hierarchical structure defined by the topological relationship, until the end iteration condition is met;

[0127] Generate a root cause analysis report based on the root cause reasoning results obtained at the end of the iteration.

[0128] Optionally, based on the above embodiments, the present invention may further include: a feedback receiving unit configured to, after outputting a root cause report when the root cause inference result satisfies a root cause determination condition, receive target feedback information with a confirmation mark issued by a user in response to the root cause report, and add the abnormal entity, root cause path, and solution in the target root cause report corresponding to the target feedback information to a historical root cause case library according to a preset data structure;

[0129] Based on the vector database, the target root cause report newly added to the historical root cause case library is vectorized and encoded, and a fast search index with entity name, topological relationship, and anomaly type as dimensions is established for use in the retrieval and matching of historical root cause cases.

[0130] A root cause analysis device based on a large language model provided in an embodiment of the present invention can execute a root cause analysis method based on a large language model provided in any embodiment of the present invention, and has functional modules and beneficial effects corresponding to the execution method.

[0131] Example 3

[0132] Figure 4 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or claimed herein.

[0133] like Figure 4 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., which is communicatively connected to the at least one processor 11. The memory stores a computer program that can be executed by the at least one processor. The processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 into the random access memory (RAM) 13. Various programs and data required for the operation of the electronic device 10 can also be stored in the RAM 13. The processor 11, ROM 12, and RAM 13 are connected to each other via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0134] Multiple components in the electronic device 10 are connected to the I / O interface 15, including an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a magnetic disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.

[0135] Processor 11 can be any general-purpose and / or specialized processing component with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various specialized artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any other suitable processor, controller, microcontroller, etc. Processor 11 executes the various methods and processes described above, such as a root cause analysis method based on a large language model.

[0136] That is, in response to a root cause analysis request submitted by a user in natural language, the name of the target entity of the anomaly root cause to be located and the topological relationship of the target entity are extracted as clue information;

[0137] Retrieve historical root cause cases that match the clue information from the vector database, and input the topological relationship in the clue information, the retrieved historical root cause cases, and the preset prompt words into the large language model;

[0138] After generating a list of doubts matching the target entity through a large language model, extract the downstream entities that cause the target entity to be abnormal from the list of doubts;

[0139] Calling the detection tools corresponding to each downstream entity to collect entity diagnostic data corresponding to each downstream entity, and identifying and outputting abnormal downstream entities in each downstream entity based on the entity diagnostic data;

[0140] After generating new clue information based on each abnormal downstream entity, the process returns to searching the vector database for historical root cause cases that match the clue information until the preset iteration end condition is met.

[0141] The final list of doubts generated in the last iteration, the abnormal diagnosis data generated during the iteration, the topological relationships, and the historical root cause cases are input into the large language model again to obtain the root cause reasoning results. Based on the root cause reasoning results, a root cause report matching the root cause analysis request is generated.

[0142] In some embodiments, a root cause analysis method based on a large language model can be implemented as a computer program tangibly embodied in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the root cause analysis method based on a large language model described above can be performed. Alternatively, in other embodiments, processor 11 can be configured to execute a root cause analysis method based on a large language model in any other appropriate manner (e.g., via firmware).

[0143] Various embodiments of the systems and techniques described herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), system-on-chip systems (SOCs), programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include being implemented in one or more computer programs that are executable and / or interpreted on a programmable system that includes at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0144] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when the computer program is executed by the processor, the functions / operations specified in the flowcharts and / or block diagrams are implemented. The computer program may be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0145] In the context of the present invention, computer-readable storage media can be tangible media that can contain or store a computer program for use with an instruction execution system, device or equipment or used in combination with an instruction execution system, device or equipment. Computer-readable storage media can include but are not limited to electronic, magnetic, optical, electromagnetic, infrared or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, computer-readable storage media can be machine-readable signal media. More specific examples of machine-readable storage media can include electrical connections based on one or more lines, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), optical fibers, portable compact disk read-only memories (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0146] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0147] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0148] A computing system may include clients and servers. The clients and servers are typically remote from each other and typically interact via a communication network. This client-server relationship arises through computer programs running on the respective computers, creating a client-server relationship. The server may be a cloud server, also known as a cloud computing server or cloud host. This server is a hosting product within the cloud computing service ecosystem that addresses the management difficulties and limited scalability of traditional physical hosting and VPS services.

[0149] It should be understood that the various forms of the processes shown above can be used to reorder, add, or delete steps. For example, the steps described in the present invention can be performed in parallel, sequentially, or in a different order, as long as the desired results of the technical solution of the present invention can be achieved. This is not limited herein.

[0150] The above specific embodiments do not limit the scope of protection of the present invention. Those skilled in the art will appreciate that various modifications, combinations, sub-combinations, and substitutions may be made based on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention are intended to be included within the scope of protection of the present invention.

Claims

1. A root cause analysis method based on a large language model, characterized in that: The method comprises: In response to a root cause analysis request submitted by a user in natural language, the name of the target entity of the anomaly root cause to be located and the topological relationship of the target entity are extracted as clue information; Retrieve historical root cause cases that match the clue information from the vector database, and input the topological relationship in the clue information, the retrieved historical root cause cases, and the preset prompt words into the large language model; After generating a list of doubts matching the target entity through a large language model, extract the downstream entities that cause the target entity to be abnormal from the list of doubts; Calling the detection tools corresponding to each downstream entity to collect entity diagnostic data corresponding to each downstream entity, and identifying and outputting abnormal downstream entities in each downstream entity based on the entity diagnostic data; After generating new clue information based on each abnormal downstream entity, the process returns to searching the vector database for historical root cause cases that match the clue information until the preset iteration end condition is met. The final list of doubts generated in the last iteration, the abnormal diagnosis data generated during the iteration, the topological relationships, and the historical root cause cases are input into the large language model again to obtain the root cause reasoning results. Based on the root cause reasoning results, a root cause report matching the root cause analysis request is generated.

2. The method according to claim 1, characterized in that In response to a root cause analysis request submitted by a user in natural language, the name of the target entity to locate the root cause of the anomaly and the topological relationship of the target entity are extracted as clue information, including: Extract the name of the target entity carried in the root cause analysis request through the named entity recognition model; According to the name of the target entity, a topological relationship graph between entities corresponding to the target entity is obtained based on the graph database as the topological relationship of the target entity; Convert the text features and topological relationships of the target entity into vector representations to form an abnormal feature vector; A specified number of historical root cause cases matching the abnormal feature vector are retrieved from a vector database, wherein the historical root cause cases include abnormal entities, root cause paths describing abnormal types, and solutions.

3. The method according to claim 2, characterized in that The topological relationships in the clue information, the retrieved historical root cause cases, and the preset prompt words are input into the large language model, including: Structural encoding of the topological relationship graph of the target entity to form a structured text containing the dependency relationships between entities; Extract abnormal entities, abnormal types, and root cause paths from historical root cause cases to generate a historical root cause mapping set; Input structured text, historical root cause mapping set, and preset prompt words into the large language model; Accordingly, a large language model is used to generate a list of doubts matching the target entity, including: Through a large language model, based on the input structured text, historical root cause mapping set, and preset prompt words, a list of doubts is generated, including the target entity, exception type, and the association path between the target entity and downstream entities.

4. The method according to claim 1, wherein Calling the detection tools corresponding to each downstream entity to collect entity diagnostic data corresponding to each downstream entity, and identifying and outputting abnormal downstream entities in each downstream entity based on the entity diagnostic data, including: According to the mapping relationship between the entity and the detection tool, obtain the detection tool corresponding to each downstream entity; Generate dynamic parameters corresponding to each detection tool based on the mapping relationship between anomaly type and detection parameters, and call each detection tool according to the dynamic parameters to perform the detection operation corresponding to each downstream entity; According to the entity diagnosis data corresponding to each downstream entity returned by all detection tools, and the standard data threshold corresponding to each downstream entity, abnormal downstream entities are identified and output in each downstream entity.

5. The method according to claim 1, characterized in that Generates a root cause report matching the root cause analysis request based on the root cause reasoning results, including: Check whether the abnormal entity name in the root cause reasoning result completely matches the node name in the topological relationship, and whether all downstream entities of the target entity involved exist in the downstream hierarchical structure defined by the topological relationship; If so, the abnormal entity name in the root cause reasoning result is standardized and mapped according to the node identification rules of the topological relationship graph; Based on the root cause path in the root cause reasoning results and the abnormal entity diagnosis data, a predefined visualization template is called to automatically generate a root cause analysis report including a trend chart.

6. The method according to claim 5, characterized in that After checking whether the abnormal entity name in the root cause reasoning result completely matches the node name in the topological relationship, and whether all downstream entities of the target entity involved exist in the downstream hierarchical structure defined by the topological relationship, the following is also included: If not, generating a supplementary detection instruction for at least one supplementary detection entity through a large language model based on the entity names and topological relationships extracted in the root cause analysis request; In response to the supplementary detection instruction, calling the matching detection tool to collect entity diagnostic data corresponding to each supplementary detection entity, and identifying and outputting abnormal supplementary entities in each supplementary detection entity based on the entity diagnostic data; The final list of doubts generated in the last iteration, the abnormal diagnosis data generated during the iteration, the topological relationships, the historical root cause cases, and the entity diagnosis data of the abnormal supplementary entities are input into the large model again to obtain the new root cause reasoning results; Return to the operation of checking whether the abnormal entity name in the root cause reasoning result completely matches the node name in the topological relationship, and whether all downstream entities of the target entity involved exist in the downstream hierarchical structure defined by the topological relationship, until the end iteration condition is met; Generate a root cause analysis report based on the root cause reasoning results obtained at the end of the iteration.

7. The method according to any one of claims 1 to 6, characterized in that After outputting a root cause report when the root cause reasoning result meets the root cause determination condition, the method further includes: Receive target feedback information with a confirmation mark issued by the user in response to the root cause report, and add the abnormal entity, root cause path, and solution in the target root cause report corresponding to the target feedback information to the historical root cause case library according to a preset data structure; Based on the vector database, the target root cause report newly added to the historical root cause case library is vectorized and encoded, and a fast search index with entity name, topological relationship, and anomaly type as dimensions is established for use in the retrieval and matching of historical root cause cases.

8. A root cause analysis device based on a large language model, characterized in that: The device comprises: A root cause analysis request response module is used to respond to a root cause analysis request submitted by a user in natural language and extract the name of the target entity of the anomaly root cause to be located and the topological relationship of the target entity as clue information; A vector database retrieval module is used to retrieve historical root cause cases that match the clue information in the vector database, and input the topological relationship in the clue information, the retrieved historical root cause cases, and the preset prompt words into the large language model; The downstream entity extraction module is used to generate a list of doubt points that match the target entity through a large language model, and then extract the downstream entities that cause the target entity to be abnormal from the list of doubt points; An abnormal entity identification module is used to call the detection tools corresponding to each downstream entity to collect entity diagnostic data corresponding to each downstream entity, and identify and output abnormal downstream entities in each downstream entity based on the entity diagnostic data; The loop iteration module is used to generate new clue information based on each abnormal downstream entity, and then return to perform the operation of searching the vector database for historical root cause cases that match the clue information until the preset iteration end condition is met; The root cause reasoning result generation module is used to input the final doubt list generated in the last iteration, the abnormal diagnosis data generated during the iteration, the topological relationships, and the historical root cause cases into the large language model again to obtain the root cause reasoning results, and generate a root cause report that matches the root cause analysis request based on the root cause reasoning results.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can perform a root cause analysis method based on a large language model according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement a root cause analysis method based on a large language model according to any one of claims 1 to 7 when executed.

Images