Government affair work order generation alarm method and system based on domain matching topology perception

Abstract

The invention provides a government affair work order generation alarm method and system based on domain fit topology awareness, and relates to the technical field of government affair work order early warning, and the method comprises the steps: obtaining real-time alarm data, carrying out key structured field extraction, introducing a cue word optimization algorithm, optimizing the key structured field, and generating an optimized cue word; constructing an operation and maintenance knowledge graph, extracting an event sequence, calculating and obtaining a hidden dependency or potential fault propagation path which is not described by a document among the components based on the event sequence, and generating an optimized operation and maintenance knowledge graph; generating a structured alarm feature sequence with weight based on the optimized operation and maintenance knowledge graph; and inputting the weighted structured alarm feature sequence into a work order generation model, converting the feature sequence into an attention bias matrix, gradually generating a fault abstract, performing optimization based on a topology perception optimization algorithm to obtain a final fault abstract, generating a processing suggestion based on the final abstract, and creating a work order. According to the invention, the work order automatic generation efficiency can be improved.

Description

Technical Field

[0001] This disclosure relates to the field of government work order early warning technology, specifically to a method and system for generating alarms for government work orders based on domain-fitting topology awareness. Background Technology

[0002] The statements in this section are merely background information relating to this disclosure and do not necessarily constitute prior art.

[0003] In modern IT operations and maintenance environments, probes deployed on various network nodes, servers, databases, middleware, and other critical business systems monitor the system's operational status, performance indicators, and anomalies in real time. When a system anomaly occurs, the probes immediately issue an alarm message, including a detailed description of the anomaly, error code, and scope of impact.

[0004] In the realm of government services, monitoring systems also generate massive amounts of alarm data, encompassing various types of devices such as hosts, databases, middleware, and network equipment. Traditional alarm handling processes require manual 24 / 7 monitoring of the alarm interface, manual analysis of alarm types and severity, and manual creation of processing work orders through a work order system for assignment to technical personnel. Furthermore, cross-departmental collaboration necessitates manual transmission of alarm information, leading to delays in fault response and failing to meet the demands of modern IT operations for rapid response and automated processing.

[0005] With technological advancements, AI-powered large-scale models are now being used for work order alarm processing. Existing AI model processing methods typically employ the following two approaches: One approach is to use rule-based or traditional machine learning models for work order classification and recommendation. These methods rely on manually defined rule templates or classifiers trained from historical data. While they offer some domain-specificity, they still have significant limitations: poor flexibility, making it difficult to adapt to new faults or undefined alarm scenarios; high maintenance costs, as rules and models need frequent updates with system changes, otherwise misjudgments or missed judgments are likely; and a lack of semantic understanding, failing to deeply understand the semantics of alarm text and only capable of shallow matching and recommendation.

[0006] The second approach is direct question-and-answer processing based on a general large language model. This method directly inputs the original alarm text into a pre-trained large model, which then generates a work order title, summary, or handling suggestions through natural language commands. Although this type of model has powerful language generation capabilities, it lacks a deep understanding of the specific domain knowledge of government IT operations and maintenance. This results in the following problems with the generated work order content: insufficient accuracy, easily overlooking implicit relationships between key alarm fields and failing to accurately identify the root cause component; lack of topology awareness, failing to combine system architecture dependencies and making it difficult to form a logical chain from root cause to scope of impact; and weak operability, with generated handling suggestions mostly being general descriptions, lacking executable operations that match specific components and error codes, making it difficult to directly guide operations and maintenance personnel in troubleshooting. Summary of the Invention

[0007] To address the aforementioned issues, this disclosure proposes a method and system for generating alarms for government work orders based on domain-aligned topology awareness. By analyzing operational data in the government domain, an operation and maintenance knowledge graph is constructed, and potential relationships are mined and optimized to obtain implicit dependencies or potential fault propagation paths. The strength of potential temporal dependencies between components is quantified, and a large language model is used as the generation engine. Attention-guided summaries are generated step by step, and root causes, propagation paths, and impact results are linked based on topological dependencies to form a logically complete fault description and generate an alarm. Then, based on a reinforcement learning feedback optimization mechanism, the work order processing alarm process is continuously optimized.

[0008] According to some embodiments, the present disclosure adopts the following technical solutions: A method for generating alerts for government work orders based on domain-fitting topology awareness includes: Acquire historical work order samples and real-time alarm data, and preprocess the real-time alarm data; Key structured fields are extracted from the preprocessed alarm data, and a prompt word optimization algorithm is introduced. Based on the sample titles of historical work orders, the key structured fields are optimized to minimize the semantic difference between the generated title and the sample title, thereby generating optimized prompt words. An operation and maintenance knowledge graph is constructed based on alarm data and optimization prompts, and event sequences are extracted. Based on the event sequences, implicit dependencies or potential fault propagation paths between components that are not described in the documentation are calculated to generate an optimized operation and maintenance knowledge graph. Based on the optimized operation and maintenance knowledge graph, field features are extracted and the comprehensive weight of each field feature is calculated. The comprehensive weight is assigned to each field feature to generate a weighted structured alarm feature sequence. The weighted structured alarm feature sequence is input into the work order generation model, which converts the weighted structured alarm feature sequence into an attention bias matrix. Based on the attention bias matrix, a fault summary is generated step by step and output. The fault summary is optimized based on the topology-aware optimization algorithm to obtain the final fault summary. Based on the final summary, processing suggestions are generated and a work order is created.

[0009] According to some embodiments, the present disclosure adopts the following technical solutions: A government work order generation and alarm system based on domain-fitting topology awareness includes: The data acquisition module is used to acquire historical work order samples and real-time alarm data, and to preprocess the real-time alarm data. The prompt word optimization module is used to extract key structured fields from the preprocessed alarm data. It introduces a prompt word optimization algorithm, based on the sample titles of historical work orders, and aims to minimize the semantic difference between the generated title and the sample title to optimize the key structured fields and generate optimized prompt words. The knowledge graph update module is used to build an operation and maintenance knowledge graph based on alarm data and optimization prompts, extract event sequences, calculate and obtain implicit dependencies or potential fault propagation paths between components that are not described in the documentation based on the event sequences, and generate an optimized operation and maintenance knowledge graph. The sequence generation module is used to extract field features based on the optimized operation and maintenance knowledge graph, calculate the comprehensive weight of each field feature, assign the comprehensive weight to each field feature, and generate a weighted structured alarm feature sequence. The fault summary generation module is used to input the weighted structured alarm feature sequence into the work order generation model, convert the weighted structured alarm feature sequence into an attention bias matrix, generate and output fault summaries step by step based on the attention bias matrix, optimize the fault summary based on the topology-aware optimization algorithm to obtain the final fault summary, generate processing suggestions and create work orders based on the final summary.

[0010] According to some embodiments, the present disclosure adopts the following technical solutions: A non-transitory computer-readable storage medium is provided for storing computer instructions, which, when executed by a processor, implement the aforementioned method for generating alarms based on domain-fitting topology awareness in government work orders.

[0011] According to some embodiments, the present disclosure adopts the following technical solutions: An electronic device includes a processor, a memory, and a computer program; wherein the processor is connected to the memory, the computer program is stored in the memory, and when the electronic device is running, the processor executes the computer program stored in the memory to enable the electronic device to implement the aforementioned alarm generation method for government work orders based on domain-fitting topology awareness.

[0012] Compared with the prior art, the beneficial effects of this disclosure are as follows: This disclosed method for generating alarms based on domain-fitting topology awareness of government work orders is used in IT operations and maintenance monitoring. When a system anomaly is detected and an alarm message is issued, the method uses AI big model technology to automatically perform semantic parsing and structured extraction on various complex alarm messages, generating content including accurate fault descriptions, possible cause analysis, and actionable processing suggestions.

[0013] This disclosed method for generating alarms for government work orders based on domain-fitting topology awareness constructs and optimizes an operation and maintenance knowledge graph, combines component criticality scoring and dynamic weight calculation of real-time alarm data, and uses an attention bias matrix to guide the work order generation model to generate accurate fault summaries, ensuring that high-weight features are expressed first, and forms a logically complete fault description based on topology dependency awareness, transmission path and impact result mining.

[0014] This disclosed method for generating alarms for government work orders based on domain-fitting topology awareness automatically generates standardized work order data based on structured information extracted from the work order generation model, and integrates knowledge graph strategies and historical case libraries to output executable suggestions, thereby achieving full-process automation from alarm parsing to work order closure.

[0015] This disclosed method for generating alarms for government work orders based on domain-fitting topology awareness covers the entire chain from data preprocessing, AI intelligent analysis, work order generation, and multi-level approval triggering. It significantly reduces the need for manual intervention and solves the problems of response delay and poor fault tolerance in traditional operation and maintenance.

[0016] This disclosed method for generating alarms for government work orders based on domain-fitting topology awareness also introduces a model feedback and self-optimization learning mechanism. Based on reinforcement learning, the feedback optimization mechanism continuously collects work order processing results (including resolution status, processing time, and human feedback), constructs a reward function to fine-tune the AI ​​model (work order generation model), drives the generated processing suggestions to continuously iterate towards more efficient, accurate, and human-experience-compliant directions, and automatically updates the knowledge graph and case library to form a closed-loop self-optimization capability, thereby enabling the system to continuously learn and improve performance in operation and maintenance practice. Attached Figure Description

[0017] The accompanying drawings, which form part of this disclosure, are used to provide a further understanding of this disclosure. The illustrative embodiments of this disclosure and their descriptions are used to explain this disclosure and do not constitute an undue limitation of this disclosure.

[0018] Figure 1 This is a flowchart of a government work order alarm generation method based on domain-fitting topology awareness, according to an embodiment of this disclosure. Detailed Implementation

[0019] The present disclosure will be further described below with reference to the accompanying drawings and embodiments.

[0020] It should be noted that the following detailed descriptions are illustrative and intended to provide further explanation of this disclosure. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure pertains.

[0021] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the exemplary embodiments according to this disclosure. As used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise. Furthermore, it should be understood that when the terms “comprising” and / or “including” are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.

[0022] Example 1 One embodiment of this disclosure provides a method for generating alarms for government work orders based on domain-fitting topology awareness. The method includes the following steps: Step 1: Obtain historical work order samples and real-time alarm data, and preprocess the real-time alarm data; Step 2: Extract key structured fields from the preprocessed alarm data, introduce a prompt word optimization algorithm, and optimize key structured fields based on the sample titles of historical work orders, with the goal of minimizing the semantic difference between the generated title and the sample title, to generate optimized prompt words. Step 3: Construct an operation and maintenance knowledge graph based on alarm data and optimization prompts, extract event sequences, calculate and obtain implicit dependencies or potential fault propagation paths between components that are not described in the documentation based on the event sequences, and generate an optimized operation and maintenance knowledge graph; Step 4: Based on the optimized operation and maintenance knowledge graph, extract field features and calculate the comprehensive weight of each field feature. Assign the comprehensive weight to each field feature to generate a weighted structured alarm feature sequence. Step 5: Input the weighted structured alarm feature sequence into the work order generation model, convert the weighted structured alarm feature sequence into an attention bias matrix, generate and output a fault summary step by step based on the attention bias matrix, optimize the fault summary based on the topology-aware optimization algorithm to obtain the final fault summary, generate processing suggestions and create a work order based on the final summary.

[0023] As one embodiment, this disclosed method for generating alarms for government work orders based on domain-fitting topology awareness proposes a fault summary generation technique using dynamic weights and topology awareness. By constructing an operations and maintenance knowledge graph and combining component criticality scores with dynamic weight calculations based on real-time alarm data, an attention bias matrix guides a large AI model to generate accurate fault summaries. This ensures that high-weight features are expressed first, and the root cause, transmission path, and impact results are linked based on topological dependencies to form a logically complete fault summary description. The specific implementation process is as follows: Step 1: Obtain historical work order samples and real-time alarm data, and preprocess the real-time alarm data; Specifically, monitoring probes deployed on component nodes such as hosts, databases, middleware, and network devices receive structured JSON-formatted alarm data in real time. Each alarm data entry contains multiple fields, including alarm time, alarm level, alarm object, system resource status, abnormal event description, and error code. To ensure the accuracy and consistency of subsequent AI analysis, the system immediately initiates a preprocessing procedure upon receiving the data.

[0024] Furthermore, the preprocessing process includes field validity checks and field normalization mapping, as detailed below: (1) First, perform field validity checks, including verifying the existence of required fields and whether the field type meets expectations (e.g., whether the timestamp is a valid date format, whether the error code is a preset enumeration value, etc.), and perform range verification for numeric fields (e.g., whether the CPU utilization rate is between 0 and 100). Then, perform garbled character filtering, and uniformly convert to the UTF-8 standard through a character encoding detection and conversion mechanism to remove or repair illegal characters, control characters, or encoding errors generated during transmission or acquisition.

[0025] (2) Subsequently, field standardization mapping is performed. A predefined metadata mapping dictionary is maintained. This dictionary is based on the specifications and industry standards of various monitoring data sources (such as Zabbix, Prometheus, cloud platform monitoring, etc.). Its core entries clarify the mapping relationship between the source data field names and the system's internal standard field names. For example, the field names "hostname", "server_name", and "NodeName" in the source data are all mapped to the standard field name "target_host".

[0026] Meanwhile, the timestamp field will be parsed and uniformly converted into the UTC time format conforming to the ISO 8601 standard according to its original format (such as Unix timestamp, RFC 3339 format or other custom formats) to ensure the consistency of global time representation.

[0027] For error codes, normalization is performed based on a continuously maintained error code knowledge base. This knowledge base is a structured data table whose entries are constructed by aggregating historical operational data, official documentation, and common enumeration values. Each record contains the original representation of common error codes (such as "ERR-1045", "MySQL 1045", "1045(HY000)") and their corresponding unique standardized error identifier (such as "MYSQL_ACCESS_DENIED"). During processing, the system queries this knowledge base to map the original error codes to unified, semantically clear standardized identifiers.

[0028] After completing the above preprocessing, the preprocessed alarm data is written into the time series database in batches and labeled with a "cleaning completed" data quality tag to provide high-quality, structured input data for the subsequent AI intelligent analysis module.

[0029] As one example, the historical work order samples are obtained from the system's data storage module for subsequent data analysis.

[0030] Step 2: Extract key structured fields from the preprocessed alarm data, introduce a prompt word optimization algorithm, and optimize key structured fields based on the sample titles of historical work orders, with the goal of minimizing the semantic difference between the generated title and the sample title, to generate optimized prompt words. Specifically, key structured fields are extracted from the preprocessed alarm data, including alarm object (A_obj), error type (A_err), error code (A_code), and scope of impact (A_scope). A basic alert word template is initialized, with the following structure: Please generate a concise operation and maintenance work order title based on the following alarm information; Work order requirements: Highlight the main fault points and their impact; the length should not exceed 20 Chinese characters; the language should be professional and unambiguous. The title should be generated based on the following: Alarm Object: {A_obj}, Error Type: {A_err}, Error Code: {A_code}, Affected Service: {A_scope}.

[0031] Furthermore, to improve the accuracy and domain relevance of the generated titles, this disclosure introduces a prompt word optimization algorithm. Based on sample titles from historical work order samples, it dynamically adjusts the weights of various key structured fields in the basic prompt words. The optimization objective is to minimize the semantic difference between the generated title and the sample title. This process is implemented using a pre-trained large language model, as follows: Define each field in the basic prompt words i The weight is Its initial value is 1, and the optimization objective is to minimize the semantic difference loss L between the generated title and the sample title. The loss function L is the cosine distance calculated based on the Sentence-BERT model:

[0032] in, and These are the sentence vector representations between the generated title and the sample title, respectively.

[0033] Furthermore, the weight updates for each key structured field are iteratively optimized using gradient descent:

[0034] in, For the first t Fields during the next iteration i The weight, The learning rate controls the update step size; For the loss function with respect to weights gradient, For the first t+ Fields in 1 iteration i The weight.

[0035] This disclosure, through the aforementioned iterative optimization, automatically identifies the key fields (such as error codes and alarm objects) that have the greatest impact on generation quality, constructs optimized prompt words, and assigns them higher weights. An example of the optimized prompt words is as follows: [Key Field] Error Code: {A_code} (Weight: [Key Fields] Alarm Object: {A_obj} (Weight: A_obj); Error Occurred, Affected Scope: {A_scope}. Please generate an operation and maintenance fault title. Requirements: No more than 20 Chinese characters, professional language, and unambiguous.

[0036] Based on the alarm object, error type, and scope of impact, the large language model automatically generates concise and accurate work order titles that conform to the operational context (such as "Redis connection timeout caused cache penetration") using the above methods, making it easier for manual identification of core issues.

[0037] As one example, this large language model can be used for existing generative AI large models.

[0038] Step 3: Construct an operation and maintenance knowledge graph based on alarm data and optimization prompts, extract event sequences, calculate and obtain implicit dependencies or potential fault propagation paths between components that are not described in the documentation based on the event sequences, and generate an optimized operation and maintenance knowledge graph; Specifically, by parsing fault and alarm data in node documents and historical work order samples, the system's component nodes are used as vertices, and edges represent the dependencies between components. Each vertex includes a component type attribute, a fault mode set attribute, and a criticality score attribute. The fault mode set attribute is the key field in the optimization prompts. The details are as follows: Building an Operations and Maintenance Knowledge Graph G =( V , E The vertex set V represents the component nodes of the system (such as API services, databases, etc.), and the edge set E represents the dependencies between components (such as "API service calls MySQL database").

[0039] Each vertex V Includes the following attributes: (1) Component type V )∈{service, database, middleware,...}; (2) Fault mode set F ( V )={ f 1,..., f n}, f n Each fault mode is represented by fields such as error code, alarm object, and possible cause; the fault mode set attribute is a key field in the optimization prompt words; (3) Keyness score K ( V )∈[0,1], indicating the importance of a component in the system.

[0040] Furthermore, to enhance the completeness and fault inference capabilities of the knowledge graph, this disclosure proposes a latent relationship mining method based on multi-source time-series logs and collaborative training. This method involves extracting time-series log data from each component node, extracting event sequences, and calculating the latency mutual information between event sequences to quantify the strength of potential time-series dependencies between components. This is used to discover implicit dependencies or potential fault propagation paths between components that are not described in the documentation, as detailed below: For any two component nodes and Extract its time period Δ T The sequence of events occurring within the timeframe is denoted as follows: and Next, the delay mutual information between event sequences is calculated to quantify the strength of potential temporal dependencies between components. The formula for calculating delay mutual information is:

[0041] in, For delay time parameters, Represents an event sequence During the delay time The value after that, Let be the probability distribution of the corresponding event.

[0042] A dependency strength threshold θ is set. When the calculated temporal dependency strength is greater than the dependency strength threshold, it indicates that there is a potential dependency or influence relationship between the two components. If the value exceeds the preset threshold θ, it indicates that the component... If a potential dependency or influence relationship exists, an edge will be automatically added to the operations and maintenance knowledge graph. It assigns the relationship type "potential dependency" and records the confidence level. .

[0043] Furthermore, calculate the influence weights between components. This indicates the size of the critical fault propagation path:

[0044] in, Representation Component V a in-degree, K ( V b ) is an upstream component in a given framework V b Keyness score or confidence level in potential dependencies .

[0045] This is used to update the operations and maintenance knowledge graph, resulting in an optimized operations and maintenance knowledge graph.

[0046] The calculated influence weights As an edge A core attribute is stored to obtain a weighted optimization and maintenance knowledge graph. This weight will play a key role in subsequent processes: on the one hand, it enriches the knowledge graph, enabling it to not only contain the connections between components, but also to characterize the probability and severity of fault propagation. The higher the value, the better. The fault The greater the risk of impact; on the other hand, to support fault summary generation, in the subsequent topology-aware optimization algorithm in step 5, when the system needs to select the most critical path from multiple potential fault propagation paths, Using this as the core sorting criterion, the path with the highest overall impact weight will be selected and displayed first, thereby ensuring that the generated final fault summary can accurately reflect the most critical fault chain.

[0047] Step 4: Based on the optimized operation and maintenance knowledge graph, extract field features and calculate the comprehensive weight of each field feature. Assign the comprehensive weight to each field feature to generate a weighted structured alarm feature sequence. Specifically, by optimizing the operations and maintenance knowledge graph, features of each field are extracted, and their overall weights are calculated:

[0048]

[0049] in, Represents static weights. Represents components within a given framework Keyness score, | F ( V The number of typical failure modes defined in the knowledge graph for this component is indicated by )|. For field features, D ( f i , T ) represents the dynamic weights based on time series analysis. T Representing a time series, α and β This is used to control the balance between static and dynamic features. For example, a component class field (such as "component":"mysql") has a weight equal to the key score of the corresponding component in the knowledge graph. K ( V i The weight of the component is indicated by its importance within the system architecture; the error code field (e.g., "error_code":"1045") is calculated as follows: |F(V)| represents the number of typical failure modes defined in the knowledge graph for this component, ensuring that common key errors have higher weights; other auxiliary fields (such as timestamps, process IDs, etc.) are uniformly assigned a basic weight of 0.1.

[0050] Furthermore, D ( f i , T The ) represents the dynamic weights based on time series analysis, which are calculated using the Z-Score method:

[0051]

[0052] in, x t This is the current time series. μ and σThese represent the mean and standard deviation of the previous period, respectively. A configurable sliding time window (default 30 minutes) is set to continuously track the trend of numerical indicators. When a significant anomaly occurs (|z|≥3), the highest dynamic weight of 1 is directly assigned; for ordinary fluctuations (|z|<3), the weight is adjusted accordingly. Distribute weights proportionally. Ensure that the three are highlighted. σ It can handle critical anomalies and smooth out normal fluctuations, avoiding drastic weight fluctuations caused by occasional extreme values.

[0053] parameter α and β This is used to control the balance between static and dynamic features. It ensures the accuracy of knowledge while responding promptly to operational anomalies. For example, when a MySQL component (knowledge graph weight 0.8) suddenly experiences a surge in connections (z=4.2), its connection number field will receive a weight of 0.6×0.8 + 0.4×1 = 0.88, accurately reflecting the criticality of that field.

[0054] Finally, the comprehensive weights are assigned to each field feature to generate a weighted structured alarm feature sequence. , Step 5: Input the weighted structured alarm feature sequence into the work order generation model, convert the weighted structured alarm feature sequence into an attention bias matrix, generate fault summaries step by step based on the attention bias matrix, optimize the fault summaries based on the topology-aware optimization algorithm, output the final fault summary, generate processing suggestions based on the final summary, and create a work order.

[0055] Specifically, the weighted structured alarm feature sequence is input into the work order generation model, for items containing... i For alarm data with each feature field, an attention bias matrix B is constructed, such that each feature receives a bias proportional to its importance during self-attention calculation. The diagonal elements are calculated using an adjustment factor, while the off-diagonal elements are set to 0. During the decoding phase, the work order generation model progressively generates a fault summary based on the weighted attention distribution, including: A pre-trained language model is used as the work order generation model, and its input is the calculated weighted structured alarm feature sequence. ,in For field features, this includes feature content (e.g., "error_code: 1045") and weight vectors. This refers to the comprehensive weight value of each feature, calculated using a dynamic weighting formula, which quantifies the importance of that feature in the current fault context. By introducing an attention bias mechanism, the model is guided to generate fault-oriented natural language summaries that highlight key information.

[0056] The combined weight vector of field featuresW =[ W 1, W 2,..., W i Convert to an attention bias matrix. For those containing n Construct alarm data with specific characteristics n × n The bias matrix B is such that each weight vector receives a bias proportional to its importance during self-attention calculation. The diagonal elements... (λ is a freely adjustable adjustment factor used to control attention sensitivity), and off-diagonal elements are set to 0.

[0057] Based on the standard self-attention mechanism, by adding the feature weight bias term calculated above, we obtain the following formula:

[0058] in, Q , K , V These represent the query vector, key vector, and numerical vector in the attention mechanism, respectively. d k This represents the attention head dimension. Adding a bias term B causes the attention score to automatically increase by 0.24 (0.8×λ) when the large model processes high-weight features (such as error codes with w=0.8), and only by 0.1×λ for low-weight features (such as timestamps with w=0.1).

[0059] Finally, in the decoding phase, the large language model generates summaries step by step based on the weighted attention distribution. Each generation step considers: the explicit expression of high-weight features (e.g., the inclusion of key error codes); causal relationships between features (naturally reflected through attention weights); and domain terminology in the knowledge graph (through operational knowledge injected during pre-training). For example, when processing alerts containing features such as "api_qps:8500 (w=0.9)" and "mysql_connections:95% (w=0.8)", the model generates a precise summary like "API request surge (QPS 8500) caused the MySQL connection pool to be nearly full (95%)", rather than the generic "system anomaly".

[0060] Furthermore, the fault summary is optimized based on the topology-aware optimization algorithm, and the final fault summary is output, including: The core of this algorithm lies in utilizing the component dependencies and influence weights defined in the optimized operation and maintenance knowledge graph to string together discrete alarm events into a logical fault narrative. The specific implementation process is as follows: First, an alarm-component association mapping is performed. The system quickly locates the corresponding component node in the knowledge graph for each alarm instance in the current alarm set through key fields such as "alarm object". For example, the alert "MySQL connection count 95%" corresponds to the "MySQL database" node in the graph.

[0061] Next, root cause path discovery and sorting are performed. Starting from the aforementioned associated component nodes, the algorithm recursively traverses its upstream dependent nodes in reverse, i.e., "who depends on it" or "who is the source of the failure," constructing potential failure propagation paths. During the traversal, a comprehensive impact score Score(P) is calculated for each path P. This score is a comprehensive reflection of the failure propagation strength and node criticality of all edges on the path, and its calculation formula is as follows:

[0062] in, It is the slave node calculated in step 3. arrive Influence weight, α is the predefined component criticality of upstream nodes in the knowledge graph, and β are harmonic coefficients used to balance the influence of propagation strength and the importance of the node itself. After calculation, the algorithm sorts all paths in descending order according to Score(P) and selects the top 3 paths with the highest scores as the most critical fault propagation chains.

[0063] Finally, structured summary synthesis is performed. The algorithm organizes the critical paths selected above into a coherent fault description statement according to their natural dependency order (root cause → propagation → result). The final generated summary must strictly meet three conditions: it must contain specific abnormal indicators of the root cause component (e.g., "API concurrency QPS +350%)"); it must reflect the state changes of key intermediate components (e.g., "MySQL connection pool exhausted"); and it must explain the final impact (e.g., "query timeout"). In addition, a length constraint layer ensures that the summary does not exceed 50 Chinese characters. For complex faults, numerical key indicators are prioritized to compress descriptive text. For example, when several alarms are received simultaneously, instead of simply listing multiple anomalies, a causal chain summary is calculated to directly indicate the source and propagation process of the fault. For example, the generated summary might be "API concurrency surge (QPS +350%) → MySQL connection pool exhausted (utilization rate 98%) → query timeout (failure rate 22%)".

[0064] Step 6: Generate handling recommendations based on the generated final fault summary; Specifically, based on the obtained fault summary and the constructed operation and maintenance knowledge graph, combined with the historical expert case library, actionable recommendations are generated through the following process: First, based on the key components and abnormal indicators (such as "MySQL connection pool exhausted") in the current fault summary, the system matches the corresponding component nodes for this processing in the operations and maintenance knowledge graph. Second, it retrieves the top 3 historical processing cases with the highest similarity from the case library. Finally, by integrating the standard processing flow of the operations and maintenance knowledge graph with the specific operational details of the cases from the existing generative model, the system generates 2-3 processing suggestions with explicit instructions. Each suggestion includes specific commands, parameter examples, or check paths to ensure that operations and maintenance personnel can execute them directly. The system prioritizes recommending verified, high-frequency, and effective solutions (starred in the knowledge graph) and automatically adds precautions (such as "must be executed during off-peak hours") for complex operations.

[0065] For example, when memory leak characteristics are identified, the output might be: "1. Use pmap -x <pid>1. Locate the distribution of memory blocks (standard tool); 2. Check for recently deployed JVM parameter changes (matching case #2078); 3. Enable -XX:+HeapDumpOnOutOfMemoryError (recommended by knowledge graph) for suspected leaking components.

[0066] Furthermore, based on the structured information obtained above, JSON-formatted work orders that meet the requirements of the work order system are automatically generated, including a concise work order title (Ticket_name), a structured HTML-formatted fault description (exc_ai_ini_faultDes), the associated responsible person (exe_ai_ini_contact), the business system name (exe_ai_ini_systemSelect_label), and an event type label (such as "cloud service provider" or "IDC system"). In addition, it also supports complete work unit data such as priority, submission time, attachment list, and process ID, ensuring that work orders can be directly recognized, accepted, and transferred by the work order platform interface.

[0067] Step 7: Model feedback and self-optimizing learning mechanism; After generating processing suggestions and creating a work order, the entire lifecycle status of the work order (including "Processing", "Resolved", and "Closed") is continuously tracked, and key indicators such as work order resolution time (TTL), handler feedback rating, and solution effectiveness label are recorded. This data, together with the initial alarm data and processing suggestions generated by the large model, constitutes a feedback dataset, which is used to continuously optimize the summary generation and suggestion generation modules.

[0068] The final status of closed work orders can be obtained through the work order system API, including solution validity labels marked by the handler (such as "valid", "partially valid", "invalid"), the time from work order creation to closure as a quantitative indicator of solution efficiency, and the records of modifications, supplements or final execution commands made by technical personnel to AI-generated suggestions during actual processing.

[0069] To optimize the work order generation model based on actual processing results, a reinforcement learning mechanism is introduced to transform the work order processing results into reward signals. The reward function R is defined as follows:

[0070] in, This is an indicator function; it takes a value of 1 if the solution is valid, and 0 otherwise. This represents an efficiency reward; the shorter the solution time, the higher the reward (which is a time constant). The text similarity between the suggestions generated by the large model and the final human execution plan is represented by the sentence vector cosine similarity calculation, so as to encourage the model to output a plan that is closer to human experience. These are the weighting coefficients for each reward item. The system maximizes the expected reward. The PPO strategy gradient algorithm is used to fine-tune the model parameters. This drives the model to choose action sequences that yield higher rewards (i.e., more efficient, faster, and more consistent with human operation) (i.e., the fault handling suggestion generation process), thereby continuously improving the practicality, accuracy, and human fit of the output suggestions in the continuous learning loop.

[0071] Simultaneously, the knowledge base is dynamically updated based on feedback data: solutions marked as "effective" are automatically stored as new success cases in the historical case library, and key steps and applicable conditions are extracted to enrich retrieval resources; this approach is also used to update the fault handling strategy nodes of corresponding components in the knowledge graph, including improving strategy confidence or adding processing paths. Through the above mechanisms, the system can continuously learn from operational practices and feedback, achieving an optimization loop that balances the accuracy and practicality of handling suggestions.

[0072] Example 2 One embodiment of this disclosure provides a government work order generation and alarm system based on domain-fitting topology awareness, including: The data acquisition module is used to acquire historical work order samples and real-time alarm data, and to preprocess the real-time alarm data. The prompt word optimization module is used to extract key structured fields from the preprocessed alarm data. It introduces a prompt word optimization algorithm, based on the sample titles of historical work orders, and aims to minimize the semantic difference between the generated title and the sample title to optimize the key structured fields and generate optimized prompt words. The knowledge graph update module is used to build an operation and maintenance knowledge graph based on alarm data and optimization prompts, extract event sequences, calculate and obtain implicit dependencies or potential fault propagation paths between components that are not described in the documentation based on the event sequences, and generate an optimized operation and maintenance knowledge graph. The sequence generation module is used to extract field features based on the optimized operation and maintenance knowledge graph, calculate the comprehensive weight of each field feature, assign the comprehensive weight to each field feature, and generate a weighted structured alarm feature sequence. The fault summary generation module is used to input the weighted structured alarm feature sequence into the work order generation model, convert the weighted structured alarm feature sequence into an attention bias matrix, generate and output fault summaries step by step based on the attention bias matrix, optimize the fault summary based on the topology-aware optimization algorithm to obtain the final fault summary, generate processing suggestions and create work orders based on the final summary.

[0073] Example 3 One embodiment of this disclosure provides a non-transitory computer-readable storage medium for storing computer instructions. When these computer instructions are executed by a processor, they implement the aforementioned method for generating alarms based on domain-fitting topology awareness in government work orders.

[0074] Example 4 One embodiment of this disclosure provides an electronic device, including a processor, a memory, and a computer program; wherein the processor is connected to the memory, and the computer program is stored in the memory. When the electronic device is running, the processor executes the computer program stored in the memory to enable the electronic device to implement the aforementioned alarm generation method for government work orders based on domain-fitting topology awareness.

[0075] This disclosure is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create a machine for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0076] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0077] While the specific embodiments of this disclosure have been described above in conjunction with the accompanying drawings, this is not intended to limit the scope of protection of this disclosure. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art without creative effort based on the technical solutions of this disclosure are still within the scope of protection of this disclosure.< / pid>

Claims

1. A method for generating alarms for government work orders based on domain-fitting topology awareness, characterized in that, include: Acquire historical work order samples and real-time alarm data, and preprocess the real-time alarm data; Key structured fields are extracted from the preprocessed alarm data, and a prompt word optimization algorithm is introduced. Based on the sample titles of historical work orders, the key structured fields are optimized to minimize the semantic difference between the generated title and the sample title, thereby generating optimized prompt words. An operation and maintenance knowledge graph is constructed based on alarm data and optimization prompts, and event sequences are extracted. Based on the event sequences, implicit dependencies or potential fault propagation paths between components that are not described in the documentation are calculated to generate an optimized operation and maintenance knowledge graph. Based on the optimized operation and maintenance knowledge graph, field features are extracted and the comprehensive weight of each field feature is calculated. The comprehensive weight is assigned to each field feature to generate a weighted structured alarm feature sequence. The weighted structured alarm feature sequence is input into the work order generation model, which converts the weighted structured alarm feature sequence into an attention bias matrix. Based on the attention bias matrix, a fault summary is generated step by step and output. The fault summary is optimized based on the topology-aware optimization algorithm to obtain the final fault summary. Based on the final summary, processing suggestions are generated and a work order is created.

2. The method for generating alarms for government work orders based on domain-fitting topology awareness as described in claim 1, characterized in that, The process of acquiring historical work order samples and real-time alarm data, and preprocessing the real-time alarm data, includes: acquiring structured JSON format alarm data in real time through monitoring probes deployed on hosts, databases, middleware, and network device nodes of the government system. The alarm data includes multiple fields such as alarm time, alarm level, alarm object, system resource status, abnormal event description, and error code. The preprocessing process includes field validity checks and field standardization mapping.

3. The method for generating alarms for government work orders based on domain-fitting topology awareness as described in claim 1, characterized in that, The process involves extracting key structured fields from the preprocessed alarm data and introducing a prompt word optimization algorithm. Based on sample titles from historical work order samples, the algorithm optimizes key structured fields to minimize the semantic difference between the generated title and the sample title, generating optimized prompt words. These key structured fields include the alarm object, error type, error code, and scope of impact. A basic prompt word is initialized. Based on sample titles from historical work order samples, the algorithm dynamically adjusts the weights of each key structured field in the basic prompt word, aiming to minimize the semantic difference loss between the generated title and the sample title. The loss function uses cosine distance calculated based on the Sentence-BERT model. Through iterative optimization, the algorithm generates the key fields that have the greatest impact on the generation quality, constructs optimized prompt words, and assigns them high weights.

4. The method for generating alarms for government work orders based on domain-fitting topology awareness as described in claim 1, characterized in that, The construction of the operation and maintenance knowledge graph based on alarm data and optimization prompts includes: parsing fault and alarm data in node documents and historical work order samples, taking the system's component nodes as vertices, and edges representing the dependencies between various components. Each vertex includes a component type attribute, a fault mode set attribute, and a criticality score attribute. The fault mode set attribute is the key field in the optimization prompts.

5. The method for generating alarms for government work orders based on domain-fitting topology awareness as described in claim 1, characterized in that, The step of calculating implicit dependencies or potential fault propagation paths between components that are not described in the documentation based on event sequence calculations and generating an optimized operation and maintenance knowledge graph includes: extracting time-series log data of each component node, extracting event sequences from them, calculating the latency mutual information between event sequences to quantify the strength of potential time-series dependencies between components, setting a dependency strength threshold, and when the calculated time-series dependency strength is greater than the dependency strength threshold, it indicates that there is a potential dependency or influence relationship between the two components. Then, an edge is added to the operation and maintenance knowledge graph, and a potential dependency relationship type is assigned. The influence weight between components is calculated to represent the size of the critical fault propagation path, thereby updating the operation and maintenance knowledge graph to obtain an optimized operation and maintenance knowledge graph.

6. The method for generating alarms for government work orders based on domain-fitting topology awareness as described in claim 1, characterized in that, The process of extracting field features from an optimized operations and maintenance knowledge graph, calculating the comprehensive weight of each field feature, and assigning the comprehensive weight to each field feature to generate a weighted structured alarm feature sequence includes: extracting field features from an optimized operations and maintenance knowledge graph, and calculating the comprehensive weight of each field feature. in, Represents static weights. Represents components within a given framework Keyness score, | F ( V The number of typical failure modes defined in the knowledge graph for this component is indicated by )|. For field features, D ( f i , T ) represents the dynamic weights based on time series analysis. T Representing a time series, α and β Used to control the balance between static and dynamic characteristics.

7. The method for generating alarms for government work orders based on domain-fitting topology awareness as described in claim 1, characterized in that, Based on the calculated comprehensive weight of each field feature and the field features themselves, a weighted structured alarm feature sequence is constructed. The weighted structured alarm feature sequence is input into the work order generation model. For those containing i For alarm data with each field feature, an attention bias matrix B is constructed, such that each feature receives a bias proportional to its importance during self-attention calculation. The diagonal elements are obtained by introducing adjustment factors, while the off-diagonal elements are set to 0. During the decoding stage, the work order generation model generates fault summaries step by step based on the weighted attention distribution.

8. A government work order generation and alarm system based on domain-fitting topology awareness, characterized in that: include: The data acquisition module is used to acquire historical work order samples and real-time alarm data, and to preprocess the real-time alarm data. The prompt word optimization module is used to extract key structured fields from the preprocessed alarm data. It introduces a prompt word optimization algorithm, based on the sample titles of historical work orders, and aims to minimize the semantic difference between the generated title and the sample title to optimize the key structured fields and generate optimized prompt words. The knowledge graph update module is used to build an operation and maintenance knowledge graph based on alarm data and optimization prompts, extract event sequences, calculate and obtain implicit dependencies or potential fault propagation paths between components that are not described in the documentation based on the event sequences, and generate an optimized operation and maintenance knowledge graph. The sequence generation module is used to extract field features based on the optimized operation and maintenance knowledge graph, calculate the comprehensive weight of each field feature, assign the comprehensive weight to each field feature, and generate a weighted structured alarm feature sequence. The fault summary generation module is used to input the weighted structured alarm feature sequence into the work order generation model, convert the weighted structured alarm feature sequence into an attention bias matrix, generate fault summaries step by step based on the attention bias matrix, generate and output fault summaries step by step based on the attention bias matrix, optimize the fault summary based on the topology-aware optimization algorithm to obtain the final fault summary, generate processing suggestions and create work orders based on the final summary.

9. A non-transitory computer-readable storage medium, characterized in that, The non-transitory computer-readable storage medium is used to store computer instructions, which, when executed by a processor, implement the government work order generation alarm method based on domain-fitting topology awareness as described in any one of claims 1-7.

10. An electronic device, characterized in that, include: The device includes a processor, a memory, and a computer program; wherein the processor is connected to the memory, the computer program is stored in the memory, and when the electronic device is running, the processor executes the computer program stored in the memory to enable the electronic device to implement the government work order generation alarm method based on domain-fitting topology awareness as described in any one of claims 1-7.

Images