Device anomaly detection method and apparatus, electronic device, and storage medium

Abstract

Embodiments of the present application provide a device anomaly detection method and device, electronic equipment and computer readable storage medium, and relate to the field of artificial intelligence. The method comprises: determining a data source related to each device to be detected; obtaining a set of prompt information, the set of prompt information comprising a plurality of first prompt information; obtaining a set of agents, the set of agents comprising a target agent corresponding to each subtask, the target agent corresponding to each subtask being used to output an intermediate detection result of the corresponding subtask; inputting each first prompt information and input data of the corresponding target agent determined from the data source into the corresponding target agent according to an execution order of each subtask to perform anomaly detection, and obtaining an anomaly detection result of a device anomaly detection task. Embodiments of the present application help relevant personnel to quickly and accurately locate the cause and impact of device anomalies, thereby solving the bottleneck of traditional methods that cannot fully analyze business indicators and rely on manual troubleshooting.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology, and more specifically, to a method, apparatus, electronic device, computer-readable storage medium, and computer program product for detecting equipment malfunctions. Background Technology

[0002] In methods for detecting equipment anomalies based on performance indicators, there is a significant reliance on manual inspections and experience-based judgment. This means engineers need to periodically perform manual checks on the equipment and rely on their experience and intuition to determine if any abnormalities exist. This method is not only inefficient, as manual inspections require substantial time and effort, but is also prone to errors. Since human judgment is often influenced by subjective factors, false alarms or missed alarms may occur.

[0003] Furthermore, these technologies rely on manual analysis of indicators and structured reporting of equipment logs. However, equipment logs are numerous, and many may be unstructured. This means that a large amount of data needs to be manually analyzed and organized to identify potential problems. This manual analysis process is both time-consuming and error-prone. Therefore, traditional equipment anomaly detection methods have significant shortcomings in both accuracy and efficiency. Summary of the Invention

[0004] This application provides a method, apparatus, electronic device, computer-readable storage medium, and computer program product for detecting equipment malfunctions, which can solve the above-mentioned problems of the prior art. The technical solution is as follows: According to one aspect of the embodiments of this application, a method for detecting device malfunction is provided, the method comprising: Identify the data sources associated with each device to be tested; Obtain a set of prompt information, which includes multiple first prompt information, each of which describes a subtask in a subtask sequence. The subtask sequence is obtained by decomposing the device anomaly detection task according to the execution order. Obtain a set of intelligent agents, the set of intelligent agents including a target intelligent agent corresponding to each subtask, and the target intelligent agent corresponding to each subtask is used to output the intermediate detection results of the corresponding subtask; According to the execution order of each subtask, each first prompt message and the input data of the corresponding target agent determined from the data source are input to the corresponding target agent for anomaly detection to obtain the anomaly detection result of the device anomaly detection task. The anomaly detection result includes the device identifier of the abnormal device among the multiple devices to be detected.

[0005] According to another aspect of the embodiments of this application, a device for detecting device malfunction is provided, the device comprising: The data source module is used to determine the data source associated with each device under test; The prompting module is used to obtain a set of prompting information, which includes multiple first prompting information. Each first prompting information describes a subtask in a subtask sequence, which is obtained by decomposing the device anomaly detection task according to the execution order. The intelligent agent module is used to acquire a set of intelligent agents, which includes a target intelligent agent corresponding to each subtask. The target intelligent agent corresponding to each subtask is used to output the intermediate detection results of the corresponding subtask. The detection module is used to input each first prompt message and the input data of the corresponding target agent determined from the data source into the corresponding target agent according to the execution order of each sub-task to perform anomaly detection, and obtain the anomaly detection result of the device anomaly detection task. The anomaly detection result includes the device identifier of the abnormal device among the multiple devices to be detected.

[0006] As an optional embodiment, the data source includes indicator data of at least one business indicator under multiple dimensions, the multiple dimensions having a hierarchical relationship, wherein the lowest dimension is the device identification dimension; The subtask sequence includes multiple first subtasks. Each first subtask includes anomaly detection of at least one business indicator in the corresponding level dimension. The higher the level of each subtask, the earlier it is executed. The intermediate detection results of each first subtask include the anomaly results of the corresponding level dimension. The detection module, according to the execution order of each subtask, inputs each first prompt message and the input data of the corresponding target agent determined from the data source into the corresponding target agent for anomaly detection, including: For the first subtask, the first prompt information describing the first subtask and the input data of the first subtask determined from the data source will be input to the target agent corresponding to the first subtask to obtain the intermediate detection result of the first subtask; wherein, the input data of the first subtask is the indicator data of at least one business indicator in the data source at the highest level dimension; For each first subtask other than the first first subtask, the first prompt information describing the first subtask and the input data of the first subtask determined from the data source based on the intermediate detection result of the previous first subtask are input to the target agent corresponding to the first subtask to obtain the intermediate detection result of the first subtask. The intermediate detection result of the last first subtask is the device identifier of the abnormal device.

[0007] As an optional embodiment, the set of prompt information further includes multiple second prompt information, each of which corresponds to a non-first first subtask, and is used to instruct the calling script to query the business indicator data from the data source under the comprehensive dimension corresponding to the non-first first subtask. The comprehensive dimension is the union of the dimension corresponding to the corresponding first subtask and the intermediate detection results of each first subtask before the corresponding first subtask. The set of intelligent agents also includes a first data drill-down intelligent agent, which is used to output the indicator data of business indicators in the comprehensive dimension corresponding to the non-first sub-task. For each subtask that is not the first subtask, the input data for the first subtask is obtained in the following way: Obtain the second prompt information corresponding to the first subtask; The second prompt information corresponding to the first subtask and the intermediate detection results of each first subtask preceding the first subtask are input into the first data drilling agent to obtain the indicator data of the business indicators determined by the first data drilling agent from the data source under the comprehensive dimension corresponding to the first subtask, which is used as the input data of the first subtask.

[0008] As an optional embodiment, the data source also includes log data from each device to be tested; The subtask sequence also includes a second subtask following the last first subtask, the second subtask including anomaly detection of the log data of the abnormal device, and the intermediate detection results of the second subtask including the root cause of the abnormality of the abnormal device; The detection module, according to the execution order of each subtask, inputs each first prompt message and the input data of the corresponding target agent determined from the data source into the corresponding target agent for anomaly detection, including: The first prompt information describing the second subtask and the input data of the second subtask determined from the data source are input to the target agent corresponding to the second subtask to obtain the root cause of the anomaly; wherein, the input data of the second subtask is the log data of the abnormal device.

[0009] As an optional embodiment, the set of prompt information further includes third prompt information, which is used to instruct the calling script to query the log data of the abnormal device from the data source; The set of intelligent agents also includes a second data drilling intelligent agent, which is used to output log data of abnormal devices; The log data of the malfunctioning device is obtained through the following methods: Receive a third prompt message; The third prompt message and the intermediate detection result of the last first subtask are input into the second data drilling agent to obtain the log data of the abnormal device determined by the second data drilling agent from the data source.

[0010] As an optional embodiment, for each of the plurality of subtasks, the first prompt information corresponding to the subtask is further used to describe the identity of the corresponding target intelligent agent and the task objective of the corresponding subtask; The first prompt information is also used to describe the input data structure of the corresponding target intelligent agent, as well as the analysis method for analyzing the input data.

[0011] As an optional embodiment, the indicator data is an indicator value sequence including multiple indicator values, each indicator value corresponding to a time point, and the positional relationship of the multiple indicator values ​​in the indicator value sequence characterizes the temporal relationship between the times corresponding to the multiple indicator values; Each first subtask also includes determining at least one of the following: Abnormal indicator values ​​in the indicator data of the corresponding level and dimension of business metrics; The time corresponding to the abnormal indicator value, and The trend of the indicator data.

[0012] As an optional embodiment, the set of intelligent agents further includes a diagnostic result generating intelligent agent, which is used to output anomaly detection conclusions; The set of prompt information also includes a fourth prompt information, which is used to indicate the requirements for generating anomaly detection conclusions based on the intermediate detection results of each sub-task and the requirements for the anomaly detection conclusions. The device further includes: The conclusion output module is used to input the intermediate detection results of each subtask and the third prompt information into the diagnostic result generation agent, and obtain the abnormal detection conclusion that meets the requirements output by the diagnostic result generation agent.

[0013] As an optional embodiment, the multiple levels of dimensions include a region dimension, a device attribute dimension, and a device identifier dimension arranged from high to low. The device attribute dimension can be of various types. The detection module performs anomaly detection on the business metrics data under the device attribute dimension, which means: Anomaly detection is performed on the indicator data of business indicators under the combination of multiple device attribute dimensions to determine the abnormal results of the combination of the multiple device attribute dimensions.

[0014] According to another aspect of the embodiments of this application, an electronic device is provided, the electronic device including a memory, a processor and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of the above-described device malfunction detection method.

[0015] According to another aspect of the embodiments of this application, a computer-readable storage medium is provided, on which a computer program is stored, wherein when the computer program is executed by a processor, the steps of the above-described device malfunction detection method are implemented.

[0016] According to one aspect of the embodiments of this application, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps of the above-described device malfunction detection method.

[0017] The beneficial effects of the technical solution provided in this application are as follows: By determining the data source related to each device to be detected, obtaining the set of prompt information and the set of intelligent agents, and decomposing the device anomaly detection task into a sequence of sub-tasks based on the idea of ​​the thought chain, the sub-task sequence includes multiple sub-tasks, and constructing the first prompt information describing each sub-task, this can reduce the inference process required for the model to understand the task, improve the accuracy and efficiency of task execution, and guide the model to determine the intermediate steps of the detection result, enhancing the interpretability of the pattern output. Furthermore, to avoid the problem of excessive divergence when a single large language model performs multiple tasks, this application adopts the method of mapping each sub-task to different intelligent agents. The arrangement of agents ensures more accurate and stable detection results. According to the execution order of each sub-task, each first prompt message and the input data of the corresponding target agent determined from the data source are input to the corresponding target agent for anomaly detection, and the anomaly detection results of the device anomaly detection task are obtained. The anomaly detection results include the device identifier of the abnormal device among the multiple devices to be detected. This can reduce unnecessary data understanding and computing power consumption of the agent set, realize the effect of automatic diagnosis and reasoning of the agent set, and help relevant personnel quickly and accurately locate the cause and impact of device anomalies. This solves the bottleneck of traditional methods that cannot fully analyze business indicators and rely on manual investigation of causes. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments of this application will be briefly introduced below.

[0019] Figure 1A A schematic diagram of the implementation environment for the device anomaly detection method provided in the embodiments of this application; Figure 1B A schematic diagram illustrating the overall concept of the equipment anomaly detection scheme provided in the embodiments of this application; Figure 2 A flowchart illustrating a method for detecting equipment malfunctions provided in an embodiment of this application; Figure 3 A schematic diagram illustrating the execution flow of an intelligent agent set based on a prompt information set, provided in an embodiment of this application; Figure 4 This application provides a schematic diagram of a process for determining abnormal devices from a data source using multiple target intelligent agents, as an embodiment of the present application. Figure 5A This is a schematic diagram of the interaction between various intelligent agents provided in an embodiment of this application; Figure 5B A schematic diagram of a device anomaly detection process provided in an embodiment of this application; Figure 6 A schematic diagram illustrating a subtask sequence and the order in which intermediate detection results are acquired, provided in an embodiment of this application; Figure 7 A flowchart illustrating the method for detecting abnormal devices provided in this application embodiment; Figure 8 This is an interactive diagram of the set of intelligent agents provided in the embodiments of this application; Figure 9 A schematic diagram of the structure of a device for detecting equipment malfunctions provided in an embodiment of this application; Figure 10 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0020] The embodiments of this application are described below with reference to the accompanying drawings. It should be understood that the embodiments described below with reference to the accompanying drawings are exemplary descriptions for explaining the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions of the embodiments of this application.

[0021] Those skilled in the art will understand that, unless otherwise stated, the singular forms “a,” “an,” and “the” used herein may also include the plural forms. It should be further understood that the terms “comprising” and “including” as used in embodiments of this application mean that the corresponding feature can be implemented as the presented feature, information, data, step, operation, element, and / or component, but do not exclude implementation as other features, information, data, step, operation, element, component, and / or combinations thereof supported by the art. It should be understood that when we say that an element is “connected” or “coupled” to another element, the one element can be directly connected or coupled to the other element, or it can mean that the one element and the other element establish a connection relationship through an intermediate element. Furthermore, “connected” or “coupled” as used herein can include wireless connection or wireless coupling. The term “and / or” as used herein indicates at least one of the items defined by the term; for example, “A and / or B” can be implemented as “A,” or as “B,” or as “A and B.”

[0022] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.

[0023] In related technologies, solutions for device anomaly alarms based on indicator monitoring include the following process: (1) Data Acquisition and Transmission: The system collects real-time operational data of the equipment, such as power consumption, network signal strength, and service execution results, through sensors deployed at key locations. This data is transmitted to the central monitoring platform in real time via wired or wireless networks; (2) Data Processing and Analysis: The received raw data undergoes preprocessing steps such as cleaning, formatting, and normalization to facilitate subsequent analysis. Utilizing advanced data analysis techniques, the system can identify data patterns under normal operating conditions and set reasonable thresholds; (3) Anomaly detection and alarm: Once data is detected to exceed the preset threshold, the system immediately triggers the anomaly detection mechanism. By comparing historical data and real-time data, the system can determine whether the device is in an abnormal state and generate detailed alarm information; (4) Alarm notification and response: Alarm information is promptly notified to relevant maintenance personnel through various means such as SMS, email, and telephone. At the same time, the system supports an automatic alarm escalation mechanism to ensure rapid response and handling at critical moments.

[0024] The relevant technologies employing manual inspection methods include the following processes: (1) Inspection plan formulation: Based on the characteristics of the equipment and the operating environment, formulate a detailed manual inspection plan, which includes the frequency, time, route and key parts and parameters to be focused on during the inspection; (2) Training of inspection personnel: Provide comprehensive training to the personnel involved in the inspection to ensure that they are familiar with the equipment operation procedures, safety precautions and methods for handling abnormal situations; (3) On-site inspection execution: The inspection personnel carry the necessary testing tools and equipment according to the plan, and conduct item-by-item inspection of the equipment. The personnel need to record the actual operating status of the equipment, compare the data records, and observe whether the equipment has abnormal noise, odor or vibration.

[0025] (4) Inspection results recording and feedback: After the inspection, the inspectors shall record the inspection results in detail and report them to the relevant person in charge. If any abnormalities are found, the emergency response procedure shall be activated immediately to ensure that the problem is resolved in a timely manner. At the same time, the inspection results shall also be used to optimize subsequent inspection plans and monitoring strategies.

[0026] Traditional methods for detecting equipment anomalies largely rely on manual inspections and experience-based judgment. This means engineers need to periodically perform manual checks on the equipment and rely on their experience and intuition to determine if any abnormalities exist. This method is not only inefficient, as manual inspections are time-consuming and labor-intensive, but also prone to errors. Because human judgment is often influenced by subjective factors, false alarms or missed alarms may occur.

[0027] Furthermore, this method relies on manual analysis of indicators and structured reporting of equipment logs. However, equipment logs are numerous, and many may be unstructured, meaning that a large amount of data needs to be manually analyzed and organized to identify potential problems. This manual analysis process is both time-consuming and error-prone. Therefore, traditional equipment anomaly detection methods have significant shortcomings in both accuracy and efficiency.

[0028] The device, apparatus, electronic equipment, computer-readable storage medium, and computer program product provided in this application are intended to solve the above-mentioned problems of the prior art, so as to achieve: (1) Based on the large language model, the abnormal performance of the equipment can be automatically detected. The intelligent drilling can identify abnormalities from different dimensions, accurately locate the precise link where the abnormality occurs, and issue abnormal alarms through multiple early warning channels, thereby solving the problem of low efficiency and inaccuracy in the traditional method of positioning. (2) Based on the large language model, the device logs and other data are automatically diagnosed, and diagnostic reports and abnormal reasoning results are intelligently generated to help relevant personnel quickly and accurately locate the cause and impact of the device abnormality, thereby solving the bottleneck of traditional methods that cannot fully analyze massive logs and rely on manual investigation of causes.

[0029] The technical solutions of this application and their effects are described below through several exemplary embodiments. It should be noted that the following embodiments can be referenced, borrowed from, or combined with each other. Identical terms, similar features, and similar implementation steps in different embodiments will not be repeated.

[0030] Figure 1A This diagram illustrates the implementation environment of the device anomaly detection method provided in this application embodiment, wherein terminal 102 communicates with server 104 via a network. A data storage system can store the data that server 104 needs to process to construct a data source. The data storage system can be integrated on server 104 or placed in the cloud or on other servers. Both terminal 102 and server 104 can be used independently to execute the device anomaly detection method provided in this application embodiment. Terminal 102 and server 104 can also be used collaboratively to execute the device anomaly detection method provided in this application embodiment. Taking the example of terminal 102 and server 104 collaboratively executing the device anomaly detection method provided in this application embodiment, the following explanation is provided: Terminal 102 can generate a device anomaly detection command and send it to server 104. When server 104 receives the device anomaly detection command, server 104 can parse the command to obtain the device identifier of the device to be detected, and obtain various indicator data of the device to be detected based on the device identifier. Server 104 obtains the set of prompt information and the set of intelligent agents, inputs the set of prompt information and the data source into the intelligent agents, and outputs the detection results through the set of intelligent agents.

[0031] Terminal 102 can be, but is not limited to, various desktop computers, laptops, smartphones, tablets, IoT devices, and portable wearable devices. IoT devices can include smart speakers, smart TVs, smart air conditioners, smart in-vehicle devices, etc. Portable wearable devices can include smartwatches, smart bracelets, head-mounted devices, etc. Server 104 can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks, and big data and artificial intelligence platforms.

[0032] In some embodiments, the terminal 102 may be loaded with an APP (Application) application, including traditional applications that require separate installation, and mini-program applications that can be used without downloading and installing, such as one or more of browser clients, web clients, or payment clients.

[0033] In some embodiments, the terminal provides online transaction services, such as payment services, to users through an application and a device under test. The device under test can be an online transaction device that provides a payment code or an online transaction device used to scan the payment code provided by the terminal. The terminal or the device under test initiates a service call to the server, and the server runs the corresponding business process. For example, if the terminal has a payment client installed, the user initiates a payment to the device under test using the payment client, and the server runs the relevant payment business process, realizing the transfer of resources from the user to the merchant.

[0034] Please see Figure 1B The figure illustrates the overall concept of the device anomaly detection scheme provided in this application embodiment. As shown, firstly, grayscale devices (devices used to test and verify new versions of programs or functions) are tested. Simultaneously, during the daily operation of all devices, the operating data of the devices are statistically analyzed to identify business indicators or sets of business indicators that can reflect key impacts. Through the device anomaly detection method provided in this application embodiment, anomaly detection is performed on key business indicators or sets of business indicators. The results of anomaly detection can include abnormal devices and abnormal indicators among the devices to be tested. These abnormal devices can be displayed in real time through a monitoring platform for staff to pay attention to and maintain, or batch processing and analysis of each abnormal indicator and abnormal device can be performed the next day. This application embodiment can also analyze the log data of abnormal devices to determine the root cause of the anomaly and provide the staff with the final detection results and troubleshooting suggestions based on the root cause of the anomaly.

[0035] This application provides a method for detecting device malfunctions, such as... Figure 2 As shown, the method includes: S101. Determine the data source associated with each device to be tested.

[0036] In this embodiment of the application, after determining each device to be tested, relevant data of each device to be tested is obtained and stored in the data source. This embodiment of the application does not specifically limit the relevant data. Depending on the actual business performance, it may include various data such as device type, firmware version, IoT platform, algorithm, geographical location, device retry rate, device battery level, signal strength, push failure rate, etc.

[0037] The data collected in this application embodiment can be structured data. For example, the data source may include multiple tabular files, and the collected data is stored in each tabular file. In some embodiments, this application embodiment can also transform the structured data to obtain data in a text description form that is easily understood by Large Language Models (LLMs). For example, suppose F is a structured dataset obtained by analyzing the relevant data of multiple devices. The structured dataset is a table, where each row represents a device, each column represents a device attribute, and T is a text-represented key-value pair {device attribute: attribute value}. For any row in F, each data in that row can be converted into a text-represented key-value pair {device attribute: attribute value}. That is, for any row in F, it can be converted into T={k1:v1;k2:v2…k n :v n}, where T is the data in the form of a text description that is easy for large language models to understand.

[0038] In one embodiment, to save resources and speed up inference, multiple devices to be detected need to be batch-detected. Considering the need for batch data processing, the data of multiple devices to be detected can be organized into a matrix to obtain an attribute matrix. Assuming there are m devices to be detected, and each device to be detected corresponds to n device attributes, an attribute matrix (A) of size (m×n) can be constructed. In the attribute matrix, (Aij) represents the j-th device attribute of the i-th device to be detected. In addition, an index matrix (B) of size (m×1) can be set, where each element (Bi) represents the i-th device to be detected. In this way, the corresponding row in the attribute matrix (A) can be found through the element (Bi), and each row of the attribute matrix (A) represents the data text of a device to be detected, which facilitates batch processing and analysis.

[0039] It should be understood that the embodiments of this application can also construct the matrix with other information. For example, assuming there are 'a' regions, each region corresponds to 'b' business indicators, an indicator matrix (C) of size (a×b) can be constructed. In the indicator matrix, (Cij) represents the j-th business indicator of the i-th region. In addition, an index matrix (D) of size (a×1) can be set, where each element (Di) represents the i-th region. In this way, the corresponding row in the indicator matrix (C) can be found through the element (Di), and each row of the indicator matrix (C) represents the business indicator text of a region, which is convenient for batch processing and analysis.

[0040] S102. Obtain a set of prompt information, which includes multiple first prompt information. Each first prompt information describes a subtask in a subtask sequence. The subtask sequence is obtained by decomposing the device anomaly detection task according to the execution order.

[0041] Large language models typically need to receive prompts to guide their output when generating text or performing tasks. These prompts can be short and direct, or complex instructions involving multiple steps.

[0042] This application embodiment can also obtain a set of prompt information, which includes multiple first prompt information. By decomposing the device anomaly detection task according to the execution order, a sub-task sequence is obtained. Each first prompt information in the prompt information set is used to describe a sub-task in the sub-task sequence. The first prompt information is used to trigger the large speech model to output the intermediate detection results of the corresponding sub-task.

[0043] In some embodiments, the present application can clearly define the device anomaly detection task and its objective, and then decompose it into multiple sub-tasks. For example, first, the task to be decomposed is defined as the device anomaly detection task, and then the objective of this task is defined as identifying the abnormal devices among the various devices to be detected. Further, it can be determined which devices are abnormal devices and which are normal devices. For example, firstly, from a regional dimension, it can be coarsely determined which areas within a certain geographical range have abnormal devices. After determining the abnormal areas, it is further determined which device attributes of the devices are abnormal within the abnormal areas, such as which manufacturers' devices or which algorithms' devices are abnormal. After determining the abnormal device attributes, it is further determined from these devices with abnormal device attributes that the abnormal devices are identified. By continuously narrowing the search scope, the final detection result is obtained. Therefore, the device anomaly detection task can be divided into three sub-tasks: Sub-task 1: Determine the abnormal areas; Sub-task 2: Determine the abnormal device attributes; Sub-task 3: Determine the abnormal devices.

[0044] Chain of Thought (CoT) refers to a natural language processing (NLP) technology based on LLM, which significantly improves the performance of large language models (such as the GPT series) in handling complex tasks, especially those involving reasoning. Specifically, chain of thought helps the model demonstrate the intermediate steps in generating an answer, rather than jumping directly to the final answer, thereby increasing the accuracy of problem-solving and the interpretability of the model's output. When using chain of thought technology, large language models can not only provide the correct answer but also demonstrate the logical process leading to that answer. For example, in solving mathematical problems, the model can first demonstrate each step of the calculation before providing the final result. This not only improves the accuracy of the answer but also enhances people's understanding of the model's decision-making process. The prompt information set in this application embodiment is constructed based on chain of thought technology. This prompt information set guides the large language model to output various intermediate detection results in the device anomaly detection process, thereby improving the interpretability of device anomaly detection.

[0045] The prompts provide a clear and organized way to guide large language models in generating answers or content that meet specific requirements. This approach improves the accuracy and efficiency of task execution by reducing the inference process required for the model to understand the task. In the embodiments of this application, the prompts, when describing subtasks, need to define the task requirements and expected output format, thereby making it easier for large language models to generate task-relevant and high-quality content. This is crucial for improving the quality of results in natural language processing tasks, reducing errors, and increasing the predictability of output.

[0046] Taking the subtask "Detecting anomalies in business metrics data at the regional level" as an example, the prompt message for this subtask could be "Identify which regions have anomalies in the business metrics data".

[0047] S103. Obtain a set of intelligent agents, the overall set including the target intelligent agent corresponding to each subtask, and the target intelligent agent corresponding to each subtask is used to output the intermediate detection results of the corresponding subtask.

[0048] A large language model is a question-answering model that outputs a response to an input question. Large models are a class of models in machine learning and artificial intelligence characterized by a large number of parameters and complex structures. These models typically consist of multi-layered neural networks, each containing a large number of neurons. Large models are also known as pre-training models or foundational models, referring to deep neural networks with a large number of parameters.

[0049] Unlike existing technologies that sequentially input prompts for each subtask into a large language model to guide it to output the final result, this application found through testing that a single large model, when used for anomaly detection tasks on a massive number of devices, suffers from excessive divergence when performing multiple tasks consecutively, leading to unstable detection accuracy and poor performance. Therefore, this application's embodiments decompose the device anomaly detection task according to the execution order, mapping each subtask to different intelligent agents. After verification, the final detection results are more accurate and stable.

[0050] S104. According to the execution order of each subtask, each first prompt message and the input data of the corresponding target intelligent agent determined from the data source are input to the corresponding target intelligent agent for anomaly detection, and the anomaly detection result of the device anomaly detection task is obtained. The anomaly detection result includes the device identifier of the abnormal device among the multiple devices to be detected.

[0051] After obtaining the set of prompt information and the set of intelligent agents, embodiments of this application can, according to the execution order of each subtask, input each first prompt information and the input data of the corresponding target intelligent agent determined from the data source into the corresponding target intelligent agent for anomaly detection.

[0052] refer to Figure 3 In this embodiment, following the execution order of subtasks, a first prompt message describing the first subtask is determined from the prompt message set, and the data required to execute the first subtask is obtained from the data source as input data. This input data is then given to the target agent 1 corresponding to the first subtask, which obtains the intermediate detection result 1 of the first subtask. Next, based on the intermediate detection result 1 of the first subtask, the input data of the target agent corresponding to the second subtask is obtained. A first prompt message describing the second subtask is determined from the prompt message set, and this first prompt message and the input data are given to the target agent corresponding to the second subtask, thereby obtaining the intermediate detection result 2 of the second subtask. This process is iterated until a first prompt message describing the last subtask is determined from the prompt message set. Based on the intermediate detection result of the second-to-last subtask, the input data of the target agent n corresponding to the last subtask is obtained from the data source. The first prompt message describing the last subtask and the input data are given to the agent corresponding to the last subtask, thereby obtaining the intermediate detection result n of the last subtask. This intermediate detection result is then used as the anomaly detection result.

[0053] The device anomaly detection method provided in this application determines the data source related to each device to be detected, obtains a set of prompt information and a set of intelligent agents, and decomposes the device anomaly detection task into a sequence of sub-tasks based on the concept of a thought chain. The sub-task sequence includes multiple sub-tasks, and constructs first prompt information describing each sub-task. This reduces the inference process required for the model to understand the task, improves the accuracy and efficiency of task execution, and guides the model to determine the intermediate steps of the detection result, enhancing the interpretability of the pattern output. Furthermore, to avoid the problem of excessive divergence when a single large language model performs multiple tasks, this application maps each sub-task to different intelligent agents. The arrangement of the agents ensures more accurate and stable detection results. According to the execution order of each subtask, each first prompt message and the input data of the corresponding target agent determined from the data source are input to the corresponding target agent for anomaly detection to obtain the anomaly detection result of the device anomaly detection task. The anomaly detection result includes the device identifier of the abnormal device among the multiple devices to be detected. This can reduce unnecessary data understanding and computing power consumption of the agent set, realize the effect of automatic diagnosis and reasoning of the agent set, and help relevant personnel quickly and accurately locate the cause and impact of device anomalies. This solves the bottleneck of traditional methods that cannot fully analyze business indicators and rely on manual investigation of causes.

[0054] Based on the above embodiments, as an optional embodiment, the data source of this application embodiment includes indicator data of at least one business indicator under multiple dimensions.

[0055] In some embodiments, business metrics may include two categories: basic metrics and derived metrics. Basic metrics may include total number of pushes, number of online pushes, number of successful pushes, number of messages processed by the device, number of messages successfully processed by the device, number of retries, number of online devices, etc. Derived metrics may include average number of pushes per device, average number of online pushes per device, average number of successful pushes per device, average number of messages processed per device, average number of messages successfully processed per device, average number of retries per device, device offline rate (e.g., determined by (total number of pushes - number of online pushes) / total number of pushes), device push failure rate (e.g., determined by (total number of pushes - number of successful pushes) / total number of pushes), device processing efficiency failure rate (e.g., determined by (total number of pushes - number of messages successfully processed by the device) / total number of pushes), and device retry rate (e.g., determined by the number of retrying devices / total number of online devices).

[0056] Each business metric in this application embodiment can have different metric data under different dimensions. Taking the business metric, device retry rate, as an example, the metric data of this business metric under the region dimension refers to the metric data of this business metric under the device cluster in a certain region (e.g., Hubei Province), while the metric data of this business metric under the algorithm dimension refers to the metric data of this business metric under the dimension of device cluster using a certain algorithm. Obviously, the metric data of this business metric under different dimensions are different.

[0057] It should be understood that each dimension in the embodiments of this application has multiple dimension values. Taking the regional dimension as an example, the dimension values ​​of the regional dimension can include Hubei, Hunan, Hebei, Henan, etc. That is, a business indicator will have different indicator data under different dimension values ​​in the same dimension. The indicator data of a business indicator under a dimension referred to in the embodiments of this application includes the indicator data of the business indicator under each dimension value in that dimension.

[0058] The different dimensions in this application embodiment have a hierarchical relationship. Dimensions with different hierarchical relationships correspond to different sub-tasks. That is, each sub-task is used to detect abnormal results in one dimension, and the intermediate detection results of each first sub-task include abnormal results of the corresponding hierarchical dimension. Abnormal results refer to the presence of abnormal dimension values ​​in the business indicator data. Taking the region dimension as an example, the abnormal detection results under the region dimension indicate in which specific region the business indicator data shows abnormalities.

[0059] The subtask sequence of this application embodiment includes multiple first subtasks. Each first subtask includes anomaly detection for at least one business indicator at a corresponding level. Considering that the business indicators in this application embodiment have indicator data across multiple dimensions, the higher the level of each subtask, the earlier it is executed. That is, the first first subtask includes anomaly detection for the indicator data of at least one business indicator at the highest dimension, the second first subtask includes anomaly detection for the indicator data of at least one business indicator at the second highest dimension, and so on, with the last first subtask including anomaly detection for the indicator data of at least one business indicator at the lowest level dimension. In this application embodiment, the lowest level dimension is the device identification dimension. This means that when performing anomaly analysis on the indicator data of business indicators across multiple dimensions, the last subtask is to perform anomaly detection on the indicator data of at least one business indicator at the device identification dimension, obtaining anomaly results for the device identification dimension—determining which specific devices are abnormal.

[0060] It is important to note that in some scenarios, a single business metric may exist across different dimensions, and its importance for anomaly detection may change. For example, if the goal is to more accurately and reasonably detect which areas of devices are experiencing anomalies, the more suitable business metric is the average retry rate per device. However, when detecting which specific devices are experiencing anomalies, the more suitable business metric is the dropout rate. Therefore, in the embodiments of this application, the business metrics corresponding to different first sub-tasks can be the same or different. For example, the business metrics for the first first sub-task can be business metrics A, B, and C, while the business metrics for the second first sub-task can be one or more of business metrics A to C, or business metrics such as business metric D that are not involved in the first first sub-task. Alternatively, it can include one or more business metrics A to C, as well as business metrics such as business metric D that are not involved in the first first sub-task. The embodiments of this application do not impose specific limitations.

[0061] In some embodiments, this application includes three levels of dimensions: region dimension, device attribute dimension, and device identifier dimension. It should be understood that the region dimension has only one type, namely, region, which specifically includes multiple dimension values, such as Hubei, Hunan, Hebei, Henan, etc. Similarly, the device identifier dimension also has only one type, namely, device identifier, which specifically includes multiple dimension values, such as the serial number (SN) code of each device. However, the device attribute dimension, compared to the region and device identifier dimensions, has multiple types, such as device type, platform algorithm, firmware version, manufacturer, etc. Under each type of device attribute dimension, multiple dimension values ​​are included. Taking the manufacturer dimension as an example, this dimension can include dimension values ​​such as Shenzhen Company A, Shanghai Company B, Hangzhou Company C, etc.

[0062] In one embodiment, the device anomaly detection task can be decomposed into the following three sequentially executed sub-tasks: Subtask 1: Perform anomaly detection on the indicator data of multiple business feature combinations under the regional dimension to obtain the business features with anomalies (i.e., abnormal business features) and the regions with anomalies (i.e., abnormal regions). Subtask 2: Perform anomaly detection on the indicator data of abnormal business characteristics in abnormal areas under multiple device attribute dimension combinations to obtain the abnormal device attribute dimension combinations (i.e., abnormal device attributes). Subtask 3: Perform anomaly detection on the indicator data of abnormal business characteristics of abnormal areas and abnormal equipment attributes under the device identifier dimension to obtain the device identifier of the abnormality (i.e., abnormal device identifier), thereby finding the abnormal device.

[0063] Specifically, the purpose of the first sub-task 1 in this application embodiment is to combine various business features to obtain multiple business indicator combinations. Each business indicator combination includes one or more business indicators, and different business indicator combinations have at least one different business indicator. For example, business indicator combination 1 includes business indicator 1, business indicator 2, and business indicator 3, and business indicator combination 4 includes business indicator 1, business indicator 2, and business indicator 4. After obtaining multiple business indicator combinations, the indicator data of each business indicator combination under a single regional dimension is further obtained. The task objective of the first sub-task 1 is to determine the abnormal business indicators and abnormal regions from each business indicator combination. For example, if the indicator data of a certain business indicator under a certain region is abnormal, then the business indicator is determined to be an abnormal business indicator, and the region is an abnormal region.

[0064] After identifying the abnormal business metrics and abnormal areas, the detection scope can be further narrowed. The purpose of Subtask 2 is to further explore the abnormal business metrics and abnormal areas obtained in Subtask 1 down to the device attribute dimension to find abnormal device attributes. Subtask 2 differs from Subtask 1 in that it obtains combinations of business metrics; instead, it obtains combinations of device attribute dimensions. A combination of device attribute dimensions is a combination of one or more device attribute dimensions. By analyzing the metric data of abnormal business metrics within the abnormal area under different combinations of device attribute dimensions, the attribute values ​​of device attribute dimensions with key anomalies can be more accurately identified. For example, Subtask 2 can determine which company manufactured the device, which algorithm it uses, and which firmware version is abnormal.

[0065] This application embodiment further delves into the device identification dimension through the first subtask 3, that is, based on the indicator data of each device (the device that matches the intermediate detection results of the first subtask 1 and 2) according to the business indicators, and locates the device with abnormality, thus realizing the effect of gradually detecting specific abnormal devices from a data source containing massive amounts of data.

[0066] It should be noted that the business metrics provided in the above examples for the first subtasks 1-3 have the following characteristics: The first subtask corresponds to multiple business indicators (business indicator combinations), and the objective of the first subtask is to filter out abnormal business indicators from multiple business indicator combinations, thereby filtering out one or more key business indicators that can reflect equipment abnormalities from multiple business indicator combinations.

[0067] For each non-first subtask, the corresponding business metrics are all the abnormal business metrics selected from the first subtask.

[0068] The first subtask 2 provided in the above example has multiple types of device attribute dimensions. That is, it performs anomaly detection on the indicator data of business indicators under the combination of multiple device attribute dimensions, determines the abnormal results of the combination of multiple device attribute dimensions, and aims to filter out one or more key device attribute dimensions that can reflect device anomalies from multiple device attribute dimensions, and determine the abnormal dimension values ​​from these key device attribute dimensions that can reflect device anomalies.

[0069] Based on the above description, the embodiments of this application, according to the execution order of each sub-task, input each first prompt message and the input data of the corresponding target agent determined from the data source into the corresponding target agent for anomaly detection, including: For the first subtask, the first prompt information describing the first subtask and the input data of the first subtask determined from the data source will be input into the target agent corresponding to the first subtask to obtain the intermediate detection result of the first subtask. For each first subtask other than the first first subtask, the first prompt information describing the first subtask and the input data of the first subtask determined from the data source based on the intermediate detection result of the previous first subtask are input to the target agent corresponding to the first subtask to obtain the intermediate detection result of the first subtask. The intermediate detection result of the last first subtask is the device identifier of the abnormal device.

[0070] The input data for the first subtask in this embodiment is the indicator data of at least one business indicator in the data source at the highest-level dimension. Taking the highest-level dimension as the region dimension as an example, the input data for the first subtask in this embodiment is the indicator data of at least one business indicator in the data source at the region dimension. Since the region dimension has multiple dimension values, the indicator data of a business indicator at the region dimension includes the indicator data of the business indicator at each dimension value of the region dimension. By inputting the first prompt information describing the first subtask and the input data of the first subtask determined from the data source into the target agent corresponding to the first subtask, the intermediate detection result of the first subtask output by the target agent corresponding to the first subtask can be obtained.

[0071] In some embodiments, the intermediate detection results of the first subtask include at least one abnormal business metric and at least one abnormal dimension value (specific region) of at least the regional dimension.

[0072] For each subtask other than the first subtask, this embodiment determines the input data of the subtask from the data source based on the intermediate detection result of the preceding subtask. For example, when the first subtask identifies abnormal business metrics and abnormal regions, since the second subtask is for anomaly detection at the device attribute dimension, the abnormal business metrics of the abnormal region at the device attribute dimension are obtained from the data source. The first prompt information describing the second subtask and the corresponding input data are then input into the target agent corresponding to the second subtask to obtain the intermediate detection result of the second subtask, i.e., the dimension value of the device attribute dimension where anomalies exist. This process continues until the intermediate detection result of the last subtask, i.e., the device identifier of the abnormal device, is obtained.

[0073] Please see Figure 4 The example illustrates a flowchart of the process of determining abnormal devices in the device to be detected from the data source through multiple target intelligent agents in an embodiment of this application. As shown in the figure, firstly, the first prompt information 4010 is used to describe the first subtask 1 - discovering an area where business indicator A is abnormal. The first prompt information 4010 and the input data 4011 are input into the target intelligent agent 4012 to obtain the intermediate detection result 4013 output by the target intelligent agent 4012 - the specific abnormal area B. The first prompt information 4020 is used to describe the first subtask 2 - the business indicator A of the abnormal area has abnormal device attributes. The first prompt information 4020 and the input data 4021 obtained from the database according to the intermediate detection result 4013 are input to the target intelligent agent 4022 to obtain the intermediate detection result 4023 output by the target intelligent agent 4022 - the specific abnormal device attribute C. The first prompt message 4030 is used to describe the first subtask 3 - discovering devices with abnormal business indicator A among the devices in abnormal area B and abnormal device attribute C. The first prompt message 4030 and the input data 4031 obtained from the database based on the intermediate detection result 4023 are input to the target intelligent agent 4032 to obtain the intermediate detection result 4033 output by the target intelligent agent 4032 - the device identifier D of the abnormal device.

[0074] Based on the above embodiments, as an optional embodiment, the device anomaly detection method of this application adopts a method of continuously narrowing the detection range. Therefore, starting from the second first sub-task, the input data of each first sub-task is indicator data with a further narrowed detection range based on the intermediate detection results of the previous first sub-tasks. Based on this, the prompt information set of this application embodiment also includes multiple second prompt information, each second prompt information corresponding to a non-first first sub-task, used to instruct the calling script to query the business indicator data from the data source under the comprehensive dimension corresponding to the non-first first sub-task.

[0075] For each subtask that is not the first subtask, the comprehensive dimension corresponding to the subtask is the union of the dimension corresponding to the subtask and the intermediate detection results of the subtasks preceding it. For example, after the first subtask identifies the abnormal region, if the dimension corresponding to the second subtask is the device attribute dimension, then the comprehensive dimension is the union of the abnormal region and the device attribute dimension. The second subtask can be understood as performing anomaly detection on the business indicator data of each device in the device attribute dimension within the abnormal region to discover abnormal dimension values ​​in the device attribute dimension.

[0076] The intelligent agent set in this application embodiment also includes a first data drill-down intelligent agent, which is used to output the indicator data of the business indicator under the comprehensive dimension corresponding to the non-first sub-task.

[0077] In some embodiments, the first data drilling agent is used to record the intermediate detection results output by the target agent corresponding to each first subtask, generate code based on an SQL template, and query the input data of the next first task based on the code.

[0078] Accordingly, in the embodiments of this application, the input data for each non-first subtask is obtained in the following manner: Obtain the second prompt information corresponding to the first subtask; The second prompt information corresponding to the first subtask and the intermediate detection results of each first subtask preceding the first subtask are input into the first data drilling agent to obtain the indicator data of the business indicators determined by the first data drilling agent from the data source under the comprehensive dimension corresponding to the first subtask, which is used as the input data of the first subtask.

[0079] Please see Figure 5A The figure exemplifies the interaction diagram of various intelligent agents in an embodiment of this application. As shown, two adjacent target intelligent agents are associated through a first data drilling intelligent agent. Specifically... After determining the intermediate detection result of the first subtask 1, the target agent corresponding to the first subtask 1 inputs the second prompt information corresponding to the second subtask and the intermediate detection result of the first subtask into the first data drilling agent. The first data drilling agent outputs the business indicator data under the comprehensive dimension corresponding to the second subtask. The business metrics data under the comprehensive dimension corresponding to the second first subtask are used as the input data for the second first subtask. This input data, along with the first prompt information describing the second first subtask, is input into the target agent corresponding to the second first subtask to obtain the intermediate detection results of the second first subtask. This process is repeated until the intermediate detection results of the last first subtask (first subtask n) are obtained.

[0080] Please see Figure 5B This document illustrates, exemplarily, a flowchart of a device anomaly detection method provided in an embodiment of this application. This embodiment is described using three dimensions: region, device attributes, and device identifier. For simplicity, the business metrics corresponding to each first subtask in this embodiment are consistent, as shown in the figure, including: First, the first prompt information 5010 is used to describe the first subtask 1 - discovering an area where business indicator A is abnormal. The first prompt information 5010 and the input data 5011 are input into the target intelligent agent 5012 to obtain the intermediate detection result 5013 output by the target intelligent agent 5012 - the specific abnormal area B. The second prompt message 5014 is used to instruct the script to query the indicator data of business indicator A in the abnormal area and device attribute dimension from the data source. The second prompt message 5014 and the abnormal area B output by the target intelligent agent 5012 are input into the first data drill-down intelligent agent 5100. The first data drill-down intelligent agent 5100 retrieves the data source and outputs the indicator data of business indicator A in the abnormal area B and device attribute dimension (which can also be called the indicator data of business indicator A of each device in the abnormal area B and abnormal device attribute C), as the input data 5021 of the target intelligent agent 5022. The first prompt information 5020 is used to describe the first subtask 2 - the business indicator A of the abnormal area has abnormal device attributes. The first prompt information 5020 and the input data 5021 are input to the target intelligent agent 5022 to obtain the intermediate detection result 5023 output by the target intelligent agent 5022 - the specific abnormal device attribute C. The second prompt information 5024 is used to instruct the script to query the business indicator A of each device in the abnormal area and abnormal device attributes from the data source. The second prompt information 5024, the abnormal area B output by the target intelligent agent 5012, and the specific abnormal device attributes C output by the target intelligent agent 5022 are input into the first data drill-down intelligent agent 5100. The first data drill-down intelligent agent 5100 retrieves the data source and outputs the indicator data of business indicator A under the dimensions of abnormal area B, abnormal device attributes C, and device identifier, that is, the specific indicator data of the business indicators of each device with abnormal device attributes in the abnormal area, as the input data 5031 of the target intelligent agent 5032. The first prompt information 5030 is used to describe the first subtask 3 - discovering a device with abnormal business indicator A. The first prompt information 5030 and the input data 5031 are input to the target intelligent agent 5032 to obtain the intermediate detection result 5033 - the device identifier D of the abnormal device output by the target intelligent agent 5032.

[0081] Based on the above embodiments, as an optional embodiment, the data source also includes log data of each device to be tested; The subtask sequence also includes a second subtask following the last first subtask, the second subtask including anomaly detection of the log data of the abnormal device, and the intermediate detection results of the second subtask including the root cause of the abnormality of the abnormal device.

[0082] Please see Figure 6 The figure illustrates an exemplary schematic diagram of a subtask sequence provided in an embodiment of this application. As shown, the subtask sequence of this application includes four subtasks, wherein... The first subtask (subtask 1) involves anomaly detection of multiple business indicator combinations under the regional dimension. The intermediate detection results of the first subtask are the abnormal business indicators and abnormal regions. The second subtask (subtask 2) involves detecting anomalies in the abnormal business metrics of the abnormal region under the combination of device attribute dimensions. The intermediate detection result of the second subtask is the abnormal device attribute. The third subtask (subtask 3) includes anomaly detection of the indicator data of abnormal business indicators of each terminal with abnormal device attributes in the abnormal area. The intermediate detection result of the third subtask is the device identifier of the abnormal device. The fourth subtask (subtask 4) involves anomaly detection of the log data of the abnormal device. The intermediate detection result of the fourth subtask is the root cause of the abnormality of the abnormal device.

[0083] This application first performs anomaly detection on combinations of business metrics at a single regional dimension, identifying specific abnormal business metrics and abnormal regions within a broad scope. Next, it narrows the anomaly detection scope to the device attribute dimension. This step targets the abnormal business metrics, performing anomaly detection on the metric data under different combinations of business metrics to discover abnormal device attributes. Then, further limiting the abnormal region and abnormal device attributes, it performs anomaly detection on the metric data of devices with the abnormal business metrics within the aforementioned limitations, locating the abnormal device. Finally, it interprets and infers the log data generated by the abnormal device to derive the root cause of the anomaly. After identifying the abnormal device, this application further performs automatic diagnosis on the log data of the abnormal device to determine the root cause of the anomaly, helping relevant personnel quickly and accurately locate the cause of the device anomaly. This overcomes the bottlenecks of traditional methods, which cannot fully analyze massive amounts of logs and rely on manual investigation.

[0084] According to the execution order of each subtask, this embodiment of the application inputs each first prompt message and the corresponding target agent's input data determined from the data source into the corresponding target agent for anomaly detection, including: The first prompt information describing the second subtask and the input data of the second subtask determined from the data source are input to the target agent corresponding to the second subtask to obtain the root cause of the anomaly; wherein, the input data of the second subtask is the log data of the abnormal device.

[0085] This application embodiment, for the abnormal devices identified in the last first subtask, uses the target agent corresponding to the second subtask to infer the cause of the abnormality from the log data of each abnormal device. It should be noted that this application embodiment identifies one or more abnormal devices through the last first subtask. When there are multiple abnormal devices, the input data for the target agent of the second subtask can be the log data of a single abnormal device, and inference can be performed on that single device's log data; alternatively, it can input the log data of all abnormal devices, and inference can be performed based on the log data of all abnormal devices to determine the commonalities of the abnormalities across all devices, thus more accurately attributing the abnormality to the device.

[0086] Based on the above embodiments, as an optional embodiment, the prompt information set also includes a third prompt information, which is used to instruct the calling script to query the log data of the abnormal device from the data source.

[0087] The set of agents also includes a second data drill-down agent, which is used to output log data of the malfunctioning device.

[0088] The log data of the malfunctioning device is obtained through the following methods: Receive a third prompt message; The third prompt message and the intermediate detection result of the last first subtask are input into the second data drilling agent to obtain the log data of the abnormal device determined by the second data drilling agent from the data source.

[0089] Please see Figure 7 The figure illustrates a flowchart of the abnormal device detection method provided in this application embodiment. This embodiment is described using three dimensions: region, device attributes, and device identifier, as shown in the figure, including: First, the first prompt information 7010 is used to describe the first subtask 1 - discovering an area where business indicator A is abnormal. The first prompt information 7010 and the input data 7011 are input into the target intelligent agent 7012 to obtain the intermediate detection result 7013 output by the target intelligent agent 7012 - the specific abnormal area B. The second prompt message 7014 is used to instruct the script to query the indicator data of business indicator A in the abnormal area and device attribute dimension from the data source. The second prompt message 7014 and the specific abnormal area B output by the target intelligent agent 7012 are input into the first data drill-down intelligent agent 7100. The first data drill-down intelligent agent 7100 retrieves the data source and outputs the specific indicator data of business indicator A in the abnormal area B and device attribute dimension, which is used as the input data 7021 of the target intelligent agent 7022. The first prompt information 7020 is used to describe the first subtask 2 - the business indicator A of the abnormal area has abnormal device attributes. The first prompt information 7020 and the input data 7021 are input to the target intelligent agent 7022 to obtain the intermediate detection result 7023 output by the target intelligent agent 7022 - the specific abnormal device attribute C. The second prompt message 7024 is used to instruct the script to query the indicator data of business indicator A from the data source under the dimensions of abnormal area, abnormal device attribute, and device identifier. The second prompt message 7024, the abnormal area B output by the target intelligent agent 7012, and the specific abnormal device attribute C output by the target intelligent agent 7022 are input into the first data drill-down intelligent agent 7100. The first data drill-down intelligent agent 7100 retrieves the data source and outputs the specific indicator data of business indicator A under the dimensions of abnormal area B, abnormal device attribute C, and device identifier, that is, the specific indicator data of the business indicators of each device with abnormal device attribute C in abnormal area B, as the input data 7031 of the target intelligent agent 7032. The first prompt information 7030 is used to describe the first subtask 3 - discovering a device with abnormal business indicator A. The first prompt information 7030 and the input data 7031 are input to the target intelligent agent 7032 to obtain the intermediate detection result 7033 - the device identifier D of the abnormal device output by the target intelligent agent 7032. The third prompt message 7034 is used to instruct the script to query the log data of the abnormal device from the data source; Input the third prompt information 7034 and the intermediate detection result 7033—the device identifier D of the abnormal device—into the second data drilling agent 7200 to obtain the log data 7041 of the abnormal device D output by the second data drilling agent 7200.

[0090] The second prompt information 7040 is used to describe the second subtask—to perform anomaly detection on the log data 7041 of the abnormal device, find the root cause of the anomaly, input the first prompt information 7030 and the log data 7041 of the abnormal device into the target intelligent agent 7042, and obtain the intermediate detection result 7043 output by the target intelligent agent 7042—the root cause of the abnormality of the abnormal device.

[0091] In some embodiments, the first data drilling agent and the second data drilling agent in this application may be the same agent or different agents.

[0092] Each target agent in this application embodiment performs different sub-tasks to solve different problems. This requires corresponding prompts to assist the agent in reasoning and understanding input data, the specific problem to be solved, the pattern, and the output data format, etc. Based on the above embodiments, as an optional embodiment, for each of the multiple sub-tasks, the first prompt information corresponding to the sub-task is further used to describe the identity of the corresponding target agent and the task objective of the corresponding sub-task.

[0093] The first prompt information in this application embodiment describes the identity of the corresponding target intelligent agent, which can help the target intelligent agent to more accurately understand its own strengths and limitations, avoid wasting computing power on processing that is unrelated to the described identity, and also guide the model to output reasoning results that are consistent with the indicated identity from the perspective of the identity.

[0094] The first prompt describes the task objective of the corresponding subtask. On the one hand, it clarifies the task orientation, enabling the agent to accurately understand and focus on the task to be completed. This helps the model generate outputs that are highly relevant to the task objective, thereby improving the overall efficiency and accuracy of the task. On the other hand, by providing precise task objectives, fine-tuning of the model behavior can be achieved without changing the overall structure of the model, thus saving a lot of computing resources and time costs.

[0095] In some embodiments, the first prompt information of this application is further used to describe the input data structure of the corresponding target intelligent agent. The input data in this application is structured data. By describing the physical meaning of each row or column of data in the input data, the model can first more easily understand the inherent logical relationship of the input data. Secondly, by providing structured input data, the model can process information more efficiently, thereby reducing the consumption of computing resources. At the same time, structured data helps the model to more accurately capture the features of the data, thereby improving the model's predictive performance and accuracy. Thirdly, it can enhance the model's generalization ability. When the model can understand and process structured input data, it is easier to transfer the learned knowledge to new, unseen datasets. This improvement in generalization ability is crucial for the model's performance in practical applications. Furthermore, it can simplify the model training process. By providing structured input data, the model training process can be simplified. The model does not need to spend a lot of time learning the structure of the data, but can directly use this structural information to optimize its own parameters. Finally, describing the input data structure improves the interpretability of the model. Structured input data helps the model generate more interpretable output. When a model understands the structure of the data, it can more easily explain how it makes decisions, which is very helpful for model debugging and optimization.

[0096] In some embodiments of this application, the various first prompt messages are also used to describe the analysis method for analyzing the input data. The analysis methods described in this application can be multiple, thereby guiding the intelligent agent to analyze the input data using multiple analysis methods, and finally, based on the analysis results of the multiple analysis methods, comprehensively inferring the intermediate detection results.

[0097] This application's embodiments guide an intelligent agent to automatically select and fit various suitable anomaly detection algorithms based on the statistical distribution of the input data through design prompts and multiple data experiments. These algorithms include standard deviation, Z-score, exponentially weighted moving average, clustering, decision algorithms, and neural networks. By combining the diagnostic results of these different anomaly algorithms with the majority voting mechanism from machine learning, an anomaly identification conclusion is given. This improves the generalization and accuracy of anomaly identification capabilities and significantly increases project development efficiency by replacing manual implementation of multiple algorithms. The embodiments of this application can adopt different analysis methods for different sub-tasks. For example, when performing anomaly detection on business indicators in the regional dimension, clustering, box plot, decision tree and other analysis methods can be used. When performing anomaly detection on business indicators in the device attribute dimension, machine learning, wavelet transform, difference method and so on can be used.

[0098] Based on the above embodiments, as an optional embodiment, the indicator data is a sequence of indicator values ​​including multiple indicator values. Taking the indicator data of business indicator A in the regional dimension as an example, the indicator data is a sequence of indicator values ​​of business indicator A in region B for ten consecutive days. Each indicator value in the indicator value sequence corresponds to a time point, and the positional relationship of the multiple indicator values ​​in the indicator value sequence represents the temporal relationship between the time points corresponding to the multiple indicator values. That is to say, the indicator value sequence of this application is not arranged in random order or sorted based on the size of the indicator values, but rather sorted based on the time points corresponding to the indicator values, which allows the intelligent agent to discover the changing trend of the indicator values.

[0099] Each first subtask in the embodiments of this application further includes determining at least one of the following: Abnormal indicator values ​​in the indicator data of the corresponding level and dimension of business metrics; The time corresponding to the abnormal indicator value, and The trend of the indicator data.

[0100] In one embodiment, the first prompt message corresponding to the first subtask may be: 1. You are a professional data computing and analysis tool, mainly used to complete two tasks; (1) Identify abnormal indicator values ​​in the regional dimension of business indicators; (2) Discover the changing trends of business indicators at the regional level; 2. The input data has 3 columns, where ds represents time, dimension represents dimension, and index represents the combination of business metrics; 3. Based on the distribution patterns of the indicator data, you need to independently select 10 appropriate anomaly detection algorithms to calculate whether there are any anomalies in each business indicator in the business indicator combination, and make a comprehensive judgment based on the results of the 10 algorithms. 4. The intermediate detection results output illustrate three issues: (1) Which business indicator in which business indicator combination is abnormal; (2) At what point was the anomaly suspected? (3) From what point in time does the indicator value show an upward or downward trend?

[0101] In one embodiment, the first prompt message corresponding to the second first subtask may be: 1. You are a professional data computing and analysis tool, mainly used to complete two tasks; (1) Identify abnormal business metrics found in the previous step, and identify abnormal metric values ​​in the metric data of the device attribute dimension combination; (2) An abnormal combination of device attribute dimensions was found; 2. The input data has 3 columns, where ds represents time, dimension represents the combination of device attribute dimensions, index represents business metrics, and anomaly time represents suspected abnormal time. 3. Based on the distribution pattern of the indicator data, you need to independently select 10 appropriate anomaly detection algorithms to calculate whether there are any anomalies in the business indicators under each device attribute combination dimension, and make a comprehensive judgment based on the results of the 10 algorithms; 4. The intermediate detection results output illustrate three issues: (1) Which combination of device attribute dimensions is abnormal around the suspected abnormal time? (2) At what time did the anomaly occur? (3) From which day did the indicator value begin to show an upward or downward trend?

[0102] In one embodiment, the first prompt message corresponding to the third first subtask may be: 1. You are a professional data computing and analysis tool, mainly used to complete two tasks; (1) Discover abnormal indicator values ​​of business indicators under the device identifier dimension. Each device identifier in the device identifier dimension is the device identifier of the device under the abnormal device identifier dimension discovered in the previous step. (2) Abnormal equipment markings were found; 2. The input data has 3 columns, where ds represents time, SN represents device identifier, and index represents business metric; 3. Based on the distribution pattern of the indicator data, you need to independently select 10 appropriate anomaly detection algorithms to calculate whether there are any anomalies in the business indicators under each device identifier dimension, and make a comprehensive judgment based on the results of the 10 algorithms; 4. The intermediate detection results output illustrate three issues: (1) Which device identifier is abnormal? (2) At what time did the anomaly occur? (3) From which day did the indicator value begin to show an upward or downward trend?

[0103] In one embodiment, the first prompt information corresponding to the fourth first subtask may be: 1. You are a professional system log intelligent diagnostic tool, and you need to complete 3 tasks; (1) Count the number of times different error types occur; (2) Summarize and rank the errors according to their frequency of occurrence; (3) Output the error type, function name, and reasoning for the cause of the system error in descending order of severity.

[0104] In this embodiment of the application, the first prompt information guides the intelligent agent to deduce key information such as who caused the anomaly (Who), when the anomaly occurred (When), under which dimensions the anomaly occurred (Where), and what anomaly occurred (What), so that relevant personnel can investigate the problem.

[0105] 2. The output results need to address three issues; (1) Summarize and deduce the types of system errors and their severity; (2) In which function did the error occur? (3) The time point when the error occurred and the frequency of the error report; (4) Reasons for errors in reasoning.

[0106] In one embodiment, the second prompt message corresponding to the second subtask is: 1. Record the abnormal areas, abnormal business indicators, and abnormal times discovered by the target agent corresponding to the first subtask, and call the script to query the indicator values ​​of the abnormal business indicators in the indicator data of the device attribute dimension combination. In one embodiment, the second prompt message corresponding to the third subtask is: 1. Record the abnormal device attribute combinations and abnormal times discovered by the target agent corresponding to the second subtask, and call the script to query the abnormal business indicator data of devices with abnormal device attribute dimensions in the abnormal area.

[0107] In one embodiment, the third prompt message corresponding to the fourth subtask is: 1. Record the abnormal device identifiers discovered by the target agent corresponding to the third subtask, and call the script to query the date data of the devices with the abnormal device identifiers.

[0108] Based on the above embodiments, as an optional embodiment, the intelligent agent set also includes a diagnostic result generating intelligent agent, which is used to output anomaly detection conclusions.

[0109] The set of prompts also includes a fourth prompt, which is used to instruct on the generation of anomaly detection conclusions based on the intermediate detection results of each subtask and the requirements for the anomaly detection conclusions.

[0110] In some embodiments, the fourth prompt message is: 1. You are an intelligent diagnostic document assistant, and you need to generate a summary document of faults and anomalies based on the input data; 2. The input data is divided into four parts: (1) Regional dimension anomaly identification results, including anomaly dimension, anomaly index, and anomaly occurrence time; (2) Root cause results of abnormalities in equipment attribute dimensions, including combinations of abnormal attribute dimensions and time of occurrence of abnormality; (3) The root cause results of the anomalies in the equipment identification dimension can pinpoint the SN code of a specific batch and the time of the anomaly. (4) Root cause results in the system log dimension, including the types and importance of system error, the function that caused the error, and the possible causes of the error; 3. Based on the data and content in the four parts above, you need to generate a complete intelligent diagnostic result document, including three themes: summary, detailed content, and summary recommendations.

[0111] The anomaly detection method in this application embodiment further includes: inputting the intermediate detection results of each subtask and the third prompt information into the diagnostic result generation agent, and obtaining the diagnostic result generation agent to output an anomaly detection conclusion that meets the requirements.

[0112] This application embodiment uses diagnostic results to generate an intelligent agent that automatically infers and summarizes the causes of anomalies from log data of malfunctioning devices and proposes corresponding handling suggestions. In some embodiments, it also sends warning information containing anomaly detection conclusions to relevant personnel via SMS, email, etc., so as to take timely measures to prevent the situation from worsening. The anomaly detection conclusions generated by the diagnostic result generation intelligent agent in this application embodiment mainly cover the following information: (1) Overview of key information for abnormal diagnosis The diagnostic result generation agent abstracts and summarizes the intermediate detection results inferred by multiple agents in each of the preceding steps to generate an overview that describes the key information of the diagnostic conclusion, such as which devices malfunctioned and why (Why); (2) Data Preview The diagnostic results generating agent abstracts key information reflecting major errors, such as the IP address where the error occurred and the rate of change of key business indicators, thereby quantifying the impact and key information caused by equipment anomalies. (3) Detailed analysis The abnormality is broken down into different error types, and the anomaly detection conclusion describes in detail the cause and severity of the equipment abnormality. (4) Recommendations for investigation Based on the cause of the error, inferences are made, and the anomaly detection results provide targeted troubleshooting suggestions.

[0113] Please see Figure 8 The figure illustrates an interactive diagram of the intelligent agent set provided in an embodiment of this application. First, the regional anomaly detection agent (that is, the agent corresponding to the first subtask in each of the above embodiments) obtains the first intermediate detection result from the data source based on the first prompt information describing the first subtask (discovering the region where business indicator A is abnormal). The intermediate detection result includes the abnormal region B and the indicator change trend of the abnormal region B. Then, the data drill-down agent queries the data of business indicator A in the abnormal area B and the device attribute dimension from the data source based on the second prompt information; Next, the attribute anomaly detection agent (that is, the agent corresponding to the second subtask in each of the above embodiments) performs anomaly detection on the indicator data of business indicator A in the abnormal region B and the device anomaly dimension according to the first prompt information describing the second subtask (discovering that the business indicator A in the abnormal region has abnormal device attributes) and obtains the second intermediate detection result. The intermediate detection result includes the abnormal device attribute C and the changing trend of the business indicator in the abnormal region B and the abnormal device attribute C. The data drill-down agent further retrieves the specific indicator data of business indicator A under the dimensions of abnormal region, abnormal device attribute, and device identifier from the data source based on the second prompt information (calling the script to query the indicator data of business indicator A from the data source). It also retrieves the specific indicator data of business indicator A under the dimensions of abnormal region B, abnormal device attribute C, and device identifier from the data source, based on the region B discovered by the regional anomaly detection agent and the abnormal device attribute C discovered by the attribute anomaly detection agent. The anomaly detection agent (i.e., the agent corresponding to the third subtask in each of the above embodiments) outputs a third intermediate detection result based on the first prompt information describing the third subtask (discovering devices with anomalies in business indicator A) and the specific indicator data of business indicator A in the abnormal region B, abnormal device attribute C, and device identifier dimension. The intermediate detection result includes the device identifier of abnormal device C and the abnormal indicator value in the indicator data of abnormal device C. The data drilling agent further retrieves the log data of the abnormal device C from the data source based on the third prompt information (calling a script to query the log data of the abnormal device from the data source); The log reasoning agent (i.e., the agent corresponding to the fourth subtask in the above embodiments) performs anomaly detection on the log data of the abnormal device C based on the fourth first prompt information (performing anomaly detection on the log data 7041 of the abnormal device and finding the root cause of the anomaly), and determines the fourth intermediate detection result. This intermediate detection result includes the number of times different error types of the abnormal device occur, the ranking result of the number of occurrences according to the severity, and the cause of each error. The diagnostic result generating agent generates an anomaly detection conclusion that summarizes the above four intermediate detection results based on the fourth prompt information (generating anomaly detection conclusions based on the intermediate detection results of each subtask) and the four intermediate detection results.

[0114] The embodiments of this application have the following advantages: (1) High degree of automation: Automatic anomaly detection and diagnosis are achieved through intelligent agents, reducing manual intervention and improving work efficiency; (2) High accuracy: The model is trained and optimized using a large amount of data to improve its generalization ability and accuracy; (3) Strong real-time performance: It can monitor the equipment operating status in real time and promptly detect and handle abnormal situations; (4) High scalability: It is suitable for different types and sizes of production equipment and has good scalability.

[0115] The following example illustrates the flow of the abnormal device detection method according to an embodiment of this application. For ease of description, this embodiment focuses on detecting abnormal devices based on a single business metric. Please refer to Table 1, which shows the device processing message failure rate in the region dimension exported from the data source in this application embodiment. The indicator data is listed in reverse order for the device processing failure rate of the corresponding region for each date.

[0116]

[0117] Table 1. Data on Device Message Processing Failure Rate by Region Determine prompt message 1 from the set of prompt messages. Prompt message 1 is: We are providing you with two columns of data: the first column represents the date, and the second column represents the device's message processing failure rate. You need to determine two things: The first question: Identify the day with the significantly abnormal failure rate; The second question is to determine whether the failure rate started to rise significantly from a certain day, or from a certain day the failure rate began to show an upward trend.

[0118] The two problems were still solved using 10 different algorithms.

[0119] Input the prompt message 1 and Table 1 into agent 1. The intermediate detection result 1 given by agent 1 is: To address your two questions, I will provide 10 different algorithms for analysis and to draw conclusions. It should be noted that since the actual data is not provided, I will only provide the logic and steps of the algorithms, which you can then apply to real-world data.

[0120] The first question: Identify the day with the significantly abnormal failure rate. Algorithm 1: Standard Deviation Method Calculate the average failure rate for all days, calculate the standard deviation, and identify the days with failure rates exceeding the average plus or minus two (or more) standard deviations, as these days may be outliers. Algorithm 2: Box Plot Method Box plots are used to identify outliers; values ​​outside the upper and lower bounds of the box plot are considered outliers. Algorithm 3: Z-score method Calculate the difference between the daily failure rate and the average failure rate, divide by the standard deviation to obtain the Z-score, and find the number of days when the absolute value of the Z-score is greater than a certain threshold (such as 2 or 3).

[0121] Algorithm 4: Moving Average Method Calculate the average failure rate within the sliding window and identify the days that deviate significantly from the moving average. Algorithm 5: Exponentially Weighted Moving Average (EWMA) Use EWMA to smooth the data and identify the number of days that deviate significantly from the smoothed value; Algorithm 6: Seasonal Decomposition Method If the data exhibits seasonality, perform seasonal decomposition first; identify outliers outside of the seasonal components. Algorithm 7: Clustering Cluster the data points to identify the days that are far from other data points; Algorithm 8: Decision Tree Method Use decision tree algorithms to identify outliers; Algorithm 9: Neural Network Method Train a neural network model to identify outliers; Algorithm 10: Statistical Tests Perform statistical tests (such as t-tests) on the daily failure rate to identify values ​​that are significantly different from those of other days.

[0122] The second question: Determine whether the failure rate began to rise significantly or show an upward trend from a certain day. Algorithm 1: Linear Regression Slope Method Perform linear regression on the daily failure rate and calculate the slope; find the starting point where the slope is significantly positive. Algorithm 2: Finite Difference Method Calculate the difference in the daily failure rate and find the starting point where the difference turns from negative to positive or remains positive. Algorithm 3: Moving Average Slope Method Calculate the moving average of the failure rate within the sliding window, find its slope, and identify the point where the slope begins to rise significantly. Algorithm 4: Exponential Smoothing Use exponential smoothing to predict future failure rates and compare them with actual values ​​to identify the point where the predicted value begins to be significantly lower than the actual value. Algorithm 5: ARIMA Model Method Build an ARIMA model to predict the failure rate, analyze the model residuals, and identify the point where the failure rate begins to rise. Algorithm 6: Seasonal Decomposition Trend Method Decompose the seasonal and trend components of the data, analyze the changes in the trend components, and find the starting point of the upward trend; Algorithm 7: Mann-Kendall Trend Test Use the Mann-Kendall nonparametric trend test to detect an upward trend in the failure rate; Algorithm 8: Spearman's Rank Correlation Coefficient Method Calculate the Spearman rank correlation coefficient to detect an upward trend in the failure rate; Algorithm 9: Wavelet Transform Method Wavelet transform is used to analyze time series data of failure rates to identify the starting point of an upward trend; Algorithm 10: Machine Learning Methods (such as Random Forest) Train a machine learning model to predict the trend of failure rate, analyze the model's prediction results, and find the point where the failure rate begins to rise. Please note that some of the algorithms above may require additional parameter settings or data preprocessing steps. In practical applications, you may need to select the appropriate algorithm and method based on the specific characteristics of the data and your business requirements.

[0123] Here are the conclusions regarding the first question: identifying which day had a significantly abnormal failure rate: Standard deviation method: It might be considered that the failure rates of 20240726 (0.283698) and 20240626 (0.287351) are outliers because they are lower than the average minus 2 standard deviations; Exponentially Weighted Moving Average (EWMA): May identify dates 20240726 and 20240626 where the smoothed value deviates significantly; For the sake of space, this application only lists the abnormal dates detected by two methods in the embodiments.

[0124] The following is a conclusion regarding the second question: determining whether the failure rate began to rise significantly or show an upward trend from a certain day: Linear regression slope method: It may be found that the failure rate shows an upward trend starting from 20240727 or 20240728; Difference method: It may be found that starting from 20240727, the failure rate bifurcation is consistently positive, indicating an upward trend.

[0125] Due to space limitations, this application only lists the results of two methods for detecting the trend of indicator changes in the embodiments.

[0126] Please refer to Table 2, which shows the device message processing failure rate index data in the device attribute dimension exported from the data source in the embodiments of this application. The device attribute dimension in Table 2 includes device type, supplier, IoT platform, device model, device algorithm, software version, firmware version, etc.

[0127]

[0128] Table 2. Data on Device Message Processing Failure Rate by Device Attribute Dimension Determine prompt message 2 from the set of prompt messages. Prompt message 2 is: I will give you some data and ask you to continue analyzing it. The first row contains column names, and except for the last column, they are different device attribute dimensions. The last column is the device message processing failure rate. Each row of data is a statistical analysis of different combinations of device attribute dimensions. Please help me summarize which dimension combinations have a significantly higher failure rate than the average failure rate, remove duplicates from these dimension combinations, and output them to me in a structured format.

[0129] Input the prompt message 2 and Table 2 into agent 2. Agent 2 provides the following intermediate detection result 2: After reanalysis, the following combination of dimensions indicates that the device's message processing failure rate is significantly higher than the average failure rate of 0.287: Supplier: supplier_jieke, Device Model: JKUSK, Software Version: 2.1.0, Firmware Version: app_jk_m1_v3.2.9, Product ID: WU351FRBIA; Supplier: supplier_jieke, Equipment Model: JK4GSK, Software Version: 2.1.0, Product ID: 008ZC10YJP; Supplier: supplier_jieke, Equipment Model: JKUSK, Software Version: 2.1.0, Product ID: WU351FRBIA; Supplier: supplier_deda, Device Model: WV119A, Device Algorithm: 1, Software Version: 2.0.0, Firmware Version: app_dhd_s3_v2.1.5, Product ID: 8Y5CK6KSFB.

[0130] The following table, listing device attribute dimension names, demonstrates device attribute dimension combinations where the device message processing failure rate is significantly higher than the average failure rate of 0.287:

[0131] Please refer to Table 3, which shows the device processing message failure rate in the device identification dimension, derived from the data source in this application embodiment.

[0132]

[0133] Table 3. Data on Device Message Processing Failure Rate in Device Identification Dimension Message 3 is determined from the set of prompt messages. Message 3 is: I need to provide you with some new data. The first column is the date, the second column is the device serial number (SN), and the third column is the daily message processing failure rate of that device. Please help me determine which devices show a significant increase in failure rate starting from a certain day. Please provide the SN and the pattern you identified in the data.

[0134] Input the prompt message 3 and Table 3 into agent 3. The intermediate detection result 3 given by agent 2 is: Based on the data you provided, I found that the following devices experienced a significant increase in message processing failure rate starting on a certain day: Device sn:B4NOLTR's failure rate rose from 0 to 0.083 starting on 2024-06-26, and then remained at 1 after 2024-07-01.

[0135] Starting with device SN: J0000C52024-06-21, the failure rate fluctuated between 0 and 1, but the overall trend was upward.

[0136] The following are examples of obtaining anomaly attribution by performing anomaly detection on log data through embodiments of this application: Log data analysis and troubleshooting report I. Overview This report provides a detailed analysis of network connection failures of device 'JBJ3703' under different IP addresses, based on the provided log data.

[0137] II. Log Data Overview The log data primarily records network connection failures of device JBJ3703 under two IP addresses (`30.168.239.xx` and `9.141.213.xx`). The logs display error messages from multiple network connection failures, as well as some other related errors.

[0138] III. Detailed Analysis 1. Network connection failure analysis IP address '30.168.239.xx': The logs recorded multiple network connection failures, with the timestamps concentrated between 17:26:44 and 17:26:48 on August 15, 2024. The error message `network connect failed:1` indicates that the device failed to connect to the network multiple times under this IP address.

[0139] IP address '9.141.213.xx': The logs recorded multiple network connection failures, with the timestamps concentrated between 17:17:55 and 17:17:59 on August 15, 2024. The error message is also 'network connect failed:1', indicating that the device has also failed to connect to the network multiple times under this IP address.

[0140] 2. Other related error analysis File failed to open: Both IP addresses showed the error message "open file tmp_monitor_log_data.json fail" in the logs, indicating that the device failed to open the `tmp_monitor_log_data.json` file.

[0141] List of invalid server IPs: The log shows an error message "invalid serverip list" for IP address '9.141.213.xx', indicating that the device encountered an invalid server IP list when initializing the HTTPDNS IP list.

[0142] IV. Investigation Recommendations 1. Check network connection: Verify that the device's network connectivity is normal under both IP addresses '30.168.239.xx' and '9.141.213.xx'. This can be checked using the ping command or other network diagnostic tools.

[0143] Check the network configuration to ensure that the IP address, subnet mask, gateway, etc. are configured correctly.

[0144] 2. Check the file system: Verify that the `tmp_monitor_log_data.json` file exists on the device and that the device has permission to read the file; If the file does not exist, check if the file generation logic is correct.

[0145] 3. Check the server IP list: Verify that the list of server IPs used by the device is correct and that all IP addresses are valid; Check the relevant configuration files to ensure there are no incorrect IP addresses or formatting issues.

[0146] V. Summary Analysis of the log data revealed that device 'JBJ3703' experienced multiple network connection failures under both IP addresses. It is recommended to follow the troubleshooting suggestions above to check and resolve the issue, ensuring the device's network connection is restored.

[0147] The following are examples of anomaly detection conclusions provided by the applicant's capabilities: Chapter 1: Dimensional Anomaly Detection Agent - Anomaly Information Conclusion I. Overview Through dimensional anomaly analysis, we discovered an anomaly in the failure rate indicator of equipment processing information in Yubei District, Chongqing. This section details the process and conclusions of the anomaly discovery.

[0148] II. Anomaly Indicators and Geographical Location Dimension: The anomaly indicator is "equipment information processing failure rate," and the coarse dimension is the geographical location of the equipment. We analyzed the time-series changes in the information processing failure rate of equipment in Yubei District, Chongqing.

[0149] III. Anomaly Detection Algorithms and Conclusions The following 10 anomaly detection algorithms were used for analysis: 1. Sliding window algorithm 2. Exponentially Weighted Moving Average (EWMA) Algorithm 3. Clustering Algorithm 4. Statistical methods 5. Machine Learning-Based Methods 6. Deep learning-based methods 7. Time Series Decomposition Algorithm 8. Anomaly Detection Tree Algorithm 9. Isolation Forest Algorithm 10. Artificial Neural Network Algorithms The conclusion drawn from the combined reasoning of various anomaly detection algorithms is that during the period from 14:00 to 16:00 on June 25, 2024, the failure rate of equipment processing information in Yubei District, Chongqing City, increased significantly, reaching twice the normal value.

[0150] Chapter Two: Device Attribute Dimension Anomaly Detection Agent - Anomaly Information Conclusion I. Overview This chapter reinterprets and summarizes fine-grained dimensional anomalies, outlining the anomalies that exist in specific dimensional combinations, including information such as anomalous data and anomalous percentages.

[0151] II. Conclusion After reinterpretation and summarization, we found that the following combination of dimensions exhibits a high rate of abnormal failures: The JKUSK and JK4GSK devices from supplier_jieke have a high failure rate under software version 2.1.0; The WV119A device model from supplier_dehuida has a high failure rate under software version 2.0.0; The BSJ4GSK device model from supplier_boshijie has a high failure rate under software version 2.1.0; The HK4GSK device model from supplier_hengke has a high failure rate under software version 2.1.0.

[0152] These abnormal dimension combinations generally have a high failure rate, with some reaching 100%, requiring close attention and handling.

[0153] Chapter 3 Anomaly Detection Agent in Identification Dimension - Conclusion on Anomaly Information I. Overview By monitoring and analyzing the device's serial number (SN) code, abnormal devices can be accurately located and the causes of their problems can be analyzed.

[0154] Abnormal device serial number statistics

[0155] Chapter 4 Log Anomaly Detection Agent - Anomaly Information Conclusion I. Overview By analyzing the system log information under the abnormal device's SN, the cause of the problem was further located. The network connection failure analysis device JBJ37Q3 experienced multiple network connection failures under both IP addresses.

[0156] II. Analysis of Network Connection Failures: Device JBJ37Q3 experienced multiple network connection failures under both IP addresses.

[0157] III. File Opening Failure Analysis: Device JBJ37Q3 failed multiple times when attempting to open the tmp_monitor_og_data,json file.

[0158] IV. Analysis of Invalid Server IP List: Device JBJ37Q3 displayed the error message "invalid serverip list" under IP address 9.141.213.xx.

[0159] V. Summary Following this comprehensive investigation of anomalous equipment, we have achieved significant results. The following are our main findings: 1. Regional anomaly: In Yubei District of Chongqing, we found that the failure rate of equipment processing information was often confirmed through comprehensive reasoning using multiple algorithms.

[0160] 2. Abnormal Device Attribute Dimensions: We also identified several specific combinations of device attribute dimensions, such as combinations of specific vendors and device models, and combinations of software versions and device models, which have a high failure rate when processing information.

[0161] 3. Anomaly location based on serial number: By monitoring the device serial number, we accurately located multiple devices that were malfunctioning and analyzed the causes of their problems, such as network connection failures and file opening failures.

[0162] 4. System Log Analysis: In-depth analysis of log data from abnormal devices further revealed the root cause of the problem, such as an invalid list of server IPs.

[0163] These findings provide us with valuable clues that help development teams quickly locate and resolve issues, thereby improving system stability and performance.

[0164] This application provides a device for detecting equipment malfunctions, such as... Figure 9 As shown, the device for detecting device malfunctions may include: a data source module 110, a prompting module 120, an intelligent agent module 130, and a detection module 140, wherein, Data source module 110 is used to determine the data source associated with each device to be tested; The prompt module 120 is used to obtain a set of prompt information, which includes multiple first prompt information. Each first prompt information is used to describe a subtask in a subtask sequence. The subtask sequence is obtained by decomposing the device anomaly detection task according to the execution order. The intelligent agent module 130 is used to acquire an intelligent agent set, the intelligent agent set including a target intelligent agent corresponding to each subtask, and the target intelligent agent corresponding to each subtask is used to output the intermediate detection results of the corresponding subtask; The detection module 140 is used to input each first prompt message and the input data of the corresponding target agent determined from the data source into the corresponding target agent according to the execution order of each sub-task for anomaly detection, and obtain the anomaly detection result of the device anomaly detection task. The anomaly detection result includes the device identifier of the abnormal device among the plurality of devices to be detected. The apparatus in this application embodiment can execute the method provided in this application embodiment, and the implementation principle is similar. The actions performed by each module in the apparatus of each embodiment of this application correspond to the steps in the method of each embodiment of this application. For detailed functional descriptions of each module of the apparatus, please refer to the descriptions in the corresponding methods shown above, which will not be repeated here.

[0165] This application provides an electronic device, including a memory, a processor, and a computer program stored in the memory. The processor executes the computer program to implement the steps of a device anomaly detection method. Compared with related technologies, this method can achieve the following: by determining the data source related to each device to be detected, obtaining a set of prompt information and a set of intelligent agents, and decomposing the device anomaly detection task into a sequence of sub-tasks based on the chain of thought approach, the sub-task sequence includes multiple sub-tasks, and constructing first prompt information describing each sub-task. This reduces the inference process required for the model to understand the task, improves the accuracy and efficiency of task execution, and guides the model to determine the intermediate steps of the detection result, enhancing the interpretability of the pattern output. Furthermore, it avoids the need for a single large language model to perform multiple tasks. To address the issue of excessive divergence in task execution, this application employs an arrangement method that maps each subtask to a different intelligent agent. This ensures more accurate and stable detection results. Based on the execution order of each subtask, the first prompt information and the input data of the corresponding target intelligent agent determined from the data source are input into the corresponding target intelligent agent for anomaly detection. This yields the anomaly detection results of the device anomaly detection task. The anomaly detection results include the device identifier of the abnormal device among the multiple devices to be detected. This reduces unnecessary data understanding and computational consumption of the intelligent agent set, enabling the intelligent agent set to automatically perform diagnostic reasoning. This helps relevant personnel quickly and accurately locate the cause and impact of device anomalies, thereby solving the bottlenecks of traditional methods that cannot fully analyze business indicators and rely on manual investigation.

[0166] In one alternative embodiment, an electronic device is provided, such as Figure 10 As shown, Figure 10The illustrated electronic device 4000 includes a processor 4001 and a memory 4003. The processor 4001 and the memory 4003 are connected, for example, via a bus 4002. Optionally, the electronic device 4000 may further include a transceiver 4004, which can be used for data interaction between the electronic device and other electronic devices, such as sending and / or receiving data. It should be noted that in practical applications, the transceiver 4004 is not limited to one type, and the structure of the electronic device 4000 does not constitute a limitation on the embodiments of this application.

[0167] Processor 4001 may be a CPU (Central Processing Unit), a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It can implement or execute the various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. Processor 4001 may also be a combination that implements computational functions, such as including one or more microprocessor combinations, a combination of a DSP and a microprocessor, etc.

[0168] Bus 4002 may include a pathway for transmitting information between the aforementioned components. Bus 4002 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus, etc. Bus 4002 can be divided into address bus, data bus, control bus, etc. For ease of representation, bus 4002 is represented by only one thick line in the figure, but this does not indicate that there is only one bus or one type of bus.

[0169] The memory 4003 may be ROM (Read Only Memory) or other types of static storage devices capable of storing static information and instructions, RAM (Random Access Memory) or other types of dynamic storage devices capable of storing information and instructions, or EEPROM (Electrically Erasable Programmable Read Only Memory), CD-ROM (Compact Disc Read Only Memory) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media, other magnetic storage devices, or any other medium capable of carrying or storing computer programs and capable of being read by a computer, without limitation herein.

[0170] The memory 4003 stores computer programs that execute embodiments of this application, and its execution is controlled by the processor 4001. The processor 4001 executes the computer programs stored in the memory 4003 to implement the steps shown in the foregoing method embodiments.

[0171] This application provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it can implement the steps and corresponding content of the aforementioned method embodiments.

[0172] This application also provides a computer program product, including a computer program that, when executed by a processor, can implement the steps and corresponding content of the aforementioned method embodiments.

[0173] The terms "first," "second," "third," "fourth," "1," "2," etc. (if present) in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in a sequence other than that shown in the illustrations or text descriptions.

[0174] It should be understood that although arrows indicate various operation steps in the flowcharts of this application's embodiments, the order in which these steps are implemented is not limited to the order indicated by the arrows. Unless explicitly stated herein, in some implementation scenarios of this application's embodiments, the implementation steps in each flowchart can be executed in other orders as required. Furthermore, some or all steps in each flowchart, based on the actual implementation scenario, may include multiple sub-steps or multiple stages. Some or all of these sub-steps or stages can be executed at the same time, and each sub-step or stage can also be executed at different times. In scenarios where execution times differ, the execution order of these sub-steps or stages can be flexibly configured according to requirements, and this application's embodiments do not limit this.

[0175] The above description is only an optional implementation method for some implementation scenarios of this application. It should be noted that for those skilled in the art, other similar implementation methods based on the technical concept of this application without departing from the technical concept of this application also fall within the protection scope of the embodiments of this application.

Claims

1. A method for detecting equipment malfunctions, characterized in that, include: Identify the data sources associated with each device to be tested; Obtain a set of prompt information, which includes multiple first prompt information, each of which describes a subtask in a subtask sequence. The subtask sequence is obtained by decomposing the device anomaly detection task according to the execution order. Obtain a set of intelligent agents, the set of intelligent agents including a target intelligent agent corresponding to each subtask, and the target intelligent agent corresponding to each subtask is used to output the intermediate detection results of the corresponding subtask; According to the execution order of each subtask, each first prompt message and the input data of the corresponding target agent determined from the data source are input to the corresponding target agent for anomaly detection to obtain the anomaly detection result of the device anomaly detection task. The anomaly detection result includes the device identifier of the abnormal device among the multiple devices to be detected.

2. The method according to claim 1, wherein the data source includes at least one business indicator under multiple dimensions, the multiple dimensions having a hierarchical relationship, wherein the lowest dimension is the device identification dimension; The subtask sequence includes multiple first subtasks. Each first subtask includes anomaly detection of at least one business indicator in the corresponding level dimension. The higher the level of each subtask, the earlier it is executed. The intermediate detection results of each first subtask include the anomaly results of the corresponding level dimension. The step of inputting each first prompt message and the corresponding target agent's input data determined from the data source into the corresponding target agent for anomaly detection according to the execution order of each sub-task includes: For the first subtask, the first prompt information describing the first subtask and the input data of the first subtask determined from the data source will be input to the target agent corresponding to the first subtask to obtain the intermediate detection result of the first subtask; wherein, the input data of the first subtask is the indicator data of at least one business indicator in the data source at the highest level dimension; For each first subtask other than the first first subtask, the first prompt information describing the first subtask and the input data of the first subtask determined from the data source based on the intermediate detection result of the previous first subtask are input to the target agent corresponding to the first subtask to obtain the intermediate detection result of the first subtask. The intermediate detection result of the last first subtask is the device identifier of the abnormal device.

3. The method according to claim 2, characterized in that, The set of prompt information also includes multiple second prompt information, each of which corresponds to a non-first first subtask and is used to instruct the calling script to query the business metrics data from the data source under the comprehensive dimension corresponding to the non-first first subtask. The comprehensive dimension is the union of the dimension corresponding to the corresponding first subtask and the intermediate detection results of each first subtask before the corresponding first subtask. The set of intelligent agents also includes a first data drill-down intelligent agent, which is used to output the indicator data of business indicators in the comprehensive dimension corresponding to the non-first sub-task. For each subtask that is not the first subtask, the input data for the first subtask is obtained in the following way: Obtain the second prompt information corresponding to the first subtask; The second prompt information corresponding to the first subtask and the intermediate detection results of each first subtask preceding the first subtask are input into the first data drilling agent to obtain the indicator data of the business indicators determined by the first data drilling agent from the data source under the comprehensive dimension corresponding to the first subtask, which is used as the input data of the first subtask.

4. The method according to claim 2, characterized in that, The data source also includes log data from each device to be tested; The subtask sequence also includes a second subtask following the last first subtask, the second subtask including anomaly detection of the log data of the abnormal device, and the intermediate detection results of the second subtask including the root cause of the abnormality of the abnormal device; The step of inputting each first prompt message and the corresponding target agent's input data determined from the data source into the corresponding target agent for anomaly detection according to the execution order of each sub-task includes: The first prompt information describing the second subtask and the input data of the second subtask determined from the data source are input to the target agent corresponding to the second subtask to obtain the root cause of the anomaly; wherein, the input data of the second subtask is the log data of the abnormal device.

5. The method according to claim 4, characterized in that, The set of prompt information also includes a third prompt information, which is used to instruct the script to query the log data of the abnormal device from the data source; The set of intelligent agents also includes a second data drilling intelligent agent, which is used to output log data of abnormal devices; The log data of the malfunctioning device is obtained through the following methods: Receive a third prompt message; The third prompt message and the intermediate detection result of the last first subtask are input into the second data drilling agent to obtain the log data of the abnormal device determined by the second data drilling agent from the data source.

6. The method according to any one of claims 2-5, characterized in that, For each of the plurality of subtasks, the first prompt information corresponding to the subtask is also used to describe the identity of the corresponding target intelligent agent and the task objective of the corresponding subtask; The first prompt information is also used to describe the input data structure of the corresponding target intelligent agent, as well as the analysis method for analyzing the input data.

7. The method according to claim 6, characterized in that, The indicator data is an indicator value sequence including multiple indicator values, each indicator value corresponds to a time point, and the positional relationship of the multiple indicator values ​​in the indicator value sequence characterizes the temporal relationship between the time points corresponding to the multiple indicator values. Each first subtask also includes determining at least one of the following: Abnormal indicator values ​​in the indicator data of the corresponding level and dimension of business metrics; The time corresponding to the abnormal indicator value, and The trend of the indicator data.

8. The method according to claim 2, characterized in that, The set of intelligent agents also includes a diagnostic result generating intelligent agent, which is used to output anomaly detection conclusions; The set of prompt information also includes a fourth prompt information, which is used to indicate the requirements for generating anomaly detection conclusions based on the intermediate detection results of each sub-task and the requirements for the anomaly detection conclusions. The method further includes: The intermediate detection results of each subtask and the third prompt information are input into the diagnostic result generating agent, and the diagnostic result generating agent outputs an anomaly detection conclusion that meets the requirements.

9. The method according to claim 2, characterized in that, The multiple levels of dimensions include the region dimension, the device attribute dimension, and the device identifier dimension, arranged from high to low. Among them, the device attribute dimension can be of various types. Anomaly detection of business metrics data under the device attribute dimension refers to: Anomaly detection is performed on the indicator data of business indicators under the combination of multiple device attribute dimensions to determine the abnormal results of the combination of the multiple device attribute dimensions.

10. A device for detecting equipment malfunctions, characterized in that, include: The data source module is used to determine the data source associated with each device under test; The prompting module is used to obtain a set of prompting information, which includes multiple first prompting information. Each first prompting information describes a subtask in a subtask sequence, which is obtained by decomposing the device anomaly detection task according to the execution order. The intelligent agent module is used to acquire a set of intelligent agents, which includes a target intelligent agent corresponding to each subtask. The target intelligent agent corresponding to each subtask is used to output the intermediate detection results of the corresponding subtask. The detection module is used to input each first prompt message and the input data of the corresponding target agent determined from the data source into the corresponding target agent according to the execution order of each sub-task to perform anomaly detection, and obtain the anomaly detection result of the device anomaly detection task. The anomaly detection result includes the device identifier of the abnormal device among the multiple devices to be detected.

11. An electronic device comprising a memory, a processor, and a computer program stored in the memory, characterized in that, The processor executes the computer program to implement the device anomaly detection method according to any one of claims 1-9.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the device anomaly detection method according to any one of claims 1-9.

13. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the device anomaly detection method according to any one of claims 1-9.

Images