Business system alarm method based on large model and related device

Abstract

The invention provides a large model-based service system alarm method and a related device, relates to the technical field of computers, in particular to the fields of artificial intelligence, large models, alarm systems and the like, and can be applied to application scenes such as intelligent assistants, virtual assistants, intelligent e-commerce and the like. The specific implementation scheme is as follows: acquiring system information of a target service system; processing system information based on the large model to obtain alarm decision information output by the large model; and under the condition that the alarm decision information indicates that alarm is needed, executing alarm operation. According to the embodiment of the invention, the system information of the business system is processed through the large model, and the corresponding alarm decision information is obtained, so that the system can execute the alarm strategy based on the obtained alarm decision information, thereby reducing the threshold for a user to use the alarm system, reducing the access time, and improving the access efficiency.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to the fields of artificial intelligence, large models, and alarm systems, and can be used in application scenarios such as smart assistants, virtual assistants, and smart e-commerce. Background Art

[0002] With the development of computer technology, many offline businesses can be transformed into online businesses, and even partially transformed into online businesses. Business systems provide different services for different scenarios. As the number of business system users increases, the content that needs to be processed becomes more complex, and some problems may occur during the operation of the business system.

[0003] The alarm system plays a vital role in the business system. It can effectively monitor the operating status of the business system and issue alarms in time when problems occur so that relevant personnel can respond and handle them quickly, thereby ensuring the stability and reliability of the business system. Summary of the invention

[0004] The present invention provides a business system alarm method based on a large model and related devices.

[0005] According to one aspect of the present disclosure, a business system alarm method based on a large model is provided, comprising:

[0006] Obtain system information of the target business system;

[0007] Processing system information based on the big model to obtain alarm decision information output by the big model;

[0008] When the alarm decision information indicates that an alarm is required, an alarm operation is performed.

[0009] According to another aspect of the present disclosure, a large model-based business system alarm device is provided, comprising:

[0010] An acquisition module is used to obtain system information of the target business system;

[0011] The output module is used to process system information based on the big model and obtain the alarm decision information output by the big model;

[0012] The execution module is used to execute the alarm operation when the alarm decision information indicates that an alarm is needed.

[0013] According to another aspect of the present disclosure, there is provided an electronic device, comprising:

[0014] at least one processor; and

[0015] a memory communicatively connected to the at least one processor; wherein,

[0016] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute any method in the embodiments of the present disclosure.

[0017] According to another aspect of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable the computer to execute any method according to the embodiments of the present disclosure.

[0018] According to another aspect of the present disclosure, a computer program product is provided, including a computer program, which implements any method according to the embodiments of the present disclosure when executed by a processor.

[0019] In the disclosed embodiment, the system information of the business system is processed through a large model to obtain corresponding alarm decision information, so that the system can execute the alarm strategy based on the obtained alarm decision information, thereby lowering the threshold for users to use the alarm system, reducing access time and improving access efficiency.

[0020] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The accompanying drawings are used to better understand the present solution and do not constitute a limitation of the present disclosure.

[0022] Figure 1 is a flowchart of a business system alarm method based on a large model according to an embodiment of the present disclosure;

[0023] Figure 2 It is a schematic diagram of a process of obtaining alarm decision information output by a large model according to an embodiment of the present disclosure;

[0024] Figure 3 is a schematic diagram of a process of training a large model according to an embodiment of the present disclosure;

[0025] Figure 4 is a flowchart of executing an alarm operation according to an embodiment of the present disclosure;

[0026] Figure 5 is a flow chart of checking whether an alarm strategy is hallucinating according to an embodiment of the present disclosure;

[0027] Figure 6 It is a schematic diagram of the overall process of a business system alarm method based on a large model according to an embodiment of the present disclosure;

[0028] Figure 7is a structural diagram of a large model-based business system alarm device according to an embodiment of the present disclosure;

[0029] Figure 8 It is a block diagram of an electronic device used to implement the big model-based business system alarm method of the embodiment of the present disclosure. DETAILED DESCRIPTION

[0030] The following is a description of exemplary embodiments of the present disclosure in conjunction with the accompanying drawings, including various details of the embodiments of the present disclosure to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope of the present disclosure. Similarly, for the sake of clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0031] In the daily operation of the business system, how to alarm is based on the configuration of rules. This requires users to be very familiar with the configuration system in order to better use the system to alarm, which is too complicated for users.

[0032] In view of this, the embodiment of the present disclosure provides a business system alarm method based on a large model. The method processes the system information of the business system through a large model to obtain corresponding alarm decision information, so that the system can execute the alarm strategy based on the obtained alarm decision information, thereby lowering the threshold for users to use the alarm system, reducing access time, and improving access efficiency.

[0033] In computer science, large models usually refer to models with a large number of parameters or complex structures. These models can be used for various tasks such as text classification, question answering, dialogue, etc.

[0034] The large model used in the disclosed embodiment may be a GPT (Generative Pre-trained Transforme, a generative pre-trained transformer model) large model, which is a large language model with powerful language understanding and generation capabilities. By performing unsupervised learning on a large amount of text, it can handle a variety of natural language tasks, such as text generation, knowledge question and answer, language understanding, etc. It can generate coherent and logical responses based on the input text, and can continuously learn and improve its performance.

[0035] like Figure 1 FIG. 1 is a flow chart of a business system alarm method based on a large model proposed in an embodiment of the present disclosure, including:

[0036] S101, obtaining system information of a target business system.

[0037] The target business system is the business system that needs to be alarmed. The target business system is a system composed of a series of interrelated business processes and operations. These processes run through the daily operations of the target business system and support the core business activities of the target business system. The system information of the target business system may include but is not limited to key indicators such as system operation status, resource utilization, error logs, and performance data. These data provide real-time status of the system health and provide basic data for subsequent large model analysis.

[0038] S102, processing system information based on the big model to obtain alarm decision information output by the big model.

[0039] The collected system information is input into a trained large model for processing. The large model analyzes and interprets the input system information and generates alarm decision information. This decision information may include descriptions of identified potential problems, severity assessments, possible causes, and solution recommendations.

[0040] S103: When the alarm decision information indicates that an alarm is required, an alarm operation is performed.

[0041] When the alarm decision information output by the large model indicates that there are problems or abnormal situations in the system that need attention, an alarm operation will be triggered. For example, an alarm notification is sent to the system administrator or relevant personnel, providing a detailed description of the problem and solution suggestions so that the relevant personnel can take timely measures to solve the problem and prevent system failure or performance degradation.

[0042] In the disclosed embodiment, the business system alarm method based on the big model obtains the system information of the target business system and processes the information using the big model to obtain alarm decision information. Compared with the traditional alarm system, this method can make full use of the powerful data processing and analysis capabilities of the big model, identify and respond to abnormal conditions of the system more quickly, reduce false alarms and missed alarms, and thus improve the stability and reliability of the business system. The alarm system based on the big model can also adapt to a variety of different business scenarios and has better flexibility and scalability. The alarm decision information of the big model can only be executed after further analysis and sorting, so as to realize the mutual cooperation of the big model and the program, which can improve the accuracy of the alarm.

[0043] In the embodiment of the present disclosure, the system information is processed based on the large model to obtain the alarm decision information output by the large model, such as Figure 2 As shown, including the following:

[0044] S201, obtaining alarm configuration information.

[0045] Alarm configuration information is a series of user-defined parameters and rules used to define alarm information, that is, users can customize the characteristics of information that needs to trigger alarm operations. These alarm information usually include but are not limited to:

[0046] Alarm level: refers to the severity of the alarm message, such as INFO, FATAL, WARNING, TRACE, etc. Each level represents a different severity, for example, INFO usually means general information notification, FATAL means the system has encountered a serious problem that may need to be handled immediately.

[0047] Alarm information source: refers to the source of alarm information generation. These sources can be different monitoring systems or platforms, such as alamonit (a process monitoring) monitoring, noah (a monitoring) monitoring, intelligent monitoring, etc., which are responsible for real-time monitoring of various indicators and status of business systems and generate alarms when abnormalities are detected.

[0048] Alarm interval: refers to the time interval at which the system issues an alarm when a problem is continuously detected, for example, 3 minutes, 5 minutes, etc. Setting the alarm interval helps prevent alarm information from being sent too frequently, thereby reducing interference to system administrators.

[0049] Alarm service: refers to the service responsible for processing and sending alarms, such as vs-rank, vs-bs, vs-attr, etc. These services may target different system components or functions. For example, vs-rank may be responsible for ranking-related service alarms, vs-bs may be responsible for backend service alarms, and vs-attr may be responsible for attribute or feature-related alarms.

[0050] During implementation, the user may construct the alarm configuration information by filling in an html (HyperText Markup Language) form based on the above alarm information.

[0051] In addition, since there is a large amount of business information in the business system, different business personnel may only pay attention to specific parts of it. Similarly, different business systems have different business logics and functions, and the alarm information that needs to be paid attention to will also be different. In order to meet the different needs of different business personnel and the different business logics between different business systems, the embodiment of the present disclosure also includes determining the alarm configuration information based on the following steps:

[0052] Step A1, obtaining an example of the alarm information to be processed that is customized by the target object.

[0053] That is, specific examples of information to be alarmed customized by the target object are obtained, and these examples of information to be alarmed include but are not limited to the alarm information contained in the above configuration information. These examples of information to be alarmed usually represent abnormal situations that may occur in the actual operating environment or specific events that need attention.

[0054] Step A2: Generate alarm configuration information based on the example of the information to be alarmed.

[0055] In the disclosed embodiments, a series of algorithms and logics can be used to judge and process these examples of information to be alarmed, including pattern recognition, condition analysis, time period determination, etc., so as to generate accurate alarm configuration information. Once these alarm configuration information are generated, they can be applied to the monitoring system to monitor the system information in the target business system to ensure that the alarm is triggered when specific conditions are met, helping users to obtain important information or handle emergency situations in a timely manner.

[0056] In the disclosed embodiment, by obtaining examples of information to be alarmed customized by the target object and generating alarm configuration information based on these examples, the flexibility and accuracy of the alarm system can be improved. By allowing users to customize alarm conditions according to their specific needs and scenarios, the abnormal conditions that users really care about can be monitored more accurately to reduce false alarms and missed alarms.

[0057] S202: construct an alarm prompt word based on the alarm configuration information and system information.

[0058] The system will determine the basic information such as the alarm type, level, and information source based on the alarm configuration information, and then combine the specific data in the system information, such as the specific content of the current error log, to build a text that accurately describes the alarm situation as an alarm prompt word according to the preset format. For example, "Please complete the content of the template, starting with ! and ending with =, that is, replace XXXXX with appropriate content", "! Alarm information group: XXXXX, alarm decision: XXXXX =".

[0059] S203, input the alarm prompt words into the large model to obtain the alarm decision information output by the large model.

[0060] The system takes the constructed alarm prompt words as input and passes them to the big model for processing. The big model outputs the corresponding alarm decision information based on the input alarm prompt words, combined with its internal knowledge base and algorithm logic. This information may include specific processing steps for the alarm situation or suggestions for relevant personnel on how to further handle the alarm event.

[0061] In the disclosed embodiment, by obtaining alarm configuration information, constructing alarm prompt words based on this information and system information, and then inputting the alarm prompt words into a large model to obtain alarm decision information, rapid identification and processing of alarm information can be achieved, thereby improving the accuracy and efficiency of alarm information processing.

[0062] In addition, users can build alarm configuration information by filling out a form, which can provide users with a simple configuration method, allowing users to easily configure, lower the threshold for using the alarm system, and improve the user experience.

[0063] In order to make the big model have good ability to process system information in the target business system, in this embodiment, the big model can be trained based on the following method, such as Figure 3 As shown, including:

[0064] S301, obtaining historical information.

[0065] That is, obtaining historical data information. This data can come from the business system's previous records, logs, databases or any other data source containing historical information. This historical information will serve as the basic data for training the model.

[0066] S302, parsing historical information based on the information template to obtain a message sample to be learned.

[0067] Information templates refer to rules or structures used to match and extract specific patterns in historical information. By applying these templates, structured message samples to be learned can be extracted from historical information. During implementation, corresponding information templates can be designed according to different application scenarios of large models in different business systems. After obtaining historical information, the historical information is parsed and sorted according to the pre-designed information templates to obtain message samples to be learned for subsequent model training.

[0068] S303: training a large model based on the message samples to be learned and the decision criteria corresponding to the message samples to be learned.

[0069] The decision criteria corresponding to the message samples to be learned refer to the correct output of the samples or the expected model response, which are usually defined based on the tasks that the model is expected to predict or perform in the actual application scenario. During the training process, the large model is trained using the extracted message samples to be learned and their corresponding decision criteria, and its internal parameters are continuously adjusted to minimize the difference between the prediction results and the decision criteria. The above process is repeated until the convergence conditions are met, such as the difference between the prediction results and the decision criteria is small enough, or the number of iterations reaches the preset number, so as to obtain the large model that can be used for alarming.

[0070] In the disclosed embodiment, training the large model by generating the message samples to be learned and the decision criteria corresponding to the message samples to be learned through historical information helps to improve the accuracy and quality of the alarm decision information generated by the large model. In addition, with the help of different historical data, the model can learn more rules and patterns, which enables the model to better adapt and respond to new and unseen system information, so as to improve the performance and application scope of the model.

[0071] In the embodiment of the present disclosure, when the alarm decision information indicates that an alarm is required, Figure 4 As shown, the alarm operation can be performed based on the following steps:

[0072] S401, analyzing alarm decision information.

[0073] By parsing the alarm decision information output by the large model, it is easy to understand the output content of the large model. In the embodiment of the present disclosure, when implemented, the purpose of parsing is to find the target field in the alarm decision information.

[0074] The search target field refers to the specific information fragment or keyword that needs to be found in the alarm decision information. For example, the search decision information contains the "****_info" field, which represents the key information directly related to the specific alarm strategy or operation. By setting the target field, it is easy to quickly and accurately locate the key fields that need to be alarmed in the received alarm decision information, which improves the decision-making efficiency while ensuring the speed and accuracy of the response to the problem. Secondly, in complex systems, it can also quickly identify and process alarm information, which plays a vital role in maintaining system stability, ensuring service quality, and improving user experience.

[0075] S402: When the alarm decision information includes a target field, the target field is parsed to obtain a corresponding alarm strategy.

[0076] In the embodiment of the present disclosure, in order to cope with complex business, the target field is an m-bit binary string, where m is a positive integer greater than 1. In this binary string, different value intervals are assigned to different information or attributes. These intervals can be continuous or discrete, depending on the design of the business system. For example, the first n bits of the m-bit binary string are used as the business code, and the remaining (mn) bits are used as the policy service code. Among them, parsing the target field to obtain the corresponding alarm strategy is implemented based on the following steps:

[0077] Step B1, parse out the service identifier of the target service system from a first value interval of the binary bits of the target field; and parse out the policy identifier from a second value interval of the binary bits of the target field.

[0078] That is, referring to the design of the target field by the target business system, the business identifier of the target business system and the policy identifier associated with the business system are parsed from different value ranges of the target field.

[0079] Step B2: Match the alarm policy based on the service identifier and the policy identifier.

[0080] The parsed business identifier and policy identifier are compared and matched with the preset alarm policy to determine the alarm operation that should be performed.

[0081] In the disclosed embodiment, by identifying the identifiers corresponding to different value intervals in the target field, the system can efficiently process and identify different business systems and alarm strategies, ensuring that the alarm will be triggered only when specific conditions are met. False alarms and missed alarms are reduced, and the accuracy of the alarm system is improved. In addition, the design of the target field allows different business systems to have complex multiple businesses, and different businesses can configure alarm strategies separately. As a result, the large model can be adapted to different business scenarios, and plug-and-play can be achieved.

[0082] S403: Execute an alarm operation based on the alarm strategy.

[0083] Once the alarm strategy is determined, the system will perform the corresponding alarm actions. These actions may include sending notifications, such as email, SMS or in-app notifications, recording alarm events to the log system, automatically triggering repair operations, or in extreme cases, performing high-risk operations such as system shutdown or disconnection, etc., which can be determined according to actual needs during implementation.

[0084] In the disclosed embodiment, the alarm decision information is analyzed to check whether the alarm decision information contains a specific target field. If the target field is contained, the alarm operation is performed after parsing the target field. The whole process is an automated and systematic alarm decision and execution process, which helps to improve the reliability and stability of the system, ensure rapid response to potential risks, and reduce the losses caused to the system by false alarms.

[0085] In the disclosed embodiment, in order to avoid hallucinations in the large model as much as possible, the rationality of the decision results generated by the large model can be further evaluated to ensure that there is no fictitious information or errors, and the corresponding post-processing process can be executed after the decision results are confirmed. The verification result can be obtained by verifying the target field; if the verification result passes, the alarm operation is executed based on the alarm strategy.

[0086] The verification content includes at least one of the following:

[0087] (1) Field format: Checking the field format means checking whether the field meets the predetermined format requirements. For example, the length of the string will be compared first to see whether it is the preset m bits.

[0088] (2) Validity of alarm strategy: Verifying the validity of alarm strategy is mainly to ensure whether the alarm strategy is correct and whether it can achieve the expected alarm purpose. You can check whether the alarm strategy contained in this m-bit string has been registered, that is, whether there is a corresponding strategy function to call. This verification helps to ensure data consistency and smooth subsequent processing.

[0089] It can also include checking whether the logic of multiple alarm strategies is correct, whether the condition settings are reasonable, etc. If the alarm strategy is invalid, subsequent alarm operations cannot be performed.

[0090] (3) Whether the alarm strategy has hallucinations: Hallucinations refer to situations where the alarm strategy has false alarms or missed alarms. Verifying whether the alarm strategy has hallucinations can ensure the accuracy of the alarm strategy and reduce unnecessary losses or delays caused by false alarms or missed alarms.

[0091] After the above verification content is tested, if the verification result passes, that is, all the verification content meets the requirements, the system will perform an alarm operation according to the preset alarm strategy. This alarm operation may include sending a notification, such as an email, SMS or in-app notification, in response to the detected problem or abnormal situation.

[0092] If the verification result fails, the system will execute a specific error handling process according to the configuration. For example, it will send an alarm message to the corresponding communication application and explain the hallucination problem of this large model.

[0093] In the disclosed embodiments, by verifying the field format, it is possible to ensure that the input data meets the expected format requirements, which helps prevent subsequent processing problems caused by data format errors. Verifying the effectiveness of the alarm strategy can ensure that the set alarm rules are reasonable and can be correctly triggered under preset conditions. Whether the alarm strategy is hallucinating can ensure that the alarm system does not fall into an invalid state or generate misleading alarms due to unattainable conditions. In summary, by verifying the target field and performing the alarm operation according to the effective alarm strategy after the verification is successful, the accuracy of data processing, the stability of the system and the user's satisfaction can be improved.

[0094] In the disclosed embodiment, the alarm strategy is checked to see if an illusion occurs, such as Figure 5 As shown, including the following:

[0095] S501, segmenting the system information to obtain a segmentation result.

[0096] That is, the system information that needs to be processed in the large model is extracted, and the input system information is segmented using a dictionary to obtain the segmentation result.

[0097] S502: Determine the degree of match between the word segmentation result and the policy label in the alarm policy.

[0098] Compare the word segmentation results with the labels in the predefined alarm strategy to determine the degree of match between them. Policy labels can be specific keywords or phrases that are used to identify potential problems or information that deserves attention. For example, vs-rank log cleaning, application notifications, phone alarms, etc.

[0099] S503: If the matching degree is higher than the preset threshold, it is determined that the alarm strategy does not have an illusion. If the matching degree is less than or equal to the preset threshold, it is determined that the alarm strategy has an illusion.

[0100] When the matching degree between the word segmentation result and the strategy label exceeds the preset value, that is, there is a high correlation between the two, it is considered that the alarm strategy effectively identifies the target information and no hallucination occurs. On the contrary, when the matching degree is lower than or equal to a preset threshold, it indicates that the alarm strategy may have incorrectly identified the information, that is, hallucination occurs.

[0101] In the disclosed embodiment, the system information is segmented, and the matching degree between the segmentation result and the policy label in the alarm policy is determined, which can effectively distinguish the real alarm signal from the false alarm, avoid the alarm policy from hallucination, and thus reduce unnecessary alarms. The matching degree between the segmentation result and the policy label in the alarm policy is measured by a preset matching degree threshold to determine whether the alarm policy is hallucinated, which can improve the accuracy and reliability of the alarm system.

[0102] In the disclosed embodiment, the system information and the policy label have different semantics, so they need to be unified into the same space by matching to identify the illusion of the large model. During implementation, the matching degree between the word segmentation result and the policy label can be determined based on a logistic regression model; or the matching degree between the word segmentation result and the policy label can be determined based on a decision tree.

[0103] Logistic regression is a generalized linear model that estimates the probability of an event given a given set of independent variables. In implementation, the relationship between the word segmentation result (i.e., input) and the policy label (i.e., output) is modeled as a probability function to predict the label probability given a given feature. By calculating the probability of the predicted label, logistic regression can determine the match between the word segmentation result and the policy label.

[0104] The decision tree is an algorithm that makes decisions based on a tree structure. It describes the relationship between features and labels by building a tree model, where each node represents a feature, each branch represents the possible value of the feature, and the last leaf node represents the final label prediction. When implemented, the decision tree starts from the root node, makes branch judgments based on the feature value, and finally reaches the leaf node to obtain the label prediction and the matching degree between the word segmentation result and the strategy label.

[0105] During implementation, which method is selected depends on factors such as the requirements of the specific task, the characteristics of the data, and the complexity of the model, and the embodiments of the present disclosure are not limited to this.

[0106] In the disclosed embodiment, the matching degree between the word segmentation result and the policy label is determined based on a logistic regression model or a decision tree, which can clearly show the association rules between the word segmentation result and the policy label, and help understand the cause of the hallucination in the alarm policy, thereby improving the stability and reliability of the entire system. In addition, the logistic regression and decision tree models support rapid training and deployment, and can detect a large number of alarm policies in a short time, which can improve the accuracy and efficiency of hallucination detection.

[0107] In summary, the business system alarm method based on the big model provided in the embodiments of the present disclosure is as follows: Figure 6 As shown, the user can set the alarm information by filling in the alarm form and input it into the alarm prompt word generation system. The generation system generates the alarm configuration information according to the form filled in by the user. After the large model alarm system receives the alarm configuration information, it processes the system information of the target business system according to the alarm configuration information to obtain the alarm decision information output by the large model alarm system. For example, the system message can also be based on the generation system according to the example of the alarm information to be processed, and the key information that the large model needs to process from the system information is sorted out to generate a prompt word containing the key information and input it into the large model to obtain the alarm decision information. Among them, the alarm listening program will monitor the alarm decision information returned by the large model alarm system in real time. When the alarm decision information is monitored, the alarm listening program will verify whether the target field contained in the alarm decision information produces hallucinations. If the verification passes, the corresponding alarm operation will be performed.

[0108] In addition, the generation system can also mine message samples to be learned from historical information based on examples of information to be alarmed, so as to construct prompt words to be input to the large model for learning, so that the large model can learn how to make decision-making strategies.

[0109] Therefore, the business system alarm method based on the big model provided in the embodiment of the present disclosure only requires the user to fill out the corresponding alarm form and then submit it to the big model. The big model intelligently processes the alarm information and generates a corresponding alarm strategy, thereby lowering the threshold for users to use the alarm system, reducing access time and improving access efficiency.

[0110] Based on the same technical concept, the embodiment of the present disclosure also provides a business system alarm device 700 based on a large model, such as Figure 7 As shown, including:

[0111] The acquisition module 701 is used to acquire the system information of the target business system;

[0112] An output module 702, used to process the system information based on the large model to obtain alarm decision information output by the large model;

[0113] The execution module 703 is used to execute an alarm operation when the alarm decision information indicates that an alarm is required.

[0114] In some embodiments, the output module is specifically used to:

[0115] Get alarm configuration information;

[0116] Constructing an alarm prompt word based on the alarm configuration information and the system information;

[0117] The alarm prompt words are input into the large model to obtain the alarm decision information output by the large model.

[0118] In some embodiments, a generating module is further included for:

[0119] Get the target object's customized alarm information sample to be processed;

[0120] Generate alarm configuration information based on the example of the alarm information to be generated.

[0121] In some embodiments, a training module is further included for training a large model:

[0122] Get historical information;

[0123] Analyze historical information based on information templates to obtain message samples to be learned;

[0124] The large model is trained based on the message samples to be learned and the decision criteria corresponding to the message samples to be learned.

[0125] In some embodiments, the execution module includes:

[0126] A first parsing unit, used for parsing alarm decision information;

[0127] The second parsing unit is used to parse the target field to obtain the corresponding alarm strategy when the alarm decision information contains the target field;

[0128] The execution unit is used to execute the alarm operation based on the alarm strategy.

[0129] In some embodiments, the target field is an m-bit binary string, where m is a positive integer greater than 1, wherein the second parsing unit is specifically configured to:

[0130] Parsing the service identifier of the target service system from the first value interval of the binary bit of the target field; and

[0131] Parsing the policy identifier from the second value interval of the binary bit of the target field;

[0132] Based on the business identifier and policy identifier, an alarm policy is matched.

[0133] In some embodiments, the first parsing unit is specifically configured to:

[0134] Find the target field in the alarm decision information.

[0135] In some embodiments, the execution unit is specifically configured to:

[0136] Verify the target field and obtain the verification result;

[0137] If the verification result passes, the alarm operation is executed based on the alarm strategy;

[0138] The verification content includes at least one of the following:

[0139] Field format, effectiveness of the alarm strategy, and whether the alarm strategy is hallucinating.

[0140] In some embodiments, the execution unit is specifically configured to:

[0141] Segment the system information to obtain the segmentation result;

[0142] Determine the matching degree between the word segmentation result and the strategy label in the alarm strategy;

[0143] In the case where the matching degree is higher than the preset threshold, it is determined that the alarm strategy has not experienced hallucinations;

[0144] When the matching degree is less than or equal to the preset threshold, it is determined that the alarm strategy is hallucinating.

[0145] In some embodiments, the execution unit is specifically configured to:

[0146] Determine the match between the word segmentation results and the strategy labels based on a logistic regression model; or,

[0147] Determine the matching degree between the word segmentation result and the strategy label based on the decision tree.

[0148] For the description of specific functions and examples of each module and submodule of the device in the embodiment of the present disclosure, reference can be made to the relevant description of the corresponding steps in the above method embodiment, which will not be repeated here.

[0149] In the technical solution disclosed herein, the acquisition, storage and application of user personal information involved are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0150] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device, a readable storage medium and a computer program product.

[0151] Figure 8 A schematic block diagram of an example electronic device 800 that can be used to implement an embodiment of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or required herein.

[0152] like Figure 8 As shown, the device 800 includes a computing unit 801, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 802 or a computer program loaded from a storage unit 808 into a random access memory (RAM) 803. In the RAM 803, various programs and data required for the operation of the device 800 can also be stored. The computing unit 801, the ROM 802, and the RAM 803 are connected to each other via a bus 804. An input / output (I / O) interface 805 is also connected to the bus 804.

[0153] A number of components in the device 800 are connected to the I / O interface 805, including: an input unit 806, such as a keyboard, a mouse, etc.; an output unit 807, such as various types of displays, speakers, etc.; a storage unit 808, such as a disk, an optical disk, etc.; and a communication unit 809, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 809 allows the device 800 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0154] The computing unit 801 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 801 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 801 performs the various methods and processes described above, such as a business system alarm method based on a large model. For example, in some embodiments, a business system alarm method based on a large model may be implemented as a computer software program, which is tangibly included in a machine-readable medium, such as a storage unit 808. In some embodiments, part or all of the computer program may be loaded and / or installed on the device 800 via the ROM 802 and / or the communication unit 809. When the computer program is loaded into the RAM 803 and executed by the computing unit 801, one or more steps of the business system alarm method based on the large model described above may be performed. Alternatively, in other embodiments, the computing unit 801 may be configured to execute the large model-based business system alarm method in any other appropriate manner (eg, by means of firmware).

[0155] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0156] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0157] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0158] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0159] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0160] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship with each other. The server may be a cloud server, a server of a distributed system, or a server combined with a blockchain.

[0161] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.

[0162] The above specific implementations do not constitute a limitation on the protection scope of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the principles of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A business system alarm method based on a large model, comprising: Obtain system information of the target business system; Processing the system information based on the large model to obtain alarm decision information output by the large model; When the alarm decision information indicates that an alarm is required, an alarm operation is performed.

2. The method according to claim 1, wherein: The processing of the system information based on the large model to obtain the alarm decision information output by the large model includes: Get alarm configuration information; Constructing an alarm prompt word based on the alarm configuration information and the system information; The alarm prompt words are input into the large model to obtain the alarm decision information output by the large model.

3. The method according to claim 2, further comprising determining the alarm configuration information based on the following method: Get the target object's customized alarm information sample to be processed; The alarm configuration information is generated based on the example of the information to be alarmed.

4. The method according to any one of claims 1-3, further comprising training the large model based on the following method: Get historical information; Parsing the historical information based on the information template to obtain a message sample to be learned; The large model is trained based on the message samples to be learned and the decision criteria corresponding to the message samples to be learned.

5. The method according to claim 1, wherein: When the alarm decision information indicates that an alarm is required, executing an alarm operation includes: Analyzing the alarm decision information; When the alarm decision information includes a target field, parsing the target field to obtain a corresponding alarm strategy; An alarm operation is performed based on the alarm strategy.

6. The method according to claim 5, wherein the target field is an m-bit binary string, m is a positive integer greater than 1, wherein: The parsing of the target field to obtain a corresponding alarm strategy includes: Parsing the service identifier of the target service system from the first value interval of the binary bit of the target field; and Parsing a policy identifier from a second value interval of the binary bit of the target field; The alarm policy is matched based on the service identifier and the policy identifier.

7. The method according to claim 5, wherein: The analyzing the alarm decision information includes: The target field is searched in the alarm decision information.

8. The method according to claim 5, wherein: The performing of the alarm operation based on the alarm strategy includes: Verify the target field to obtain a verification result; If the verification result passes, an alarm operation is performed based on the alarm strategy; The verification content includes at least one of the following: Field format, effectiveness of the alarm strategy, and whether the alarm strategy is hallucinating.

9. The method according to claim 8, wherein: Verify that the alarm strategy is not illusionary, including: Performing word segmentation on the system information to obtain a word segmentation result; Determining a degree of match between the word segmentation result and a policy label in the alarm policy; In the case where the degree of match is higher than a preset threshold, determining that the alarm strategy does not cause hallucination; When the matching degree is less than or equal to the preset threshold, it is determined that the alarm strategy is hallucinating.

10. The method according to claim 9, wherein: The determining of the matching degree between the word segmentation result and the policy label in the alarm policy includes: Determine the matching degree between the word segmentation result and the strategy label based on a logistic regression model; or, The matching degree between the word segmentation result and the strategy label is determined based on the decision tree.

11. A business system alarm device based on a large model, comprising: An acquisition module is used to obtain system information of the target business system; An output module, used for processing the system information based on the large model to obtain alarm decision information output by the large model; The execution module is used to execute the alarm operation when the alarm decision information indicates that an alarm is needed.

12. The device according to claim 11, wherein: The output module is specifically used for: Get alarm configuration information; Constructing an alarm prompt word based on the alarm configuration information and the system information; The alarm prompt words are input into the large model to obtain the alarm decision information output by the large model.

13. The apparatus according to claim 12, further comprising a generating module, configured to: Get the target object's customized alarm information sample to be processed; The alarm configuration information is generated based on the example of the information to be alarmed.

14. The apparatus according to any one of claims 11 to 13, further comprising a training module for training the large model: Get historical information; Parsing the historical information based on the information template to obtain a message sample to be learned; The large model is trained based on the message samples to be learned and the decision criteria corresponding to the message samples to be learned.

15. The device according to claim 11, wherein The execution module comprises: A first parsing unit, used for parsing the alarm decision information; A second parsing unit is used to parse the target field to obtain a corresponding alarm strategy when the alarm decision information contains the target field; An execution unit is used to execute an alarm operation based on the alarm strategy.

16. The device according to claim 15, wherein the target field is an m-bit binary string, m is a positive integer greater than 1, wherein: The second parsing unit is specifically used for: Parsing the service identifier of the target service system from the first value interval of the binary bit of the target field; and Parsing a policy identifier from a second value interval of the binary bit of the target field; The alarm policy is matched based on the service identifier and the policy identifier.

17. The device according to claim 15, wherein: The first parsing unit is specifically used for: The target field is searched in the alarm decision information.

18. The device according to claim 15, wherein: The execution unit is specifically used for: Verify the target field to obtain a verification result; If the verification result passes, an alarm operation is performed based on the alarm strategy; The verification content includes at least one of the following: Field format, effectiveness of the alarm strategy, and whether the alarm strategy is hallucinating.

19. The device according to claim 18, wherein The execution unit is specifically used for: Performing word segmentation on the system information to obtain a word segmentation result; Determining a degree of match between the word segmentation result and a policy label in the alarm policy; In the case where the degree of match is higher than a preset threshold, determining that the alarm strategy does not cause hallucination; When the matching degree is less than or equal to the preset threshold, it is determined that the alarm strategy is hallucinating.

20. The device according to claim 19, wherein The execution unit is specifically used for: Determine the matching degree between the word segmentation result and the strategy label based on a logistic regression model; or, The matching degree between the word segmentation result and the strategy label is determined based on the decision tree.

21. An electronic device comprising: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 10.

22. A non-transitory computer-readable storage medium storing computer instructions, wherein: The computer instructions are used to cause the computer to execute the method according to any one of claims 1-10.

23. A computer program product comprising a computer program, which, when executed by a processor, implements the method according to any one of claims 1 to 10.

Images