Alarm convergence method and device based on heuristic rules and large language model enhancement, equipment and medium

Abstract

This invention discloses an alarm convergence method, apparatus, device, and medium based on heuristic rules and a large language model. The method includes: acquiring alarm data streams from a distributed cloud system; dividing the alarm data streams based on a preset time window to construct a target alarm pair set; calculating a first relevance score for each alarm pair in the target alarm pair set based on heuristic rules; classifying alarm pairs into high-confidence alarm pairs and low-confidence alarm pairs based on the first relevance score; inputting the low-confidence alarm pairs into a large language model; using the large language model to call operation and maintenance knowledge documents and system topology data to perform causal inference on the low-confidence alarm pairs to determine a second relevance score; generating a relevance matrix based on the first and second relevance scores; and aggregating the alarm data streams based on the relevance matrix to generate alarm clusters. This achieves the technical effect of improving the accuracy of alarm aggregation.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of distributed cloud system alarm processing, and in particular to an alarm convergence method and device based on heuristic rules and large language model enhancement, equipment and medium. BACKGROUND

[0002] With the rapid popularization of cloud computing, micro-service architecture and containerization technology, the scale and complexity of modern distributed cloud systems have increased significantly. These systems are usually composed of hundreds or thousands of services, components and nodes, and work together through multi-level dependencies to complete business requests. In such highly coupled systems, the abnormality of a component often propagates upstream and downstream along the dependency chain, triggering a chain reaction that causes a large number of interrelated alarm events in a short period of time. This phenomenon is commonly known as "alarm storm", which is one of the most challenging problems in current intelligent operation scenarios.

[0003] Alarm storm not only causes a sharp increase in the number of alarms in the monitoring system, but also causes problems such as information redundancy, mixed alarms, and disordered alarm sequences, making it difficult for operation engineers to determine whether these alarms are triggered by the same root cause. For example, when a database fails, multiple services that depend on the database may trigger different semantic alarms such as "timeout", "connection failure", "data loading exception" in a short period of time. Even though these alarms show obvious causal relationships, they differ greatly in text description and surface symptoms, making it difficult for humans to quickly focus on the root cause.

[0004] Existing alarm aggregation research can be divided into methods based on semantic similarity and methods based on statistical co-occurrence. The semantic-based method identifies textually similar alarms through natural language processing techniques and considers alarms with similar semantics as related. However, in complex distributed systems, alarms triggered by the same root cause often have different semantics, such as "server overload" and "server response slow", which are derived from the same resource bottleneck, but their alarm texts differ greatly. Therefore, pure text semantic methods cannot cover heterogeneous types of real related alarms. On the other hand, statistical co-occurrence methods usually rely on the co-occurrence patterns between alarms in historical alarm data to infer the relationship between alarms. This type of method relies on a large amount of historical data for learning, but in actual systems, service topology is frequently adjusted with version updates, resource scheduling and business dynamics, making the timeliness of co-occurrence patterns poor. For new alarm patterns that have not occurred, statistical methods also have difficulty in giving accurate judgments. Therefore, alarm aggregation methods that rely solely on semantics or statistics cannot maintain stable correlation in complex and dynamic distributed cloud systems. The existing technology cannot effectively alleviate the alarm storm problem. SUMMARY

[0005] This invention provides an alarm convergence method, apparatus, device, and medium based on heuristic rules and large language model enhancement to achieve accurate alarm convergence, solving the technical problem of low operation and maintenance efficiency caused by alarm redundancy and difficulty in accurately determining correlation in distributed cloud systems.

[0006] According to one aspect of the present invention, an alarm convergence method based on heuristic rules and large language model enhancement is provided, the method comprising: Obtain alarm data streams from distributed cloud systems, divide the alarm data streams based on preset time windows, and construct a target alarm pair set based on alarms within the same time window after division. The first relevance score of each alarm pair in the target alarm pair set is calculated based on heuristic rules. The alarm pairs in the target alarm pair set are divided into high-confidence alarm pairs and low-confidence alarm pairs according to the first relevance score. The low-confidence alarm pairs are input into a large language model, which then calls upon operation and maintenance knowledge documents and system topology data to perform causal inference on the low-confidence alarm pairs to determine a second relevance score. The large language model is obtained by fine-tuning a pre-built instruction fine-tuning dataset of alarm pairs and causal relationships. A correlation matrix is ​​generated based on the first correlation score and the second correlation score. The alarm data stream is then aggregated based on the correlation matrix to generate an alarm cluster.

[0007] According to another aspect of the present invention, an alarm convergence device based on heuristic rules and large language model enhancement is provided, the device comprising: The alarm segmentation module is used to acquire alarm data streams from the distributed cloud system, segment the alarm data streams based on a preset time window, and construct a target alarm pair set based on alarms within the same time window after segmentation. The first relevance determination module is used to calculate the first relevance score of each alarm pair in the target alarm pair set based on heuristic rules, and to divide the alarm pairs in the target alarm pair set into high-confidence alarm pairs and low-confidence alarm pairs according to the first relevance score. The second relevance determination module is used to input the low-confidence alarm pairs into a large language model, and use the large language model to call operation and maintenance knowledge documents and system topology data to perform causal inference on the low-confidence alarm pairs to determine the second relevance score; wherein, the large language model is fine-tuned by a pre-constructed instruction fine-tuning dataset of alarm pairs and causal relationships; The alarm cluster generation module is used to generate a correlation matrix based on the first correlation score and the second correlation score, and to aggregate the alarm data stream based on the correlation matrix to generate an alarm cluster.

[0008] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising: At least one processor; and memory that is communicatively connected to at least one processor; The memory stores a computer program that can be executed by at least one processor, which enables the at least one processor to execute the alarm convergence method based on heuristic rules and large language model enhancement according to any embodiment of the present invention.

[0009] According to another aspect of the present invention, a computer-readable storage medium is provided, which stores computer instructions for causing a processor to execute and implement the alarm convergence method based on heuristic rules and large language model enhancement of any embodiment of the present invention.

[0010] The technical solution of this invention involves acquiring alarm data streams from a distributed cloud system, dividing the alarm data streams based on a preset time window, and constructing a target alarm pair set based on alarms within the same time window after division. A first correlation score is calculated for each alarm pair in the target alarm pair set based on heuristic rules. Based on the first correlation score, the alarm pairs in the target alarm pair set are divided into high-confidence alarm pairs and low-confidence alarm pairs. The low-confidence alarm pairs are input into a large language model, which calls operation and maintenance knowledge documents and system topology data to perform causal inference on the low-confidence alarm pairs to determine a second correlation score. The large language model is fine-tuned using a pre-constructed instruction fine-tuning dataset of alarm pairs and causal relationships. A correlation matrix is ​​generated based on the first and second correlation scores. The alarm data streams are aggregated based on the correlation matrix to generate alarm clusters. This solution solves the technical problems of low operation and maintenance efficiency caused by alarm redundancy and difficulty in accurately determining correlation in distributed cloud systems, achieving the technical effects of improving alarm aggregation accuracy, focusing on root cause faults, and reducing operation and maintenance costs.

[0011] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0012] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0013] Figure 1 A flowchart illustrating an alarm convergence method based on heuristic rules and large language model enhancement, provided for an embodiment of the present invention; Figure 2 A flowchart of another alarm convergence method based on heuristic rules and large language model enhancement provided in an embodiment of the present invention; Figure 3 A schematic diagram of an alarm convergence device based on heuristic rules and large language model enhancement provided in an embodiment of the present invention; Figure 4 A schematic diagram of an electronic device for implementing an alarm convergence method based on heuristic rules and large language model enhancement according to an embodiment of the present invention. Detailed Implementation

[0014] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0015] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0016] Figure 1 This is a flowchart illustrating an alarm convergence method based on heuristic rules and large language model enhancement, provided in an embodiment of the present invention. This embodiment is applicable to alarm storm handling. The method can be executed by an alarm convergence device based on heuristic rules and large language model enhancement. This device can be implemented in hardware and / or software and can be configured in an electronic device. Figure 1 As shown, the method specifically includes the following steps: S110. Obtain the alarm data stream of the distributed cloud system, divide the alarm data stream according to a preset time window, and construct a target alarm pair set based on the alarms within the same time window after division.

[0017] In this context, a distributed cloud system can be understood as a system composed of multiple dispersed cloud resource nodes that provide services collaboratively through a network. An alarm data stream can be understood as a collection of various alarm messages continuously generated within the distributed cloud system, reflecting abnormal system states. A preset time window can be understood as a pre-defined fixed time interval, which can be preset based on experience; this embodiment does not impose specific restrictions on it. A target alarm pair set can be understood as a set of pairs of valid alarms within the same time window, filtered and used for correlation analysis.

[0018] Specifically, first, acquire the alarm data stream continuously generated in the distributed cloud system, and then divide the alarm data stream according to a preset fixed time interval, such as 5 minutes. Select effective combinations from the alarms within each time window to construct a target alarm pair set for correlation analysis, ensuring that the analysis focuses on alarms that may be related in time.

[0019] Preferably, real-time alarm data streams are obtained from a distributed cloud system. The system can originate from various infrastructures and applications, with alarms arriving continuously in the form of events. For each alarm in the real-time alarm stream, this embodiment automatically searches for relevant external knowledge documents, such as standard operating procedures, service manuals, historical fault cases, expert experience bases, and common fault mode documents, using preset text matching, key field mapping, or knowledge retrieval algorithms, and binds these documents to the alarm. The bound external knowledge documents can be used to provide contextual information in subsequent reasoning and decision-making steps, improving the accuracy and interpretability of alarm cause analysis.

[0020] Preferably, the real-time alarm data stream is divided into multiple alarm batches according to a preset time window. Alarms within each time window are considered as a candidate set that may be interconnected. Within this time window, the system extracts structural information such as service call chains, node topology, and resource dependencies to establish potential service dependencies between alarms within the same window.

[0021] Preferably, this embodiment constructs a full-stack observability data acquisition layer. Data sources primarily rely on standardized monitoring probes and agents deployed in the enterprise IT environment. Specifically, for host and Kubernetes container environments, PrometheusNodeExporter and cAdvisor can be used to collect basic resource metrics such as CPU, memory, and disk I / O; for application performance monitoring (APM), OpenTelemetrySDK is integrated to obtain service call trace data, and it is compatible with Jaeger and zipkin protocols, focusing on collecting RPC call latency, error rate, and throughput; for log data, Fluentd and Filebeat are used to collect application logs and system logs distributed across various nodes in real time. All collected data streams have unified metadata tags and are stored in time-series format, with sampling intervals set to 15 to 60 seconds. For historical data exceeding 24 hours, downsampling technology is used to aggregate it into a 5-minute granularity rolling summary window to balance storage costs and query efficiency.

[0022] Preferably, the collected data undergoes cleaning and standardization preprocessing. For example, an ETL (Extract-Transform-Load) pipeline is used to remove null values ​​and garbled fields caused by network jitter. Alarm compression and format standardization are performed, mapping alarms from different monitoring sources to a unified JSON event structure: E=(ID,Timestamp,Source,Level,Description,Entity}. Furthermore, for text description fields, regular expressions are used to remove dynamic parameters and extract alarm templates to ensure the stability of subsequent semantic analysis.

[0023] The external knowledge binding mechanism of RAG (Retrieval Enhanced Generation) for alarm templates. The system maintains an enterprise-level operation and maintenance knowledge base, which includes standard operating procedures (SOPs), historical fault review reports and service architecture documents. The specific binding process is as follows: (1) Vectorization: For the alarm template text extracted in the preprocessing, the pre-trained Sentence-BERT model is used to map the alarm template text T_alert and the knowledge base document D_doc into vectors, and an offline index is established. (2) Hybrid retrieval: The BM25 algorithm is used for keyword matching retrieval, and the Milvus or FAISS vector database is used for semantic similarity retrieval. (3) Re-ranking: The relevance scores of the recalled Top-10 documents are scored, and the document summary with the highest score is attached to the alarm event as the template-level context feature C_know.

[0024] Optionally, the step of constructing a target alarm pair set based on alarms within the same time window after partitioning includes: extracting the source service identifier, node identifier, trigger timestamp, and associated resource information of each alarm within the same time window; traversing and pairing all alarms within the same time window in a pairwise combination manner to construct an initial alarm pair set; filtering out invalid alarm pairs in the initial alarm pair set whose trigger time difference exceeds a preset time difference threshold within the window and whose source service and node are not associated, to obtain the target alarm pair set.

[0025] In this context, the source service identifier can be understood as a unique identifier used to distinguish the service to which the alarm belongs. The node identifier can be understood as a unique identifier used to distinguish the system node where the alarm resides. The trigger timestamp can be understood as the specific time information recorded when the alarm is triggered. The associated resource information can be understood as information about system resources (such as CPU, memory, etc.) related to the alarm. The initial alarm pair set can be understood as the original set formed by combining all alarms in pairs within the same time window, without filtering. The preset time difference threshold can be understood as a pre-set critical time value for judging whether the alarm trigger times are close; this embodiment does not impose specific restrictions on it. Invalid alarm pairs can be understood as alarm pairs with excessively large trigger time differences and no association between the source service and the node, requiring no further analysis.

[0026] Specifically, the source service identifier, node identifier, trigger timestamp, and associated resource information of each alarm within the same time window are extracted; all alarms within the window are traversed in pairs to construct an initial alarm pair set containing all possible combinations; invalid alarm pairs that have a trigger time difference exceeding the preset time difference threshold within the window and have no association between the source service and the node are filtered out, resulting in a target alarm pair set containing only potentially related alarm combinations, thus improving the efficiency of subsequent correlation calculations.

[0027] Preferably, this embodiment uses a sliding time window algorithm to segment the real-time alarm stream, with the window size... Set the interval to 5 minutes, with a step size of 1 minute. Within each window, construct an undirected alarm graph. ,in For alarm collection.

[0028] S120. Calculate the first correlation score of each alarm pair in the target alarm pair set based on heuristic rules, and divide the alarm pairs in the target alarm pair set into high-confidence alarm pairs and low-confidence alarm pairs according to the first correlation score.

[0029] Heuristic rules can be understood as rules (such as time-based, topological, and semantic-based rules) pre-defined based on experience, common sense, or domain knowledge, used to quickly determine the relevance of alarms. The first relevance score can be understood as a numerical value calculated using heuristic rules, quantifying the degree of association between alarm pairs. High-confidence alarm pairs can be understood as alarm pairs whose first relevance score reaches a preset standard and can be clearly determined to be relevant. Low-confidence alarm pairs can be understood as alarm pairs whose first relevance score does not reach the high-confidence standard, but are not yet determined to be irrelevant and require further analysis.

[0030] Specifically, based on preset heuristic rules such as temporal proximity, topological proximity, and semantic similarity, the first relevance score of each alarm pair in the target alarm pair set is calculated. Then, the alarm pairs are divided into two categories, high confidence and low confidence, according to the score, so as to achieve the initial screening of alarm relevance and reduce the workload of subsequent in-depth analysis.

[0031] Preferably, this embodiment analyzes all alarm pairs within the window based on heuristic rules of temporal co-occurrence, spatial topological proximity, and alarm semantic similarity, and calculates a first relevance score. Based on the relevance score, alarm pairs are divided into high-confidence alarm pairs and low-confidence alarm pairs. The high-confidence portion can be determined to be relevant by the rules without the need for a large model; the low-confidence portion indicates that the rules cannot provide a clear conclusion and requires further in-depth analysis.

[0032] Preferably, in order to calculate any two alarms First correlation score between In this embodiment, a heuristic rule calculation module based on multimodal features is designed.

[0033] The first type of rule is the time co-occurrence decay fraction. (Alarm) , The time difference is Considering that causal events are usually closely adjacent in time, an exponential decay function is used to calculate temporal correlation: ; in, This is the time decay hyperparameter.

[0034] The second type of rule is the spatial topological proximity sub-score. The corresponding entity for the alarm is calculated using the service topology graph obtained from CMDB and ServiceMesh. Shortest path hop count between To more accurately reflect the tightness of direct dependencies in a microservice architecture, this embodiment introduces a topology decay factor. (The value is 0.5), the spatial correlation score is defined as: ; This rule ensures that physically or logically adjacent faults are aggregated first.

[0035] The third type of rule is the alarm semantic similarity sub-score. The alarm text vector is calculated using the Sentence-BERT model. Cosine similarity: ; Specifically, the three sub-scores are weighted and combined to obtain the first relevance score: ; ; in, , , The rule weights can be set based on system experience or training data.

[0036] Specifically, for each pair of alarms The system determines: If If it is judged as a high-confidence correlation, then it is considered relevant. If the result is low confidence and uncertain, it will be further processed by the large language model.

[0037] Optionally, the heuristic rules include time proximity rules, topological proximity rules, and semantic similarity rules; the step of calculating the first relevance score of each alarm pair in the target alarm pair set based on the heuristic rules includes: calculating the time difference relevance score of two alarms using the time proximity rule; calculating the topological association relevance score of the alarms using the topological proximity rule; calculating the semantic association relevance score of the alarm description using the semantic similarity rule; and performing a weighted summation of the time difference relevance score, the topological association relevance score, and the semantic association relevance score to obtain the first relevance score.

[0038] The temporal proximity rule can be understood as a rule that judges the relevance of two alarms based on the proximity of their trigger times. The topological proximity rule can be understood as a rule that judges the relevance of alarms based on the topological distance between the alarm's node and the service. The semantic similarity rule can be understood as a rule that judges the relevance of alarms based on the semantic consistency of the alarm description text. The temporal difference relevance score can be understood as a numerical value calculated using the temporal proximity rule, quantifying the degree of correlation between alarm trigger times. The topological correlation relevance score can be understood as a numerical value calculated using the topological proximity rule, quantifying the degree of correlation between alarm topological locations. The semantic correlation relevance score can be understood as a numerical value calculated using the semantic similarity rule, quantifying the degree of semantic correlation between alarm descriptions. The preset weight can be understood as a pre-set value used to balance the proportion of the three types of relevance scores in the final result. It can be preset based on experience, and this embodiment does not impose specific restrictions on it.

[0039] Specifically, the time difference correlation score between two alarms is calculated using the time proximity rule, with higher scores for closer times; the topological proximity rule is used to calculate the topological association correlation score for alarms, with higher scores for closer topological distances; and the semantic similarity rule (such as cosine similarity calculation of text vectors) is used to calculate the semantic association correlation score for alarm descriptions, with higher scores for closer semantics. Finally, these three scores are weighted and summed according to preset weights to obtain a first correlation score that comprehensively reflects the degree of correlation between alarms, ensuring the comprehensiveness of the initial judgment.

[0040] Optionally, classifying alarm pairs in the target alarm pair set into high-confidence alarm pairs and low-confidence alarm pairs based on the first correlation score includes: determining the alarm pair as a high-confidence alarm pair when the first correlation score is not less than a preset first confidence threshold; and determining the alarm pair as a low-confidence alarm pair when the first correlation score is less than a preset first confidence threshold and not less than a preset second confidence threshold.

[0041] The preset first confidence threshold can be understood as a pre-set critical score value for determining that an alarm pair is of high confidence relevance. The preset second confidence threshold can be understood as a pre-set critical score value for distinguishing low confidence alarm pairs from irrelevant alarm pairs, and is less than the preset first confidence threshold. The preset first confidence threshold and the preset second confidence threshold can be preset based on experience, and this embodiment does not impose specific restrictions on them.

[0042] Specifically, two different confidence thresholds are preset. The first confidence threshold is higher than the second confidence threshold. When the first relevance score of an alarm pair is not less than the first confidence threshold, it indicates that the correlation is clear and is judged as a high-confidence alarm pair. When the first relevance score is less than the first confidence threshold but not less than the second confidence threshold, it indicates that the correlation is unclear and is judged as a low-confidence alarm pair, providing clear objects for subsequent deep inference. Optionally, when dividing the target alarm pair set by confidence, if the first relevance score of an alarm pair is less than the second confidence threshold, it indicates that there is no actual correlation and is determined as an unrelated alarm pair, directly excluded without further large language model inference and aggregation processing, further improving the overall process efficiency.

[0043] S130. Input the low-confidence alarm pairs into the large language model, and use the large language model to call the operation and maintenance knowledge documents and system topology data to perform causal inference on the low-confidence alarm pairs to determine the second relevance score; wherein, the large language model is fine-tuned by a pre-constructed instruction fine-tuning dataset of alarm pairs and causal relationships.

[0044] The large language model can be understood as a language model with powerful natural language processing and logical reasoning capabilities, fine-tuned for specific data to adapt to operational scenarios. Operational knowledge documents can be understood as knowledge documents related to operations and maintenance, including standard operating procedures, historical fault cases, and expert experience. System topology data can be understood as data reflecting the dependencies and location relationships between services, nodes, and resources in a distributed cloud system. Causal reasoning can be understood as the reasoning process that analyzes whether there is a causal relationship between alarm pairs based on alarm content, knowledge documents, and topology data. The second correlation score can be understood as a numerical value quantifying the degree of correlation between low-confidence alarm pairs, derived through causal reasoning using the large language model.

[0045] Specifically, low-confidence alarm pairs are input into a large language model fine-tuned with operation and maintenance scenario data. The model actively calls operation and maintenance knowledge documents and system topology data to perform causal reasoning on alarm pairs, accurately determine their degree of correlation, and output a second correlation score to make up for the limitations of heuristic rules.

[0046] Preferably, only low-confidence alarm pairs are sent to the large language model for inference. The large language model combines the content of the alarm pair (alarm name, description, source service, node information, etc.), the bound external knowledge documents, and the service dependency chain or topology path. Causal inference and semantic association analysis are performed, and relationship labels are output to clearly determine the association attribute of the low-confidence alarm pair, specifically "related" or "unrelated", to determine whether there is a causal relationship between the alarm pairs; the confidence score, the deterministic quantitative value corresponding to the relationship label, is normalized (ensuring the value range is in the [0,1] interval) and used as the second relevance score.

[0047] In this embodiment of the invention, the large language model can parse complex cross-service dependencies, implicit causal relationships, and alarm patterns that are difficult for rules to cover, thereby making up for the shortcomings of heuristic rules and improving the accuracy of alarm correlation judgment.

[0048] Optionally, before inputting the low-confidence alarm pairs into the large language model, the method further includes: selecting a general-purpose base language model, freezing the pre-training weights of the general-purpose base language model, and training only the newly added low-rank matrix; collecting alarm association data from historical fault work orders to construct an instruction fine-tuning dataset of alarm pairs and causal relationships; wherein the dataset contains the association of alarm pairs in different scenarios and corresponding causal logic descriptions; using low-rank adaptation technology to build a fine-tuning framework, setting hyperparameters, and training the general-purpose base language model based on the instruction fine-tuning dataset; adjusting the hyperparameters by monitoring the causal inference accuracy of the model output during training until the model's inference performance on the validation set reaches a preset standard, thus completing the fine-tuning to obtain the large language model.

[0049] In this context, the general-purpose base language model can be understood as a basic language processing model that has not undergone domain-specific adaptation, such as the LLaMA-3-8B base model. Pre-trained weights can be understood as parameters learned and fixed during the pre-training phase of the general-purpose base language model. These can be pre-set based on experience, and this embodiment does not impose specific restrictions on them. A low-rank matrix can be understood as a newly added low-dimensional matrix used to adapt to the operation and maintenance scenario, with a training cost lower than the full set of model parameters. Historical fault work orders can be understood as work order data recording past system fault situations, processing procedures, and results. The instruction fine-tuning dataset can be understood as a dataset organized in the form of instructions, containing descriptions of alarm correlations and causal logic, used for fine-tuning the model. Low-rank adaptation technology can be understood as a technique that trains only the newly added low-rank matrix and freezes the pre-trained weights to achieve efficient model fine-tuning. Hyperparameters can be understood as parameters preset before model training (such as training batch size, learning rate, etc.). The validation set can be understood as a dataset used to verify the model training effect, independent of the training data. The preset standard can be understood as a pre-set indicator (such as the causal inference accuracy threshold) to determine whether the model training is qualified. It can be preset based on experience, and this embodiment does not impose specific restrictions on it.

[0050] Specifically, a general-purpose base language model is selected, and its pre-training weights are frozen to reduce training costs. Training is performed only on newly added low-rank matrices. Alarm correlation data from historical fault work orders are collected to construct an instruction fine-tuning dataset containing the correlation and causal logic descriptions of alarm pairs under different scenarios. A fine-tuning framework is built using low-rank adaptation technology, and hyperparameters such as training batch size and learning rate are set. The model is trained based on the instruction fine-tuning dataset. During training, the causal inference accuracy of the model output is continuously monitored, and hyperparameters are adjusted according to the results until the model's inference performance on the validation set reaches the preset standard. Fine-tuning is then completed to obtain a large language model adapted to the operation and maintenance scenario, ensuring that the model has accurate alarm causal inference capabilities.

[0051] Preferably, for low-confidence alarm pairs, this embodiment introduces a large language model for deep causal reasoning. Considering the insufficient specialization of general-purpose large models in the field of operation and maintenance, this embodiment selects LLaMA-3-8B as the base model and uses LoRA (Low-Rank Adaptation) technology for efficient parameter fine-tuning. During the fine-tuning process, the pre-trained weights are maintained. Freeze, train only low-rank matrices and The formula for calculating forward propagation is: ; in, , ,rank The training data consists of a fine-tuning dataset of alarm pairs and causal relationships constructed from historical fault work orders.

[0052] Preferably, this embodiment uses prompting engineering technology to organize structured alarm information into natural language form, enabling the large language model to perform causal reasoning. The constructed prompting structure includes: (1) Task role definition module: used to instruct the model to perform alarm semantic analysis as an expert. (2) Task objective description module: clarifies the alarm relationship type to be judged (such as correlation, causality, etc.). (3) Context fusion module: splices the alarm text, involved service entities, topological associations and external knowledge information into natural language context according to a preset format. (4) Output constraint module: used to standardize the structured format of the model output for subsequent parsing and fusion.

[0053] Specifically, the large model receives a prompt consisting of the above information and outputs a JSON structure containing relational labels (relevant / irrelevant) and a confidence score. The system parses this output and directly extracts the confidence value as the semantic score for the second stage. ; Among them, The original confidence level of the model output is represented by Norm, which is used for normalization (no processing is needed if the model output is already in the 0-1 range). This ensures that the value range of S(2) strictly falls between [0,1], accurately reflecting the certainty of the large model's judgment on causal relationships.

[0054] Specifically, this embodiment employs a hierarchical conditional fusion strategy to calculate the final correlation matrix. The specific logic is as follows: For any alarm pair If it is determined to be a high-confidence correlation in step S2 ( Then, without the need for a large model, simply let (2) If it is judged to be of low confidence level ( Then, the results of the large model inference are introduced for weighted correction, and the fusion formula is: ; in, For the fusion weights of rules and models, considering the insufficient judgment power of rules for such samples, the following settings are set. This endows large models with semantic reasoning capabilities. Higher decision weights allow for the correction of ambiguous cases while ensuring efficiency.

[0055] S140. Generate a correlation matrix based on the first correlation score and the second correlation score, and aggregate the alarm data stream based on the correlation matrix to generate an alarm cluster.

[0056] The correlation matrix can be understood as a dataset that presents the final correlation degree of all alarm pairs in matrix form. An alarm cluster can be understood as a set of alarms that share a common root cause and are aggregated together.

[0057] Specifically, the first and second correlation scores are merged to generate a correlation matrix that reflects the degree of correlation among all alarm pairs. Based on this matrix, alarms in the original alarm data stream are aggregated, and alarms with common root causes are grouped into an alarm cluster to achieve alarm convergence.

[0058] Optionally, the step of generating a correlation matrix based on the first correlation score and the second correlation score, and aggregating the alarm data stream based on the correlation matrix to generate an alarm cluster, includes: determining the target correlation score of high-confidence alarm pairs and the target correlation score of low-confidence alarm pairs respectively, and constructing a correlation matrix based on multiple target correlation scores; wherein, the target correlation score of the high-confidence alarm pair is directly adopted from its first correlation score, and the target correlation score of the low-confidence alarm pair is calculated by weighting the first correlation score and the second correlation score according to a preset weight ratio; performing clustering or connected component-based grouping processing on the alarm data stream, using the Leuven community detection algorithm as the clustering method, using the target correlation score as the edge weight, and achieving alarm grouping by maximizing modularity; merging alarms with a common root cause after grouping into an alarm cluster.

[0059] The target relevance score can be understood as the alarm pair association score used to construct the relevance matrix after combining the first relevance score and / or the second relevance score. The preset weight ratio can be understood as a pre-set ratio based on experience to balance the proportion of the first and second relevance scores in the target relevance score of low-confidence alarm pairs; this embodiment does not impose specific restrictions on it. Connected component grouping can be understood as a grouping method that divides interconnected alarms into groups based on their association relationships. The Leuven community detection algorithm can be understood as a clustering algorithm that achieves community (alarm cluster) partitioning by maximizing modularity. Edge weights can be understood as numerical values ​​(i.e., target relevance scores) used in cluster analysis to represent the association strength between alarm pairs. Maximizing modularity can be understood as the optimization objective of the clustering algorithm, which aims to make the internal associations of the partitioned alarm clusters close and the inter-cluster associations sparse.

[0060] Specifically, the target relevance score of all alarm pairs is determined. High-confidence alarm pairs directly use their first relevance score, while low-confidence alarm pairs are obtained by fusing the first and second relevance scores according to a preset weight ratio to obtain the target relevance score. Then, a relevance matrix is ​​constructed based on all target relevance scores. Next, the alarm data stream is clustered or grouped based on connected components. The Leuven community detection algorithm is selected, using the target relevance score as the edge weight, and the efficient grouping of alarms is achieved by maximizing the modularity. Finally, alarms with common root causes after grouping are merged into an alarm cluster to complete the accurate aggregation of alarms.

[0061] Preferably, in this embodiment, all alarms within the window are jointly aggregated based on the first correlation score and the second correlation score. Alarms that are determined to have a common root cause are merged into an alarm cluster, and each cluster corresponds to a potential root cause of the fault.

[0062] Specifically, target relevance scores for high-confidence alarm pairs and low-confidence alarm pairs are determined separately, and a relevance matrix is ​​constructed based on multiple target relevance scores. The target relevance score for high-confidence alarm pairs is directly derived from their first relevance score, while the target relevance score for low-confidence alarm pairs is calculated by weighting the first and second relevance scores according to a preset weight ratio. The alarm data stream is then clustered or grouped based on connected components. The Leuven community detection algorithm is used as the clustering method, with the target relevance score as the edge weight, and alarm grouping is achieved by maximizing modularity. Alarms with a common root cause after grouping are merged into one alarm cluster.

[0063] Preferably, based on the final correlation matrix In this embodiment, the Louvain community detection algorithm is used to aggregate alarms. The target relevance score is regarded as the weight of the edge, and closely related alarms are divided into the same alarm cluster by maximizing the modularity. Each cluster represents an independent fault scenario.

[0064] Within each alarm cluster, the alarm that is upstream in the topology, has the earliest occurrence time, or is considered by the large model to be the most likely causal source is selected as the root cause alarm. The aggregation result is finally output in a structured form, including alarm cluster ID, cluster members, root cause alarm, and corresponding external knowledge document.

[0065] The technical solution of this invention involves acquiring alarm data streams from a distributed cloud system, dividing the alarm data streams based on a preset time window, and constructing a target alarm pair set based on alarms within the same time window after division. A first correlation score is calculated for each alarm pair in the target alarm pair set based on heuristic rules. Based on the first correlation score, the alarm pairs in the target alarm pair set are divided into high-confidence alarm pairs and low-confidence alarm pairs. The low-confidence alarm pairs are input into a large language model, which calls operation and maintenance knowledge documents and system topology data to perform causal inference on the low-confidence alarm pairs to determine a second correlation score. The large language model is fine-tuned using a pre-constructed instruction fine-tuning dataset of alarm pairs and causal relationships. A correlation matrix is ​​generated based on the first and second correlation scores. The alarm data streams are aggregated based on the correlation matrix to generate alarm clusters. This solution solves the technical problems of low operation and maintenance efficiency caused by alarm redundancy and difficulty in accurately determining correlation in distributed cloud systems, achieving the technical effects of improving alarm aggregation accuracy, focusing on root cause faults, and reducing operation and maintenance costs.

[0066] Figure 2 This is a flowchart illustrating another alarm convergence method based on heuristic rules and large language model enhancement provided in this embodiment of the invention. Based on the above embodiments, this embodiment represents a further optimization, and its specific implementation can be found in the technical solution of this embodiment. Technical terms that are the same as or corresponding to those in the above embodiments will not be repeated here. Figure 2 As shown, based on the above embodiments, the method further includes the following steps: S150. Within each alarm cluster, select the top-uppermost alarm in the topology, the alarm with the earliest first occurrence time, or the causal source alarm determined by the large language model as the root cause alarm, and generate an aggregated result containing the alarm cluster and the corresponding root cause alarm.

[0067] Root cause alarms can be understood as the original fault alarms that trigger other alarms within an alarm cluster, and are the core object of fault diagnosis. Aggregation results can be understood as structured output data containing information such as alarm cluster identifiers, alarm members within the cluster, corresponding root cause alarms, and related knowledge documents.

[0068] Specifically, after generating alarm clusters based on the correlation matrix, for each alarm cluster, the topmost alarm in the topology that conforms to the fault propagation logic, the earliest first occurrence time that conforms to the chronological logic, or the causal source alarm determined by the large language model that conforms to the intelligent reasoning logic is selected as the root cause alarm. Finally, a structured aggregation result containing alarm clusters and corresponding root cause alarms is generated, providing clear guidance for operation and maintenance personnel to quickly locate the core of the fault.

[0069] Specifically, based on system topology data (such as configuration management database CMDB, topology graph collected by service mesh), a call chain and resource dependency graph between services are constructed to clarify the upstream and downstream relationships of each service / node. For example: database service → application service → front-end service, where the database service is the upstream of this link. For all alarms within the same alarm cluster, the position of the corresponding service / node in the topology dependency graph is traced, and alarms corresponding to services / nodes without upstream dependencies or located at the starting point of the fault propagation link are selected. These alarms are the top-upper alarms in the topology. The core characteristic is that their own faults will propagate downstream along the topology dependency relationship, triggering other subsequent alarms, but they themselves will not be triggered by the faults of other service / nodes corresponding to other alarms in the cluster.

[0070] The technical solution of this invention solves the technical problems of redundant and mixed alarms and difficulty in root cause location in alarm storms in distributed cloud systems by selecting the topological upstream alarm, the alarm with the earliest first occurrence time, or the causal source alarm determined by the large language model in each alarm cluster as the root cause alarm, and generating an aggregated result containing alarm clusters and corresponding root cause alarms. It achieves the beneficial effects of quickly focusing on core faults, reducing the analysis burden of operation and maintenance personnel, and improving the efficiency of intelligent operation and maintenance.

[0071] Figure 3 This is a schematic diagram of an alarm convergence device based on heuristic rules and large language model enhancement, provided as an embodiment of the present invention. Figure 3 As shown, the device includes: an alarm division module 310, a first correlation determination module 320, a second correlation determination module 330, and an alarm cluster generation module 340.

[0072] The alarm segmentation module 310 is used to acquire alarm data streams from a distributed cloud system, segment the alarm data streams based on a preset time window, and construct a target alarm pair set based on alarms within the same time window after segmentation. The first correlation determination module 320 is used to calculate the first correlation score of each alarm pair in the target alarm pair set based on heuristic rules, and divide the alarm pairs in the target alarm pair set into high-confidence alarm pairs and low-confidence alarm pairs according to the first correlation score. The second correlation determination module 330 is used to input the low-confidence alarm pairs into a large language model, and perform causal inference on the low-confidence alarm pairs by calling operation and maintenance knowledge documents and system topology data through the large language model to determine the second correlation score. The large language model is obtained by fine-tuning a pre-constructed alarm pair and causal relationship instruction fine-tuning dataset. The alarm cluster generation module 340 is used to generate a correlation matrix based on the first correlation score and the second correlation score, and aggregate the alarm data stream based on the correlation matrix to generate an alarm cluster.

[0073] The technical solution of this invention involves acquiring alarm data streams from a distributed cloud system, dividing the alarm data streams based on a preset time window, and constructing a target alarm pair set based on alarms within the same time window after division. A first correlation score is calculated for each alarm pair in the target alarm pair set based on heuristic rules. Based on the first correlation score, the alarm pairs in the target alarm pair set are divided into high-confidence alarm pairs and low-confidence alarm pairs. The low-confidence alarm pairs are input into a large language model, which calls operation and maintenance knowledge documents and system topology data to perform causal inference on the low-confidence alarm pairs to determine a second correlation score. The large language model is fine-tuned using a pre-constructed instruction fine-tuning dataset of alarm pairs and causal relationships. A correlation matrix is ​​generated based on the first and second correlation scores. The alarm data streams are aggregated based on the correlation matrix to generate alarm clusters. This solution solves the technical problems of low operation and maintenance efficiency caused by alarm redundancy and difficulty in accurately determining correlation in distributed cloud systems, achieving the technical effects of improving alarm aggregation accuracy, focusing on root cause faults, and reducing operation and maintenance costs.

[0074] Optionally, the alarm partitioning module includes: The information extraction unit is used to extract the source service identifier, node identifier, trigger timestamp, and associated resource information for each alarm within the same time window; The initial alarm pair building unit is used to iterate and pair all alarms within the same time window in a pairwise combination manner to build an initial alarm pair set. The target alarm pair construction unit is used to filter invalid alarm pairs in the initial alarm pair set whose trigger time difference exceeds a preset time difference threshold within the window and whose source service and node are not associated, so as to obtain the target alarm pair set.

[0075] Optionally, the heuristic rules include temporal proximity rules, topological proximity rules, and semantic similarity rules; correspondingly, the first relevance determination module includes: The first calculation unit is used to calculate the time difference correlation score between two alarms using the time proximity rule; The second calculation unit is used to calculate the topological association relevance score of the alarm using the topological proximity rule; The third calculation unit is used to calculate the semantic association relevance score of the alarm description through the semantic similarity rules; The fourth calculation unit is used to perform a weighted summation of the time difference correlation score, the topological correlation correlation score, and the semantic correlation correlation score to obtain the first correlation score.

[0076] Optionally, the first correlation determination module includes: The first division unit is used to determine the alarm pair as a high-confidence alarm pair when the first correlation score is not less than a preset first confidence threshold. The second division unit is used to determine the alarm pair as a low-confidence alarm pair when the first correlation score is less than a preset first confidence threshold and not less than a preset second confidence threshold.

[0077] Optionally, the device further includes: The model selection module is used to select a general-purpose base language model before inputting the low-confidence alarm into the large language model, freeze the pre-training weights of the general-purpose base language model, and train only the newly added low-rank matrix. The dataset construction module is used to collect alarm association data from historical fault work orders to construct an instruction fine-tuning dataset of alarm pairs and causal relationships; wherein, the dataset contains the association of alarm pairs in different scenarios and the corresponding causal logic descriptions; The model fine-tuning module is used to build a fine-tuning framework using low-rank adaptation technology, set hyperparameters, and train the general-purpose base language model based on the instruction fine-tuning dataset. The model determination module is used to adjust hyperparameters during training by monitoring the causal inference accuracy of the model output until the model's inference performance on the validation set reaches the preset standard, thus completing fine-tuning to obtain a large language model.

[0078] Optionally, the alarm cluster generation module includes: A matrix construction unit is used to determine the target relevance scores of high-confidence alarm pairs and low-confidence alarm pairs respectively, and construct a relevance matrix based on multiple target relevance scores; wherein, the target relevance score of the high-confidence alarm pair is directly adopted from its first relevance score, and the target relevance score of the low-confidence alarm pair is calculated by weighting the first relevance score and the second relevance score according to a preset weight ratio. The grouping unit is used to cluster or group the alarm data stream based on connected components. The Leuven community detection algorithm is used as the clustering method, and the target relevance score is used as the edge weight. Alarm grouping is achieved by maximizing the modularity. The merging unit is used to merge alarms that have a common root cause after being grouped into an alarm cluster.

[0079] Optionally, the device further includes: The aggregation result generation module is used to aggregate the alarm data stream based on the correlation matrix, generate alarm clusters, and then select the top-uppermost alarm in each alarm cluster, the alarm with the earliest first occurrence time, or the causal source alarm determined by the large language model as the root cause alarm, and generate an aggregation result containing the alarm cluster and the corresponding root cause alarm.

[0080] The alarm convergence device based on heuristic rules and large language model enhancement provided in the embodiments of the present invention can execute the alarm convergence method based on heuristic rules and large language model enhancement provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0081] Figure 4 This is a schematic diagram of an electronic device for implementing the alarm convergence method based on heuristic rules and large language model enhancement according to embodiments of the present invention. The electronic device is intended to represent various forms of digital computers, such as laptops, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframes, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0082] like Figure 4 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded into the RAM 13 from storage unit 18. The RAM 13 can also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0083] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0084] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as alarm convergence based on heuristic rules and large language model enhancements.

[0085] In some embodiments, the alarm convergence method based on heuristic rules and large language model enhancement can be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the alarm convergence method based on heuristic rules and large language model enhancement described above can be performed. Alternatively, in other embodiments, processor 11 can be configured by any other suitable means (e.g., by means of firmware) to perform alarm convergence method based on heuristic rules and large language model enhancement.

[0086] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations may include: implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0087] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0088] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0089] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0090] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0091] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0092] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0093] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. An alarm convergence method based on heuristic rules and large language model enhancement, characterized in that, include: Obtain alarm data streams from distributed cloud systems, divide the alarm data streams based on preset time windows, and construct a target alarm pair set based on alarms within the same time window after division. The first relevance score of each alarm pair in the target alarm pair set is calculated based on heuristic rules. The alarm pairs in the target alarm pair set are divided into high-confidence alarm pairs and low-confidence alarm pairs according to the first relevance score. The low-confidence alarm pairs are input into a large language model, which then calls upon operation and maintenance knowledge documents and system topology data to perform causal inference on the low-confidence alarm pairs to determine a second relevance score. The large language model is obtained by fine-tuning a pre-built instruction fine-tuning dataset of alarm pairs and causal relationships. A correlation matrix is ​​generated based on the first correlation score and the second correlation score. The alarm data stream is then aggregated based on the correlation matrix to generate an alarm cluster.

2. The method according to claim 1, characterized in that, The construction of the target alarm pair set based on alarms within the same time window after partitioning includes: Extract the source service identifier, node identifier, trigger timestamp, and associated resource information for each alarm within the same time window; All alarms within the same time window are traversed and paired in pairs to construct an initial alarm pair set; Invalid alarm pairs in the initial alarm pair set whose trigger time difference exceeds the preset time difference threshold within the window and whose source service and node are not associated are filtered out to obtain the target alarm pair set.

3. The method according to claim 1, characterized in that, The heuristic rules include temporal proximity rules, topological proximity rules, and semantic similarity rules; the calculation of the first relevance score for each alarm pair in the target alarm pair set based on the heuristic rules includes: The time difference correlation score between two alarms is calculated using the time proximity rule. The topological correlation score of the alarm is calculated using the topological proximity rule; The semantic similarity rule is used to calculate the semantic association relevance score of the alarm description; The time difference correlation score, the topological association correlation score, and the semantic association correlation score are weighted and summed to obtain the first correlation score.

4. The method according to claim 1, characterized in that, Based on the first relevance score, the alarm pairs in the target alarm pair set are divided into high-confidence alarm pairs and low-confidence alarm pairs, including: When the first correlation score is not less than a preset first confidence threshold, the alarm pair is determined to be a high confidence alarm pair; When the first correlation score is less than a preset first confidence threshold and not less than a preset second confidence threshold, the alarm pair is determined to be a low confidence alarm pair.

5. The method according to claim 1, characterized in that, Before applying the low-confidence alert to the input large language model, the following steps are also included: A general-purpose base language model is selected, the pre-training weights of the general-purpose base language model are frozen, and training is performed only on the newly added low-rank matrix; Collect alarm correlation data from historical fault work orders to construct an instruction fine-tuning dataset of alarm pairs and causal relationships; wherein, the dataset contains the correlation of alarm pairs in different scenarios and the corresponding causal logic description; A fine-tuning framework is built using low-rank adaptation technology, hyperparameters are set, and the general-purpose base language model is trained based on the instruction fine-tuning dataset. During training, hyperparameters are adjusted by monitoring the causal inference accuracy of the model output until the model's inference performance on the validation set reaches the preset standard, thus completing fine-tuning to obtain a large language model.

6. The method according to claim 1, characterized in that, The step of generating a correlation matrix based on the first correlation score and the second correlation score, and aggregating the alarm data stream based on the correlation matrix to generate an alarm cluster, includes: The target relevance scores of high-confidence alarm pairs and low-confidence alarm pairs are determined respectively, and a relevance matrix is ​​constructed based on multiple target relevance scores; wherein, the target relevance score of the high-confidence alarm pair is directly adopted from its first relevance score, and the target relevance score of the low-confidence alarm pair is calculated by weighting the first relevance score and the second relevance score according to a preset weight ratio. The alarm data stream is clustered or grouped based on connected components. The Leuven community detection algorithm is used as the clustering method, and the target relevance score is used as the edge weight. Alarm grouping is achieved by maximizing the modularity. Alarms that share a common root cause after being grouped are merged into an alarm cluster.

7. The method according to claim 1, characterized in that, After aggregating the alarm data stream based on the correlation matrix to generate alarm clusters, the method further includes: Within each alarm cluster, the top-most alarm in the topology, the alarm with the earliest first occurrence time, or the causal source alarm determined by the large language model is selected as the root cause alarm, and an aggregated result containing the alarm cluster and the corresponding root cause alarm is generated.

8. An alarm convergence device based on heuristic rules and large language model enhancement, characterized in that, include: The alarm segmentation module is used to acquire alarm data streams from the distributed cloud system, segment the alarm data streams based on a preset time window, and construct a target alarm pair set based on alarms within the same time window after segmentation. The first relevance determination module is used to calculate the first relevance score of each alarm pair in the target alarm pair set based on heuristic rules, and to divide the alarm pairs in the target alarm pair set into high-confidence alarm pairs and low-confidence alarm pairs according to the first relevance score. The second relevance determination module is used to input the low-confidence alarm pairs into a large language model, and use the large language model to call operation and maintenance knowledge documents and system topology data to perform causal inference on the low-confidence alarm pairs to determine the second relevance score; wherein, the large language model is fine-tuned by a pre-constructed instruction fine-tuning dataset of alarm pairs and causal relationships; The alarm cluster generation module is used to generate a correlation matrix based on the first correlation score and the second correlation score, and to aggregate the alarm data stream based on the correlation matrix to generate an alarm cluster.

9. An electronic device, characterized in that, The electronic device includes: At least one processor; and a memory communicatively connected to the at least one processor; The memory stores a computer program that can be executed by the at least one processor, which is then executed by the at least one processor to enable the at least one processor to perform the alarm convergence method based on heuristic rules and large language model enhancement as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that cause a processor to execute the alarm convergence method based on heuristic rules and large language model enhancement as described in any one of claims 1-7.

Images