Industrial network self-health management method, device and electronic equipment

Abstract

The present invention relates to an industrial network self-health management method, device and electronic equipment, the method comprising: converting fault judgment rules and historical cases into a short text form suitable for Embedding processing; standardizing and threshold matching the network monitoring data collected in real time, and outputting a set of network status description sentences; Embedding processing and adaptive clustering of the standardized status description sentences; similarity retrieval based on the aggregated vectors; based on the retrieved historical cases, calling the LLM model to speculate and sort the causes of the faults, and updating the case library. The method uses a rule library for supplementary retrieval, and uses the LLM model to quickly construct historical cases, so that the system can ensure a high fault location accuracy in the early stage of deployment, thereby improving the level of self-health management, flexibly adapting to network changes, and achieving accurate fault location.

Description

Technical Field

[0001] The present invention relates to the field of industrial network management, and in particular to an industrial network self-health management method, device and electronic equipment. Background Art

[0002] Due to the particularity of industrial networks, any failure or interruption may cause economic losses or even casualties. With the development of industrial Internet technology, the scale of industrial networks continues to expand, and network management has become increasingly difficult. At present, there are methods for anomaly detection using traditional AI technologies such as Bayesian networks, machine learning, and deep learning. However, due to the non-uniform standards of various industrial networks, similar and diverse problems, and an extreme lack of negative samples, machine learning-based technologies cannot solve the problem of network variability, which leads to the problem that judgment rules need to change synchronously, and cannot solve the problem of accurately locating faults. Its flexibility and adaptability are insufficient, and it cannot cope with the challenges of self-health management brought about by the development of current complex industrial networks. Therefore, it needs to be improved. Summary of the invention

[0003] Based on this, it is necessary to provide an industrial network self-health management method, device and electronic equipment to address the problem that due to the non-uniform standards of various industrial networks, similar and diverse problems, and extreme lack of negative samples, machine learning-based technology cannot solve the problem of network variability, which leads to the need for synchronous changes in judgment rules, and cannot solve the problem of accurately locating faults. Its flexibility and adaptability are insufficient, and it cannot cope with the self-health management challenges brought about by the development of current complex industrial networks.

[0004] The present invention provides an industrial network self-health management method, the method comprising:

[0005] Convert fault judgment rules and historical cases into short text suitable for Embedding processing;

[0006] Perform standardization and threshold matching on the network monitoring data collected in real time, and output a set of short sentences describing the network status;

[0007] Perform embedding processing and adaptive clustering on the standardized state description sentences;

[0008] Perform similarity retrieval based on the aggregated vectors;

[0009] Based on the retrieved historical cases, the LLM model is called to infer and sort the fault causes, and the case library is updated.

[0010] In one embodiment, the converting of the fault determination rules and historical cases into a short text form suitable for Embedding processing includes:

[0011] Describe each fault judgment rule and historical case in natural language to obtain a text description with consistent format;

[0012] Vectorize the text description based on the pre-trained Embedding model and store the Embedding result of each text description in a vector list;

[0013] Based on a lightweight method, a hierarchical graph is constructed to encode the relevant relationship, a hierarchical graph identifier is obtained, and the hierarchical graph identifier is saved as a unique identifier of the record;

[0014] The processed rules and cases are stored in a rule base and a historical case base respectively, and the corresponding rule base and historical case base are stored in a vector database, wherein each record contains its corresponding text description, vector representation and its unique identifier.

[0015] In one embodiment, the network monitoring data collected in real time is standardized and threshold matched, and a set of short sentences describing the network status is output, including:

[0016] Obtaining network monitoring data collected by network monitoring tools and devices, and performing standardized processing on the network monitoring data, wherein the network monitoring data includes delay, packet loss rate, and bandwidth utilization;

[0017] Based on the standardized network monitoring data, identify indicators that exceed the threshold and generate corresponding short sentences describing the network status;

[0018] The network status description short sentences are stored in a set, and the network status description short sentence set is output.

[0019] In one embodiment, the identifying the indicator exceeding the threshold based on the standardized network monitoring data includes:

[0020] Obtain standardized network monitoring data;

[0021] The network monitoring data is input into the LLM model, and a result of exceeding the threshold index is output. The LLM model is based on a deep neural network and is trained using network monitoring data samples within a threshold range and network monitoring data samples outside a threshold range as training data.

[0022] In one embodiment, the embedding process and adaptive clustering of the standardized state description sentences include:

[0023] Each state description sentence is vectorized based on the pre-trained Embedding model, and a high-dimensional vector representation is output;

[0024] Convert all vector representations into a vector set;

[0025] Clustering vector sets based on agglomerative hierarchical clustering algorithm;

[0026] Call the LLM model to extract the semantic summary of each cluster;

[0027] Use position encoding to record the relationship between each short sentence and the cluster it belongs to.

[0028] In one embodiment, the similarity search based on the aggregated vectors includes:

[0029] Based on the index of similarity retrieval, the similarity between each aggregated vector and all vectors in the rule base and the historical case base is calculated, and the results are stored in a list, wherein the index of similarity retrieval is COSINE similarity;

[0030] Sort the list by similarity value and output the top two case results with the highest similarity;

[0031] In response to the top two case results with the highest similarity being below a threshold, the most relevant case is derived based on the hierarchical graph identifier of the matched rule record.

[0032] In one embodiment, based on the retrieved historical cases, calling the LLM model to infer and sort the fault causes and updating the case library includes:

[0033] Extract relevant information from historical cases obtained from similarity retrieval and process it into structured text data;

[0034] Call the LLM model to process the structured text data into multiple possible fault causes, assign a confidence score to each cause, and generate a fault cause score list;

[0035] Prioritize failure causes based on confidence scores;

[0036] The historical case library is updated based on the inference results, new fault information is recorded, and the updated case information is pushed to the technician for confirmation.

[0037] In one embodiment, the updating of the historical case library according to the inference result, recording the new fault information, and pushing the updated case information to the technician for confirmation includes:

[0038] Record detailed information of the current fault as a new case and assign a high confidence mark, wherein the detailed information of the current fault includes the inferred cause, treatment measures and treatment results;

[0039] Assign low confidence marks to other inferred reasons that are not selected and record them in the case library;

[0040] The updated case information is pushed to the technical staff for confirmation, and the updated case includes a new case identification number, a fault description, and an inference basis.

[0041] The present invention also provides an industrial network self-health management device, comprising:

[0042] The conversion module is used to convert fault judgment rules and historical cases into short text forms suitable for Embedding processing;

[0043] The output module is used to perform standardization processing and threshold matching on the network monitoring data collected in real time, and output a set of short sentences describing the network status;

[0044] Clustering module, used to perform embedding processing and adaptive clustering on standardized state description sentences;

[0045] A retrieval module, used for similarity retrieval based on the aggregated vectors;

[0046] The update module is used to call the LLM model to speculate and sort the fault causes based on the retrieved historical cases, and update the case library.

[0047] The present invention also provides an electronic device, comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the industrial network self-health management method as described in any one of the above is implemented.

[0048] The above-mentioned industrial network self-health management method, device and electronic equipment, on the one hand, use the rule library to perform supplementary retrieval, and use the LLM model to quickly construct historical cases, so that the system can ensure a high fault location accuracy in the early stage of deployment, thereby improving the level of self-health management. On the other hand, by establishing dynamic fault judgment rules and historical case libraries, it can flexibly adapt to network changes and achieve accurate fault location. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] In order to more clearly illustrate the technical solutions in the present invention or the prior art, a brief introduction is given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0050] Figure 1 A schematic diagram of a process flow of an industrial network self-health management method in one embodiment;

[0051] Figure 2 It is a schematic diagram of the Embedding processing flow in one embodiment;

[0052] Figure 3 A schematic diagram of a normalization process and a threshold matching process in one embodiment;

[0053] Figure 4 A schematic diagram of a process for identifying an indicator exceeding a threshold value in one embodiment;

[0054] Figure 5 is a schematic diagram of a clustering process in an embodiment;

[0055] Figure 6 is a schematic diagram of a similarity retrieval process in an embodiment;

[0056] Figure 7 A schematic diagram of a flow chart of inferring and sorting fault causes in an embodiment;

[0057] Figure 8 A schematic diagram of a case update process in an embodiment;

[0058] Fig. 9 Schematic diagram of the structure of an industrial network self-health management device in one embodiment;

[0059] Fig.10 The figure is a diagram showing the internal structure of an electronic device according to an embodiment. DETAILED DESCRIPTION

[0060] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0061] Due to the particularity of industrial networks, any failure or interruption may cause economic losses or even casualties. With the development of industrial Internet technology, the scale of industrial networks continues to expand, and network management becomes increasingly difficult.

[0062] In the existing technology, there are methods for anomaly detection using traditional AI technologies such as Bayesian networks, machine learning, and deep learning. However, due to the non-uniform standards of various industrial networks, similar and diverse problems, and an extreme lack of negative samples, the accuracy of machine learning-based technologies is greatly limited.

[0063] On the other hand, with the rapid development of wireless technologies such as industrial 5G, wireless networks have gradually been connected to traditional industrial fixed networks. This has further exacerbated the complexity and variability of industrial networks. Health assessment models and fault location models trained based on traditional machine learning methods are often unable to adapt to new network changes, resulting in normal network changes being easily identified as faults, which greatly increases the false alarm rate and ultimately makes the self-health strategy ineffective.

[0064] CN117041115A discloses an industrial Internet fault self-checking method, including the following steps: S1, collecting all operating data signals on the industrial equipment link; S2, screening out the operating data signals that may cause equipment failure; S3, judging whether the operating data signal is within the preset normal operating range, if it is within the preset normal operating range, entering step S4, if not, it is judged as an equipment failure; S4, further judging whether the collected operating data signal and the historically collected operating data signal have changed, if there is a change, entering step S5, if there is no change, then the entire self-checking process is terminated; S5, using the exponential smoothing method to predict the future data value of the operating data signal; S6, calculating the time when the operating data signal exceeds the preset fault data value. The industrial Internet fault self-checking method monitors the normal range values ​​of all operating data signals on the industrial equipment link, and also realizes the prediction of the data value of the operating data signal with a changing trend. However, the above-mentioned industrial Internet fault self-checking method is based on a variable threshold for judgment, and cannot effectively realize fault location.

[0065] On the other hand, with the rapid development of LLM (Large Language Model) technology, there are related applications based on large language models. CN118312896A discloses a fault diagnosis expert system based on a large language model and an implementation method, including: module M1: converting the fault diagnosis of the equipment into a rule base containing multiple fault diagnosis rules; module M2: extracting features from the fault diagnosis rules using a large language model; module M3: collecting the operation data of the equipment using a sensor, and calculating the corresponding extracted feature values ​​based on the collected operation data; module M4: performing fault diagnosis on the equipment based on the fault diagnosis rules based on the corresponding extracted feature values ​​calculated. The fault diagnosis expert system based on a large language model and the implementation method can dynamically modify the rule parameters in the large language model input by describing the fault features and the fault diagnosis rules in natural language, and there is no hard editing problem of the traditional method. However, the above method only solves the problem of dynamically modifying the rule parameters by describing the fault features and the judgment rules in natural language. It cannot solve the problem of network variability, which requires synchronous changes in judgment rules, and it cannot solve the problem of accurately locating faults. It lacks flexibility and adaptability and cannot cope with the self-health management challenges brought about by the development of current complex industrial networks.

[0066] Therefore, the following combination Figure 1-Figure 10 The present invention describes the industrial network self-health management method, device and electronic equipment.

[0067] like Figure 1 As shown, in one embodiment, a method for self-health management of an industrial network includes the following steps:

[0068] Step S100, converting the fault judgment rules and historical cases into a short text form suitable for Embedding processing to facilitate subsequent machine learning and natural language processing operations.

[0069] By establishing initial fault determination rules and historical case libraries, a basis is provided for subsequent network monitoring and fault location.

[0070] Step S200, standardize and threshold match the network monitoring data collected in real time, and output a set of short sentences describing the network status for subsequent analysis and fault location.

[0071] Standardized processing of network monitoring data will provide accurate basic information for subsequent state semantic space aggregation and fault location.

[0072] Step S300, performing embedding processing and adaptive clustering on the standardized state description short sentences to improve the accuracy of subsequent analysis.

[0073] Embedding and adaptive clustering of short state description sentences will provide more accurate and meaningful information for subsequent network state semantic approximate retrieval and fault location.

[0074] Step S400: perform similarity retrieval based on the aggregated vectors to search for cases similar to the current network state from the rule library and the historical case library.

[0075] Similarity retrieval based on the aggregated vectors will effectively help identify historical cases that are similar to the current network status, providing an important basis for fault location and network management.

[0076] Step S500: Based on the retrieved historical cases, the LLM model is called to infer and sort the fault causes, and the case library is updated to ensure that it reflects the latest fault information.

[0077] Fault inference based on historical cases and case library updates will effectively improve the accuracy of fault location and the system's adaptability, providing important support for subsequent network management.

[0078] This industrial network self-health management method, on the one hand, uses a rule library for supplementary retrieval and uses the LLM model to quickly construct historical cases, so that the system can ensure a high fault location accuracy in the early stage of deployment, thereby improving the level of self-health management. On the other hand, by establishing dynamic fault judgment rules and historical case libraries, it can flexibly adapt to network changes and achieve accurate fault location.

[0079] In this embodiment, see Figure 2 , converting fault judgment rules and historical cases into short text forms suitable for Embedding processing, including:

[0080] Step S110, describing each fault determination rule and historical case in natural language to obtain a text description with a consistent format.

[0081] For example, a rule can be described as "When the network delay is greater than 100ms, issue an alarm", while a historical case can be described as "Case 101: In May 2023, the network delay reached 150ms, resulting in a slow system response".

[0082] Step S120, vectorize the text description based on the pre-trained Embedding model, and store the Embedding result of each text description in a vector list.

[0083] The Embedding model preferably uses the Sentence-Embedding model fine-tuned for network monitoring data. The Embedding model converts each text into a high-dimensional vector, usually 512 dimensions or higher. These vectors can capture the semantic information of the text, so that similar texts are close in the vector space.

[0084] Step S130, constructing a hierarchical graph based on a lightweight method to encode the relevant relationship, obtaining a hierarchical graph identifier, and saving the hierarchical graph identifier as a unique identifier of the record.

[0085] The identifier of each record should contain the identifiers of its related rules and cases in the format: caseid-ruleid1-ruleid2-...

[0086] For example, a record with identification number 101-1-2 indicates that case 101 is associated with rule 1 and rule 2.

[0087] Step S140, storing the processed rules and cases in the rule base and the historical case base respectively, and storing the corresponding rule base and historical case base in the vector database, each record including its corresponding text description, vector representation and its unique identifier.

[0088] For example, a record in the rule base can be: {"id": 1, "description": "Network delay is greater than 100ms, issue an alarm", "vector": [0.1, 0.2, ..., 0.5]}.

[0089] The following are some examples:

[0090] Assume the following rules and cases:

[0091] Rule 1: If the network delay is greater than 100ms, an alarm is issued.

[0092] Rule 2: If the packet loss rate exceeds 5%, an alarm is issued.

[0093] Case 101: In May 2023, the network latency reaches 150ms, resulting in slow system response.

[0094] After processing, the records of the rule base R and the historical case base H are as follows:

[0095] R: {"id": 1, "description": "Network delay is greater than 100ms, issue an alarm", "vector":[0.1, 0.2, ..., 0.5]}

[0096] H: {"id": 101, "description": "Case 101: In May 2023, the network delay reached 150ms, resulting in slow system response", "vector": [0.3, 0.4, ..., 0.6]}

[0097] Construct a hierarchical graph identifier: 101-1 indicates that case 101 is associated with rule 1.

[0098] The data is stored in a vector database, and the hierarchical graph identifier is saved as the ID number of the record.

[0099] By utilizing the pre-trained large language model (LLM) and performing graph-based vector processing on the fault expert library, the self-health assessment and fault location model can dynamically evaluate the entire network status, cope with complex environmental changes, and provide the entire reasoning process of fault location, making it easier for auxiliary technicians to quickly locate problems.

[0100] In this embodiment, see Figure 3 , standardizes and thresholds the network monitoring data collected in real time, and outputs a set of short sentences describing the network status, including:

[0101] Step S210, obtaining network monitoring data collected by network monitoring tools and devices, and performing standardization processing on the network monitoring data, the network monitoring data including delay, packet loss rate and bandwidth utilization.

[0102] Network monitoring data formats include numerical, text and log types. For numerical records, they need to be converted into standard text format for subsequent processing. For example, "delay = 150ms" is converted into "delay is 150 milliseconds" to facilitate subsequent LLM processing; for text logs, they are cleaned and refined to remove irrelevant redundant characters and noise information. For example, the "6%" in "packet loss rate is 6%" is extracted and standardized to "packet loss rate exceeds 5%."

[0103] Step S220, based on the standardized network monitoring data, identifying indicators exceeding the threshold, and generating corresponding network status description sentences.

[0104] Use the pre-trained language model (LLM) to perform threshold matching on the standardized text. First, define a set of threshold rules, such as: latency threshold: an alarm is issued when it is greater than 100ms, packet loss rate threshold: an alarm is issued when it exceeds 5%, and then input the standardized text into the LLM. The model will match according to the preset threshold rules, identify indicators that exceed the threshold, and generate corresponding status judgment sentences.

[0105] Step S230: store the short sentences describing the network status in a set, and output the short sentence set describing the network status.

[0106] Generates concise and clear status judgment sentences, each of which does not exceed 200 characters. Sample output may include:

[0107] "The delay exceeds the threshold. The current value is 150ms, and the excess ratio is 50%."

[0108] "The packet loss rate exceeds the threshold. The current value is 6%, which exceeds the ratio by 20%."

[0109] "Bandwidth utilization is normal and the current value is 70%."

[0110] These short sentences will be stored in a collection to facilitate subsequent analysis and fault location.

[0111] The following are some examples:

[0112] Assume that the following data is collected:

[0113] Latency: 150ms

[0114] Packet loss rate: 6%

[0115] Bandwidth utilization: 70%

[0116] After standardization and threshold matching, the output network status judgment sentence set may be:

[0117] "The delay exceeds the threshold. The current value is 150ms, and the excess ratio is 50%."

[0118] "The packet loss rate exceeds the threshold. The current value is 6%, which exceeds the ratio by 20%."

[0119] "Bandwidth utilization is normal and the current value is 70%."

[0120] By standardizing the network monitoring data, it is convenient to provide accurate basic information for subsequent state semantic space aggregation and fault location.

[0121] In this embodiment, see Figure 4 Based on the standardized network monitoring data, identify indicators that exceed the threshold, including:

[0122] Step S221, obtaining standardized network monitoring data.

[0123] Step S222, input the network monitoring data into the LLM model, and output the result of exceeding the threshold indicator. The LLM model is based on a deep neural network, and is trained with network monitoring data samples within the threshold range and network monitoring data samples outside the threshold range as training data.

[0124] In this embodiment, see Figure 5 , Embedding processing and adaptive clustering are performed on the standardized state description sentences, including:

[0125] Step S310, vectorize each state description sentence based on the pre-trained Embedding model and output a high-dimensional vector representation.

[0126] For industrial network status, due to the small number of characters in short sentences, in order to speed up processing, reduce computing load, and maintain semantic accuracy, a pre-trained Sentence-Embedding model with an output dimension of 512 and a model parameter not exceeding 2B (2 billion parameters) is preferred.

[0127] The specific steps include:

[0128] Each short sentence is input into the Embedding model, and the model outputs a high-dimensional vector representation (depending on the specific model, the dimension varies; preferably, a 512-dimensional lightweight Embedding model is output to improve data processing speed). The formula is:

[0129] ,

[0130] in, is the vector representation of a short sentence, and i is the i-th short sentence.

[0131] Step S320: convert all vector representations into a vector set.

[0132] In this way, all short sentences will be converted into a vector set , where n is the total number of short sentences.

[0133] Step S330: clustering the vector set based on an agglomerative hierarchical clustering algorithm.

[0134] The vector set is clustered using the Agglomerative Hierarchical Clustering algorithm, which builds a cluster tree by gradually merging similar samples and is suitable for processing an uncertain number of clusters.

[0135] The specific steps are as follows:

[0136] The distance between vectors is usually calculated using cosine similarity or Euclidean distance, where the formula for calculating cosine similarity is:

[0137] ,

[0138] in, Representation vector The norm or length of Representation vector The norm or length of , usually refers to the Euclidean norm (i.e. the modulus of the vector). In the cosine similarity formula, the denominator Dot product of two vectors by their lengths Normalize to ensure that the similarity value is between -1 and 1;

[0139] Then, according to the distance matrix, the vectors with the closest distance are gradually merged to form clusters.

[0140] The calculation formula is as follows:

[0141] ,

[0142] Among them, K is the cluster number threshold, N is the network scale, that is, the number of network nodes, I is the number of state indicators, and the merging is stopped when the number of clusters after merging is greater than the preset threshold K.

[0143] Step S340: Call the LLM model to extract the semantic summary of each cluster.

[0144] The specific steps are as follows:

[0145] Summarize the short sentences in each cluster to generate a concise semantic description. For example, the short sentences in the cluster may include "delay exceeds the threshold, the current value is 150ms" and "delay is abnormal, the current value is 160ms", then its semantic summary can be "delay is abnormal, the current value is between 150ms and 160ms".

[0146] The semantic summary of each cluster is recorded as , and embed it, recorded as , the formula is:

[0147] ,

[0148] in, is the semantic summary of the nth cluster.

[0149] Step S350: Use position coding to record the relationship between each short sentence and its corresponding cluster.

[0150] The specific identifier (ID) format is: state ID - type ID - sequence number. For example, if the state ID is 1, the type ID is 2, and the cluster sequence number is 3, the record is "1-2-3".

[0151] The following are some examples:

[0152] Assume that after Embedding processing, the obtained state description short sentence vector set is: ,

[0153] After adaptive clustering, it is assumed that two clusters are formed:

[0154] Cluster 1: contains the short sentences "The delay exceeds the threshold, the current value is 150ms" and "The delay is abnormal, the current value is 160ms".

[0155] Cluster 2: contains the short sentence "The packet loss rate exceeds the threshold, and the current value is 6%."

[0156] For cluster 1, the generated semantic summary is "abnormal delay, the current value is between 150ms and 160ms", and embedding is performed to obtain a vector .

[0157] Embedding and adaptive clustering of short state description sentences will provide more accurate and meaningful information for subsequent network state semantic approximate retrieval and fault location.

[0158] In this embodiment, participating Figure 6 , similarity retrieval based on the aggregated vector, including:

[0159] Step S410, based on the similarity search index, calculate the similarity between each aggregated vector and all vectors in the rule base and the historical case base, and store the result in a list. The similarity search index is COSINE similarity.

[0160] The specific steps are as follows:

[0161] Initialize an empty list to store similar cases and their similarity values.

[0162] For each vector , calculate its The similarity value is calculated and the result is stored in a list in the format of ("Case ID", "Similarity Value").

[0163] Step S420, sorting the list according to the similarity value, and outputting the first two case results with the highest similarity.

[0164] Sort the list according to the similarity value and select the top K cases with the highest similarity as the final result, where K is preferably set to 2.

[0165] Step S430, in response to the first two case results with the highest similarity being both below a threshold, deriving the most relevant case based on the hierarchical graph identifier of the matched rule record.

[0166] If the similarities of the TopK cases are all lower than the threshold S (set according to the actual network scale and case library scale, the preferred default value is 0.6), it means that no relevant historical cases are matched. At this time, the most relevant case is derived through the hierarchical graph ID of the matched rule record.

[0167] For example, if there is no case record higher than the threshold S in the similarity search results, but a rule record higher than the threshold S can be matched, and its hierarchical graph ID is 101-10, then case 10 is used as the matching historical case.

[0168] The following are some examples:

[0169] Assume that the current aggregation vector is , the vector sets in the rule base and historical case base are ;

[0170] Calculate similarity:

[0171] for , the calculated similarity value is 0.75.

[0172] for , the calculated similarity value is 0.85.

[0173] for , the calculated similarity value is 0.65.

[0174] Sorting by similarity value, we get a list of similar cases:

[0175] Case ID: 2, Similarity: 0.85

[0176] Case ID: 1, Similarity: 0.75

[0177] Case ID: 3, Similarity: 0.65

[0178] Finally, the first two cases with the highest similarity (case IDs 2 and 1) were selected for subsequent analysis.

[0179] Similarity retrieval based on the aggregated vectors will effectively help identify historical cases that are similar to the current network status, providing an important basis for fault location and network management.

[0180] In this embodiment, see Figure 7 Based on the retrieved historical cases, the LLM model is called to infer and sort the fault causes, and the case library is updated, including:

[0181] Step S510, extract relevant information from the historical cases obtained from the similarity search and process it into structured text data so as to be input into the LLM for analysis.

[0182] Step S520, calling the LLM model to process the structured text data into multiple possible fault causes, assigning a confidence score to each cause, and generating a fault cause score list.

[0183] The specific steps are as follows:

[0184] The description of the historical case and the characteristics of the current network status are used as input to form a complete context. Input format reference: "Based on the historical case with case ID X, the fault description is 'network delay is too high', and the current status is 'average delay 100ms'. Please speculate on the possible cause of the fault and give the analysis reasons. Finally, give the confidence of this inference, with the score ranging from low (1) to high (5)."

[0185] LLM will generate multiple possible failure causes based on the input context and assign a confidence score to each cause, ranging from low (1) to high (5), indicating the reliability of the speculation.

[0186] Step S530 , prioritizing the fault causes based on the confidence scores to ensure that the most likely causes are ranked first.

[0187] For example, suppose LLM infers the following fault causes and their confidence levels:

[0188] Reason A: Network equipment failure, confidence level 4

[0189] Reason B: Configuration error, confidence level 5

[0190] Reason C: External attack, confidence level 3

[0191] According to the confidence score, the sorted results are:

[0192] 1. Reason B: Configuration error, confidence level 5

[0193] 2. Reason A: Network equipment failure, confidence level 4

[0194] 3. Reason C: External attack, confidence level 3

[0195] Step S540, update the historical case library according to the inference result, record the new fault information, and push the updated case information to the technician for confirmation.

[0196] In this embodiment, see Figure 8 , update the historical case library based on the inference results, record the new fault information, and push the updated case information to the technicians for confirmation, including:

[0197] Step S541, the detailed information of the current fault is recorded as a new case and given a high confidence mark, the detailed information of the current fault including the inferred cause, treatment measures and treatment results.

[0198] Step S542: assign low confidence marks to other inferred reasons that are not selected and record them in the case library.

[0199] Step S543: Push the updated case information to the technician for confirmation. The updated case includes a new case identifier, fault description, and inference basis.

[0200] The updated case library will contain new case IDs, fault descriptions, inference basis and other information to ensure that the system can continuously learn and adapt to new failure modes.

[0201] The following are some examples:

[0202] Assume that during the fault speculation process, LLM speculates the following reasons:

[0203] Reason 1: Network equipment failure, confidence level 4

[0204] Reason 2: Configuration error, confidence level 5

[0205] Record this information into the case library to form a new case:

[0206] Case ID: 2023-001

[0207] Fault description: Network delay is too high

[0208] Reason for inference: Switch (ID: 23) is congested, similar to the historical case library (ID: 2022-035)

[0209] At the same time, the reasons for not being selected (such as external attacks) are also recorded as case ID: 2023-002, confidence: low.

[0210] Fault inference based on historical cases and case library updates will effectively improve the accuracy of fault location and the system's adaptability, providing important support for subsequent network management.

[0211] The industrial network self-health management device provided by the present invention is described below. The industrial network self-health management device described below and the industrial network self-health management method described above can be referenced to each other.

[0212] like Fig. 9 As shown, in one embodiment, an industrial network self-health management device includes a conversion module 910 , an output module 920 , a clustering module 930 , a retrieval module 940 and an update module 950 .

[0213] The conversion module 910 is used to convert the fault determination rules and historical cases into a short text form suitable for Embedding processing.

[0214] The output module 920 is used to perform standardization processing and threshold matching on the network monitoring data collected in real time, and output a set of short sentences describing the network status.

[0215] The clustering module 930 is used to perform embedding processing and adaptive clustering on the standardized state description short sentences.

[0216] The retrieval module 940 is used to perform similarity retrieval based on the aggregated vectors.

[0217] The updating module 950 is used to call the LLM model to infer and sort the fault causes based on the retrieved historical cases, and to update the case library.

[0218] In this embodiment, the conversion module 910 is specifically used for:

[0219] Describe each fault judgment rule and historical case in natural language to obtain a text description with consistent format;

[0220] Vectorize the text description based on the pre-trained Embedding model and store the Embedding result of each text description in a vector list;

[0221] Based on a lightweight method, a hierarchical graph is constructed to encode the relevant relationship, a hierarchical graph identifier is obtained, and the hierarchical graph identifier is saved as a unique identifier of the record;

[0222] The processed rules and cases are stored in the rule base and historical case base respectively, and the corresponding rule base and historical case base are stored in the vector database, each record containing its corresponding text description, vector representation and its unique identifier.

[0223] In this embodiment, the output module 920 is specifically used for:

[0224] Obtain network monitoring data collected by network monitoring tools and devices and perform standard processing on the network monitoring data, including latency, packet loss rate, and bandwidth utilization;

[0225] Based on the standardized network monitoring data, identify indicators that exceed the threshold and generate corresponding short sentences describing the network status;

[0226] The network status description short sentences are stored in a set, and the network status description short sentence set is output.

[0227] It should be noted that based on the standardized network monitoring data, indicators exceeding the threshold are identified, which are specifically used for:

[0228] Obtain standardized network monitoring data;

[0229] The network monitoring data is input into the LLM model, and the results of exceeding the threshold indicators are output. The LLM model is based on a deep neural network, which is trained with network monitoring data samples within the threshold range and network monitoring data samples within the non-threshold range as training data.

[0230] In this embodiment, the clustering module 930 is specifically used for:

[0231] Each state description sentence is vectorized based on the pre-trained Embedding model, and a high-dimensional vector representation is output;

[0232] Convert all vector representations into a vector set;

[0233] Clustering vector sets based on agglomerative hierarchical clustering algorithm;

[0234] Call the LLM model to extract the semantic summary of each cluster;

[0235] Use position encoding to record the relationship between each short sentence and the cluster it belongs to.

[0236] In this embodiment, the search module 940 is specifically used for:

[0237] Based on the similarity retrieval index, the similarity between each aggregated vector and all vectors in the rule base and historical case base is calculated, and the results are stored in a list. The similarity retrieval index is COSINE similarity;

[0238] Sort the list by similarity value and output the top two case results with the highest similarity;

[0239] In response to the top two case results with the highest similarity being below a threshold, the most relevant case is derived based on the hierarchical graph identifier of the matched rule record.

[0240] In this embodiment, the updating module 950 is specifically used for:

[0241] Extract relevant information from historical cases obtained from similarity retrieval and process it into structured text data;

[0242] Call the LLM model to process the structured text data into multiple possible fault causes, assign a confidence score to each cause, and generate a fault cause score list;

[0243] Prioritize failure causes based on confidence scores;

[0244] The historical case library is updated based on the inference results, new fault information is recorded, and the updated case information is pushed to the technician for confirmation.

[0245] It should be noted that the historical case library is updated according to the inference results, new fault information is recorded, and the updated case information is pushed to the technicians for confirmation, which is specifically used for:

[0246] Record the detailed information of the current fault as a new case and assign a high confidence mark. The detailed information of the current fault includes the inferred cause, treatment measures, and treatment results.

[0247] Assign low confidence marks to other inferred reasons that are not selected and record them in the case library;

[0248] The updated case information is pushed to the technical staff for confirmation. The updated case includes the new case identification number, fault description and inference basis.

[0249] The industrial network self-health management device, on the one hand, uses the rule library for supplementary retrieval and uses the LLM model to quickly construct historical cases, so that the system can ensure a high fault location accuracy in the early stage of deployment, thereby improving the level of self-health management. On the other hand, by establishing dynamic fault judgment rules and historical case libraries, it can flexibly adapt to network changes and achieve accurate fault location.

[0250] Fig.10 An example of a physical structure diagram of an electronic device is shown. The electronic device may be a smart terminal, and its internal structure diagram may be as follows: Fig.10 As shown. The electronic device includes a processor, a memory and a network interface connected via a system bus. Among them, the processor of the electronic device is used to provide computing and control capabilities. The memory of the electronic device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the electronic device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, an industrial network self-health management method is implemented, and the method includes:

[0251] Convert fault judgment rules and historical cases into short text suitable for Embedding processing;

[0252] Perform standardization and threshold matching on the network monitoring data collected in real time, and output a set of short sentences describing the network status;

[0253] Perform embedding processing and adaptive clustering on the standardized state description sentences;

[0254] Perform similarity retrieval based on the aggregated vectors;

[0255] Based on the retrieved historical cases, the LLM model is called to infer and sort the fault causes, and the case library is updated.

[0256] Those skilled in the art will understand that Fig.10 The structure shown in the figure is only a block diagram of a part of the structure related to the scheme of the present invention, and does not constitute a limitation on the electronic device to which the scheme of the present invention is applied. The specific electronic device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0257] On the other hand, the present invention also provides a computer storage medium storing a computer program, which implements an industrial network self-health management method when the computer program is executed by a processor, the method comprising:

[0258] Convert fault judgment rules and historical cases into short text suitable for Embedding processing;

[0259] Perform standardization and threshold matching on the network monitoring data collected in real time, and output a set of short sentences describing the network status;

[0260] Perform embedding processing and adaptive clustering on the standardized state description sentences;

[0261] Perform similarity retrieval based on the aggregated vectors;

[0262] Based on the retrieved historical cases, the LLM model is called to infer and sort the fault causes, and the case library is updated.

[0263] In another aspect, a computer program product or a computer program is provided, the computer program product or the computer program comprising computer instructions, the computer instructions being stored in a computer-readable storage medium. A processor of an electronic device reads the computer instructions from the computer-readable storage medium, and when the processor executes the computer instructions, an industrial network self-health management method is implemented, the method comprising:

[0264] Convert fault judgment rules and historical cases into short text suitable for Embedding processing;

[0265] Perform standardization and threshold matching on the network monitoring data collected in real time, and output a set of short sentences describing the network status;

[0266] Perform embedding processing and adaptive clustering on the standardized state description sentences;

[0267] Perform similarity retrieval based on the aggregated vectors;

[0268] Based on the retrieved historical cases, the LLM model is called to infer and sort the fault causes, and the case library is updated.

[0269] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing related hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided by the present invention may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory.

[0270] By way of illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0271] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0272] The above-described embodiments only express several implementation methods of the present invention, and the description thereof is relatively specific and detailed, but it cannot be understood as limiting the scope of the present invention. It should be pointed out that, for a person of ordinary skill in the art, several modifications and improvements can be made without departing from the concept of the present invention, and these all belong to the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the attached claims.

Claims

1. An industrial network self-health management method, characterized in that: The method comprises: Convert fault judgment rules and historical cases into short text suitable for Embedding processing; Perform standardization and threshold matching on the network monitoring data collected in real time, and output a set of short sentences describing the network status; Perform embedding processing and adaptive clustering on the standardized state description sentences; Perform similarity retrieval based on the aggregated vectors; Based on the retrieved historical cases, the LLM model is used to infer and sort the fault causes, and the case library is updated; The conversion of fault determination rules and historical cases into a short text form suitable for Embedding processing includes: Describe each fault judgment rule and historical case in natural language to obtain a text description with consistent format; Vectorize the text description based on the pre-trained Embedding model and store the Embedding result of each text description in a vector list; Based on a lightweight method, a hierarchical graph is constructed to encode the correlation between fault judgment rules and historical cases, and a hierarchical graph identifier is obtained. The hierarchical graph identifier is saved as a unique identifier recorded in the fault judgment rules and historical cases. The processed rules and cases are stored in a rule base and a historical case base respectively, and the corresponding rule base and historical case base are stored in a vector database, where each record in the vector database contains its corresponding text description, vector representation and unique identifier; The network monitoring data collected in real time is standardized and threshold matched, and a set of short sentences describing the network status is output, including: Obtaining network monitoring data collected by network monitoring tools and devices, and performing standardized processing on the network monitoring data, wherein the network monitoring data includes latency, packet loss rate, and bandwidth utilization; Based on the standardized network monitoring data, identify indicators that exceed the threshold and generate corresponding short sentences describing the network status; The short sentences describing the network status are stored in a set, and the set of short sentences describing the network status is outputted; The step of identifying indicators exceeding thresholds based on the standardized network monitoring data includes: Obtain standardized network monitoring data; The network monitoring data is input into an LLM model, and a result of exceeding a threshold indicator is outputted, wherein the LLM model is based on a deep neural network and is trained using network monitoring data samples within a threshold range and network monitoring data samples within a non-threshold range as training data; The embedding process and adaptive clustering of the standardized state description short sentences include: Each state description sentence is vectorized based on the pre-trained Embedding model, and a high-dimensional vector representation is output, where: Convert all vector representations into a vector set. All short sentences will be converted into a vector set v = {v1, v2, ..., v n }, where n is the total number of short sentences; Clustering of vector sets is performed based on the agglomerative hierarchical clustering algorithm. The specific steps are as follows: Calculate the distance between vectors using cosine similarity or Euclidean distance, where the formula for cosine similarity is: Among them, ‖v i ‖ represents the vector v i The norm or length of , ‖v j ‖ represents the vector v j The norm or length of the vector usually refers to the Euclidean norm (i.e., the modulus of the vector). In the cosine similarity formula, the denominator ‖v i ‖·‖v j ‖The dot product v of two vectors by the length of the vector i ·v j Normalize to ensure that the similarity value is between -1 and 1; Then, according to the distance matrix, the vectors with the closest distance are gradually merged to form clusters. The calculation formula is as follows: K = log(N·I), Among them, K is the cluster number threshold, N is the network scale, that is, the number of network nodes, and I is the number of state indicators. When the number of clusters after merging is greater than the preset threshold K, the merging is stopped; Call the LLM model to extract the semantic summary of each cluster. The specific steps are as follows: Summarize the short sentences in each cluster to generate a concise semantic description; The semantic summary of each cluster is recorded as C n , and embed it, recorded as CV n , the formula is: CV n =Embed(C n ), Among them, C n is the semantic summary of the nth cluster; Position coding is used to record the relationship between each short sentence and its cluster. The specific identifier (ID) format is: state ID-type ID-serial number. The similarity retrieval based on the aggregated vectors includes: Based on the index of similarity retrieval, the similarity between each aggregated vector and all vectors in the rule base and the historical case base is calculated, and the results are stored in a list, wherein the index of similarity retrieval is COSINE similarity; Sort the list by similarity value and output the top two case results with the highest similarity; In response to the top two case results with the highest similarity being below a threshold, the most relevant case is derived based on the hierarchical graph identifier of the matched rule record; Based on the retrieved historical cases, the LLM model is called to infer and sort the fault causes, and the case library is updated, including: Extract relevant information from historical cases obtained from similarity retrieval and process it into structured text data; Call the LLM model to process the structured text data into multiple possible fault causes, assign a confidence score to each cause, and generate a fault cause score list; Prioritize failure causes based on confidence scores; The historical case library is updated based on the inference results, new fault information is recorded, and the updated case information is pushed to the technician for confirmation.

2. The industrial network self-health management method according to claim 1, characterized in that: The historical case library is updated according to the inference results, new fault information is recorded, and the updated case information is pushed to the technician for confirmation, including: Record detailed information of the current fault as a new case and assign a high confidence mark, wherein the detailed information of the current fault includes the inferred cause, treatment measures and treatment results; Assign low confidence marks to other inferred reasons that are not selected and record them in the case library; The updated case information is pushed to the technical staff for confirmation, and the updated case information includes a new case identification symbol, a fault description, and an inference basis.

3. An industrial network self-health management device, characterized in that: include: The conversion module is used to convert fault judgment rules and historical cases into short text forms suitable for Embedding processing; The output module is used to perform standardization processing and threshold matching on the network monitoring data collected in real time, and output a set of short sentences describing the network status; Clustering module, used to perform embedding processing and adaptive clustering on standardized state description sentences; A retrieval module, used for similarity retrieval based on the aggregated vectors; The update module is used to call the LLM model to infer and sort the fault causes based on the retrieved historical cases, and update the case library; The conversion of fault determination rules and historical cases into a short text form suitable for Embedding processing includes: Describe each fault judgment rule and historical case in natural language to obtain a text description with consistent format; Vectorize the text description based on the pre-trained Embedding model and store the Embedding result of each text description in a vector list; Based on a lightweight method, a hierarchical graph is constructed to encode the correlation between fault judgment rules and historical cases, and a hierarchical graph identifier is obtained. The hierarchical graph identifier is saved as a unique identifier recorded in the fault judgment rules and historical cases. The processed rules and cases are stored in a rule base and a historical case base respectively, and the corresponding rule base and historical case base are stored in a vector database, where each record in the vector database contains its corresponding text description, vector representation and its unique identifier; The network monitoring data collected in real time is standardized and threshold matched, and a set of short sentences describing the network status is output, including: Obtaining network monitoring data collected by network monitoring tools and devices, and performing standardized processing on the network monitoring data, wherein the network monitoring data includes delay, packet loss rate, and bandwidth utilization; Based on the standardized network monitoring data, identify indicators that exceed the threshold and generate corresponding short sentences describing the network status; The short sentences describing the network status are stored in a set, and the set of short sentences describing the network status is outputted; The step of identifying indicators exceeding thresholds based on the standardized network monitoring data includes: Obtain standardized network monitoring data; The network monitoring data is input into an LLM model, and a result of exceeding a threshold indicator is outputted, wherein the LLM model is based on a deep neural network and is trained using network monitoring data samples within a threshold range and network monitoring data samples within a non-threshold range as training data; The embedding process and adaptive clustering of the standardized state description short sentences include: Based on the pre-trained Embedding model, each state description sentence is vectorized and output as a high-dimensional vector representation, where: Convert all vector representations into a vector set. All short sentences will be converted into a vector set v = {v1, v2, ..., v n }, where n is the total number of short sentences; Clustering of vector sets is performed based on the agglomerative hierarchical clustering algorithm. The specific steps are as follows: Calculate the distance between vectors using cosine similarity or Euclidean distance, where the formula for cosine similarity is: Among them, ‖v i ‖ represents the vector v i The norm or length of , ‖v j ‖ represents the vector v j The norm or length of the vector usually refers to the Euclidean norm (i.e., the modulus of the vector). In the cosine similarity formula, the denominator ‖v i ‖·‖v j ‖The dot product v of two vectors by the length of the vector i ·v j Normalize to ensure that the similarity value is between -1 and 1; Then, according to the distance matrix, the vectors with the closest distance are gradually merged to form clusters. The calculation formula is as follows: K = log(N·I), Among them, K is the cluster number threshold, N is the network scale, that is, the number of network nodes, and I is the number of state indicators. When the number of clusters after merging is greater than the preset threshold K, the merging is stopped; Call the LLM model to extract the semantic summary of each cluster. The specific steps are as follows: Summarize the short sentences in each cluster to generate a concise semantic description; The semantic summary of each cluster is recorded as C n , and embed it, recorded as CV n , the formula is: CV n =Embed(C n ), Among them, C n is the semantic summary of the nth cluster; Position coding is used to record the relationship between each short sentence and its cluster. The specific identifier (ID) format is: state ID-type ID-serial number. The similarity retrieval based on the aggregated vectors includes: Based on the index of similarity retrieval, the similarity between each aggregated vector and all vectors in the rule base and the historical case base is calculated, and the results are stored in a list, wherein the index of similarity retrieval is COSINE similarity; Sort the list by similarity value and output the top two case results with the highest similarity; In response to the top two case results with the highest similarity being below a threshold, the most relevant case is derived based on the hierarchical graph identifier of the matched rule record; Based on the retrieved historical cases, the LLM model is called to infer and sort the fault causes, and the case library is updated, including: Extract relevant information from historical cases obtained from similarity retrieval and process it into structured text data; Call the LLM model to process the structured text data into multiple possible fault causes, assign a confidence score to each cause, and generate a fault cause score list; Prioritize failure causes based on confidence scores; The historical case library is updated based on the inference results, new fault information is recorded, and the updated case information is pushed to the technician for confirmation.

4. An electronic device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 2 are implemented.

Images