Intelligent alarm method and system based on Transform variational auto-encoder network

Abstract

According to the intelligent alarm method and system based on the Transform variational auto-encoder network, input data are mapped to a potential space in combination with long-term dependence capture, a self-attention mechanism and parallel processing capacity of the Transform, and output data are sampled from the potential space, so that the accuracy and real-time processing capacity of anomaly detection are improved. According to the method, the Transform network and the VAE network are combined, and the modeling capability of the database sequence data is remarkably improved by utilizing the long-term dependence capture and self-attention mechanism of the Transform. On the basis of a TVAE model, an AI large model and a local knowledge graph are combined, deep analysis is carried out on an anomaly detection result, potential root causes are extracted, and a solution is provided. Through the strong learning ability of the AI large model and the rich background information of the knowledge graph, the root cause of the abnormality can be quickly identified and positioned, so that an efficient and accurate solution is provided, and the processing efficiency of operation and maintenance personnel and the accuracy of problem solving are improved.

Description

Technical Field

[0001] The present invention relates to an intelligent alarm method and system based on a Transformer variational autoencoder network, and belongs to the field of intelligent operation and maintenance. Background Art

[0002] As the amount of digital service data in enterprises continues to grow and the load on the network environment increases, database server monitoring becomes increasingly important. Database operation and maintenance personnel are under tremendous pressure. Once the database service fails or is paralyzed, it may cause a large-scale paralysis of the company's services. Therefore, real-time monitoring and timely response to abnormal behavior and performance issues of database servers are crucial.

[0003] Traditional database server monitoring methods are often based on rules or statistical methods, detecting anomalies through predefined rules or thresholds. However, this method is usually only applicable to known problems, and requires manual updating and maintenance of rules, which cannot meet the needs of accurate identification and effective response to security issues in complex network environments. In addition, as an important deep generation model, variational autoencoder (VAE) has made some progress in the field of intelligent alarm. However, there are some challenges in processing sequence data. Sequence data usually has complex time dependencies and correlations. Traditional VAE models are difficult to capture these features, resulting in limited performance in practical applications. With the continuous growth of enterprise service data in terms of data volume, the pressure of database operation and maintenance services has been greatly challenged. Although deep learning-based intelligent alarm systems such as VAE networks have powerful generation and probabilistic modeling capabilities, they lack the ability to model long-term dependencies of sequence data.

[0004] First, the traditional VAE model lacks the ability to model the long-term dependencies of sequence data. The model is usually based on element-by-element reconstruction loss and cannot effectively capture the long-term dependencies in sequence data, resulting in low quality of generated reconstructed data and difficulty in reflecting the true structure of sequence data.

[0005] In addition, the traditional VAE model has limited potential representation learning capabilities. The model is usually based on a simple latent variable model, which cannot fully utilize the context and information of the data, resulting in the lack of representation ability of the learned latent representation and difficulty in capturing the essential characteristics of the data.

[0006] Finally, the existing technology does not provide sufficient support for subsequent solutions after completing anomaly detection, and requires manual investigation of the cause of the failure and finding a solution, which increases the complexity and time cost of maintenance. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] Figure 1This is a diagram of the Transformer variational autoencoder network structure. Summary of the invention

[0008] In order to solve the problems existing in the prior art, the present invention proposes an intelligent alarm method based on the Transformer variational autoencoder network. The method combines the long-term dependency capture, self-attention mechanism and parallel processing capabilities of the Transformer to map the input data to the latent space and generate output data from it by sampling, thereby improving the accuracy of anomaly detection and real-time processing capabilities. Specifically, the following steps are included:

[0009] (1) Data preparation: Collect and prepare network data for training and testing;

[0010] (2) Anomaly detection: The trained model inputs the input data into the encoder to obtain the potential representation of the data, and then reconstructs the data through the decoder. The reconstruction error and KL divergence indicators are used to evaluate whether the data is abnormal. Data exceeding a certain threshold will be considered abnormal.

[0011] (3) Alarm generation: Generate alarm information for detected abnormal data, monitor the operation of the intelligent alarm system, collect user feedback, and tune and improve the model based on feedback and performance evaluation results;

[0012] (4) Intelligent root cause analysis: Build a local knowledge graph based on expert prior knowledge and the annotated data of the database operation and maintenance manual, and establish an operation and maintenance knowledge network. Perform root cause analysis on system abnormal alarms, and propose solutions for the abnormal alarms in combination with the AI ​​big model.

[0013] Furthermore, in step (2), the Transformer variational autoencoder network is divided into an encoder and a decoder. The encoder encodes the input data into the distribution parameters of the latent space, and the decoder samples from the latent space and generates output data. When detecting anomalies, first, the dynamic weight parameter λ is calculated. l =αλ l-1 +(1-α)·P l , where α is the smoothing coefficient, l is the number of training iterations, P l is the performance indicator of the model on the validation set, then the loss function based on the Transformer variational autoencoder network is

[0014] Where t is the time step index of the sequence, i is the index of each word in the vocabulary, and N vocab is the vocabulary size, x t,i is the actual value of word i at time step t in the initial input sequence, is the predicted value of word i at time step t in the sequence generated by the decoder; J is the size of the potential representation, σ j is the standard deviation of the potential representation in the jth dimension, μ j is the mean of the potential representation in the jth dimension; T is the sequence length, is the target sequence, and y is the sequence generated by the model.

[0015] Furthermore, in step (4), based on the enterprise's real database maintenance cases, database operation and maintenance work manuals, and expert prior knowledge unstructured data, tools are used to annotate entities and relationships in unstructured operation and maintenance knowledge, and a graph database is used to construct a database operation and maintenance knowledge graph, which includes "alarm item-cause-specific cause", "cause-how to solve-solution", and "cause-related alarm item-alarm item" triples; and combined with the calculation method of node importance, the weight attribute is set for the associated alarm item node of the cause. The larger the weight value, the more likely the cause is to be the root cause of the alarm anomaly.

[0016] Based on the above method, the present invention proposes an intelligent warning system based on the Transformer variational autoencoder network. The system combines the Transformer's long-term dependency capture, self-attention mechanism and parallel processing capabilities to map input data to a latent space and generate output data from it, thereby improving the accuracy of anomaly detection and real-time processing capabilities. Specifically, it includes:

[0017] (1) Data preparation module: This module collects and prepares network data for training and testing;

[0018] (2) Anomaly detection module: This module uses the trained model to input the input data into the encoder to obtain the potential representation of the data, and then reconstructs the data through the decoder. The reconstruction error and KL divergence indicators are used to evaluate whether the data is abnormal. Data exceeding a certain threshold will be considered abnormal.

[0019] (3) Alarm generation module: This module generates alarm information for detected abnormal data, monitors the operation of the intelligent alarm system, collects user feedback, and tunes and improves the model based on the feedback and performance evaluation results.

[0020] (4) Intelligent root cause analysis module: This module builds a local knowledge graph based on expert prior knowledge and the annotated data of the database operation and maintenance manual, and establishes an operation and maintenance knowledge network. It performs root cause analysis on system abnormal alarms and proposes solutions for the abnormal alarms in combination with the AI ​​big model.

[0021] Furthermore, in the anomaly detection module, the Transformer variational autoencoder network is divided into an encoder and a decoder. The encoder encodes the input data into the distribution parameters of the latent space, and the decoder samples from the latent space and generates output data. When detecting anomalies, first, the dynamic weight parameter λ is calculated. l =αλ l-1 +(1-α)·P l , where α is the smoothing coefficient, l is the number of training iterations, P l is the performance indicator of the model on the validation set, then the loss function based on the Transformer variational autoencoder network is

[0022] Where t is the time step index of the sequence, i is the index of each word in the vocabulary, and N vocab is the vocabulary size, x t,i is the actual value of word i at time step t in the initial input sequence, is the predicted value of word i at time step t in the sequence generated by the decoder; J is the size of the potential representation, σ j is the standard deviation of the potential representation in the jth dimension, μ j is the mean of the potential representation in the jth dimension; T is the sequence length, is the target sequence, and y is the sequence generated by the model.

[0023] Furthermore, in the intelligent root cause analysis module, based on the company's real database maintenance cases, database operation and maintenance work manuals, and expert prior knowledge unstructured data, tools are used to annotate entities and relationships in unstructured operation and maintenance knowledge, and a graph database is used to build a database operation and maintenance knowledge graph, which includes "alarm item-cause-specific cause", "cause-how to solve-solution", and "cause-related alarm item-alarm item" triples; and combined with the calculation method of node importance, the weight attribute is set for the associated alarm item node of the cause. The larger the weight value, the more likely the cause is to be the root cause of the alarm anomaly.

[0024] Compared with the prior art, the invention is innovative in that:

[0025] (1) The integration of Transformer and VAE improves anomaly detection capabilities: This paper combines the Transformer network with the VAE network, and uses the Transformer's long-term dependency capture and self-attention mechanism to significantly improve the modeling capabilities of database sequence data. By mapping the input data to the latent space and reconstructing it, the TVAE model can more accurately detect and identify abnormal behaviors, while using attention weights to provide interpretability for anomaly detection results, allowing the system to have higher real-time processing capabilities and accuracy when facing large-scale data.

[0026] (2) Root cause analysis and solutions combining AI big model and local knowledge graph: Based on the TVAE model, this invention combines AI big model and local knowledge graph to conduct in-depth analysis of anomaly detection results, extract potential root causes and provide solutions. Through the powerful learning ability of AI big model and the rich background information of knowledge graph, the root cause of anomalies can be quickly identified and located, thereby providing efficient and accurate solutions, improving the processing efficiency of operation and maintenance personnel and the accuracy of problem solving. DETAILED DESCRIPTION

[0027] With the continuous growth of enterprise service data in terms of data volume, the pressure of database operation and maintenance services is facing considerable challenges. Although intelligent alarm systems based on deep learning, such as VAE networks, have powerful generation and probability modeling capabilities, they lack the ability to model long-term dependencies of sequence data. The present invention proposes a Transformer variational autoencoder (TVAE) network, combined with the Transformer's long-term dependency capture, self-attention mechanism and parallel processing capabilities, to map input data to a latent space, and generate output data from it by sampling, thereby improving the accuracy of anomaly detection and real-time processing capabilities.

[0028] 1. Data preparation

[0029] Collect and prepare network data for training and testing, which can include network traffic data, log files, system event records, etc. Then preprocess the collected data, including cleaning, denoising, normalization and other operations to ensure data quality and consistency.

[0030] 2. Anomaly Detection

[0031] This paper proposes a new Transformer variational autoencoder (TVAE) network. The trained model inputs the input data into the encoder to obtain the potential representation of the data, and then reconstructs the data through the decoder. The reconstruction error and KL divergence indicators are used to evaluate whether the data is abnormal. Data exceeding a certain threshold will be considered abnormal.

[0032] Furthermore, in step 2, a new network model based on Transformer variational autoencoder is proposed to address the limitations of variational autoencoder networks in processing complex time dependencies and correlations of sequence data. The TVAE network can be divided into two parts: the encoder and the decoder, where the encoder is responsible for encoding the input data into the distribution parameters of the latent space, and the decoder samples from the latent space and generates output data.

[0033] (1) Encoder

[0034] The encoder is responsible for mapping the input data to the mean and variance parameters in the latent space. The input data is passed through the embedding layer to obtain the word embedding representation, which is input to the Transformer encoder as an input sequence. The Transformer encoder consists of multiple layers of self-attention layers and feedforward neural network layers, and each layer is connected through residual connections and layer normalization. The output of the last layer of the Transformer encoder is used to predict the mean and variance parameters of the latent space.

[0035] (2) Decoder

[0036] A random vector is sampled from the latent space, whose distribution is determined by the mean and variance parameters predicted by the encoder, and this random vector is used as the input of the decoder. The decoder output passes through a fully connected layer and then passes through the softmax function to produce the final output sequence.

[0037] In the anomaly detection task, in order to improve the accuracy and reliability of anomaly detection, the present invention uses a dynamic weight balancing method to calculate the loss function, thereby improving the generalization ability and robustness of the anomaly detection model.

[0038] First, calculate the dynamic weight parameter λ, let λ l =αλ l-1 +(1-α)· l P, where α represents the smoothing coefficient, l represents the number of training iterations, and P l Represents the performance index of the model on the validation set. Then, the loss function of the TVAE network is

[0039] Where t represents the time step index of the sequence, i represents each word index in the vocabulary, and N vocab represents the vocabulary size, x t,i represents the actual value of word i at time step t in the initial input sequence, represents the predicted value of word i at time step t in the sequence generated by the decoder; J represents the size of the potential representation, σ j represents the standard deviation of the latent representation in the jth dimension, μ j represents the mean of the potential representation in the jth dimension; T represents the sequence length, represents the target sequence, and y is the sequence generated by the model.

[0040] (3) Anomaly Detection

[0041] After completing the TVAE model training, anomaly detection tasks are performed on the test data to evaluate the performance of the model. Two types of anomalies are judged: discrete point anomalies and context subsequence anomalies. The former refers to some outliers, and the latter refers to time series fragments that are different from the context. The reconstructed data obtained by the decoder will use the reconstruction error and KL divergence indicators to evaluate whether the data is abnormal. Data exceeding a certain threshold will be considered abnormal.

[0042] 3. Alarm generation

[0043] Generate warning information for detected abnormal data, including warning type, level, and suggestions, etc. In addition, monitor the operation of the intelligent warning system, collect user feedback, and tune and improve the model based on feedback and performance evaluation results.

[0044] 4. Intelligent root cause analysis

[0045] Intelligent analysis is achieved based on the "AI model + local knowledge graph". The present invention constructs a local knowledge graph based on expert prior knowledge and the annotation data of the database operation and maintenance manual, and establishes an operation and maintenance knowledge network. Root cause analysis is performed on system abnormal alarms, and a reasonable solution is proposed for the abnormal alarm in combination with the AI ​​big model.

[0046] Furthermore, in step 4, the present invention uses tools to annotate entities and relationships in unstructured operation and maintenance knowledge based on real enterprise database maintenance cases, database operation and maintenance work manuals, expert prior knowledge and other unstructured data, and uses a graph database to build a database operation and maintenance knowledge graph. It includes multiple triples such as "alarm item-cause-specific cause", "cause-how to solve-solution", and "cause-related alarm item-alarm item". In addition, to facilitate root cause analysis, combined with the calculation method of node importance, and considering factors such as the associated alarm items of the cause, a weight attribute is set for the "cause" node. The larger the weight value, the more likely the cause is to be the root cause of the alarm anomaly.

[0047] The following is a more specific example:

[0048] 1. Data preparation

[0049] Collect network traffic data, log files, system event records and other data for training and testing, including network traffic data, log files, system event records, etc. Then pre-process the collected data, including cleaning, denoising, normalization and other operations to ensure the quality and consistency of the data.

[0050] 2. Anomaly Detection

[0051] This paper proposes a new Transformer variational autoencoder (TVAE) network. The trained model inputs the input data into the encoder to obtain the potential representation of the data, and then reconstructs the data through the decoder. The reconstruction error and KL divergence indicators are used to evaluate whether the data is abnormal. Data exceeding a certain threshold will be considered abnormal.

[0052] Specifically, step 2 includes the following:

[0053] (1)Encoder

[0054] First, input the sequence x = {x1, x2, ..., x T} Through the embedding layer, each word is mapped to a high-dimensional vector space to obtain the word embedding representation E(x), and E p (x) = E(x) + PE(x), where PE(x) is the positional encoding. The word embedding representation E p (x) is used as the input of the Transformer encoder. Each layer consists of a multi-head self-attention mechanism and a feedforward neural network. Each layer is connected by residual connections and layer normalization. Then the attention score is calculated as Where Q, K, and V represent query, key, and value matrices, respectively. The last layer output of the Transformer encoder is used to predict the mean and variance parameters of the latent space, and μ = W μ ·h+b μ , logσ 2 =W σ ·h+b σ , where h is the last layer output of the Transformer encoder, W μ , W σ and h μ 、h σ is the parameter of the fully connected layer, b μ 、b σ is the bias vector.

[0055] (2)Decoder

[0056] The task of the decoder is to generate output data from random vectors sampled from the latent space. The specific structure is as follows:

[0057] First, a random vector z is sampled from the distribution determined by the mean and variance parameters predicted by the encoder, and this sampled random vector z is used as the input of the decoder and mapped to a high-dimensional space. The decoder also consists of multiple layers of self-attention layers and feedforward neural network layers. The decoder uses a masking mechanism to ensure that only the previous output can be seen during decoding.

[0058] The final output of the decoder passes through a fully connected layer and then passes through the softmax function to generate the probability distribution of the final output sequence. Where W o and h dec is the parameter of the fully connected layer, b o is a bias vector.

[0059] The dynamic weight balancing strategy is introduced into the loss function to optimize the loss. Specifically, first, the dynamic weight parameter λ is calculated, and λ is set l =αλ l-1 +1-(α·) l P, where α represents the smoothing coefficient, l represents the number of training iterations, and P l Represents the performance index of the model on the validation set. Then, the loss function of the TVAE network is

[0060] Where t represents the time step index of the sequence, T represents the sequence length, i represents the index of each word in the vocabulary, and N vocab represents the vocabulary size, x t,i represents the actual value of word i at time step t in the initial input sequence, represents the predicted value of word i at time step t in the sequence generated by the decoder; J represents the size of the potential representation, σ j represents the standard deviation of the latent representation in the jth dimension, μ j represents the mean of the potential representation in the jth dimension; represents the target sequence, and y is the sequence generated by the model. After training, the TVAE model is evaluated, including performance indicators such as model accuracy, recall rate, and precision.

[0061] Specifically, assuming that the input sequence x is the time series data of the sequence usage rate, for example, the number of times used per minute in the past 60 minutes, let x = {15, 18, 17, ...,, the prediction result of the TVAE model is {11, 17, 15, ..., 25}, and the error e = {4, 1, 2, ..., 5} is calculated for each time. According to the historical data, a reasonable error threshold θ = 3 is determined, so the error e at certain moments can be obtained. t >θ, these moments are marked as abnormal.

[0062] 3. Alarm generation

[0063] Generate alarm information for detected abnormal data, including alarm object, alarm item, alarm content, severity, etc. For example, if the alarm item is "sequence usage is high", this alarm is a serious abnormality and should be handled in time. The specific information is as follows. In addition, monitor the operation of the intelligent alarm system, collect user feedback, and tune and improve the model based on feedback and performance evaluation results.

[0064]

[0065]

[0066] 4. Intelligent root cause analysis

[0067] The present invention realizes intelligent analysis of alarm items based on the method of "AI model + local knowledge graph", including the cause and solution of the abnormality of the alarm item and the root cause analysis of the related alarm items. Specifically, data annotation is completed based on expert knowledge and database work manual to establish a knowledge graph. For example, if the alarm item "high sequence usage rate" is abnormal, the node whose attribute value of the alarm item node is "high sequence usage rate" is searched in the knowledge graph, and the triple knowledge graph of the cause, solution and related alarm items is extracted. Further, the most likely cause of the abnormality of the alarm item is analyzed according to the related alarm items. For example, after analysis, it is found that the root cause of the abnormality of the alarm item this time is "a large number of insert operations in the application." Further, the solution corresponding to the cause can be obtained according to the relationship network in the knowledge graph. In addition, this root cause and other background knowledge are sent to the AI ​​big model as prompts for extended analysis, and the AI ​​big model will propose a reasonable analysis and solution for the abnormal alarm item.

[0068] The units, devices or modules described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. For the convenience of description, the above devices are described separately by functions divided into various modules. Of course, when implementing this application, the functions of each module can be implemented in the same or more software and / or hardware, or the modules that implement the same function can be implemented by a combination of multiple sub-modules or sub-units. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the coupling or direct coupling or communication connection between each other shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0069] Those skilled in the art also know that, in addition to implementing the controller in a purely computer-readable program code, the controller can be made to implement the same function in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, such a controller can be considered as a hardware component, and the devices for implementing various functions included therein can also be considered as structures within the hardware component. Or even, the devices for implementing various functions can be considered as both software modules for implementing the method and structures within the hardware component.

[0070] The present application may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, classes, etc. that perform specific tasks or implement specific abstract data types. The present application may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0071] It can be known from the description of the above implementation methods that those skilled in the art can clearly understand that the present application can be implemented by means of software plus a necessary general hardware platform. Based on such an understanding, the technical solution of the present application can be essentially or partly contributed to the prior art in the form of a software product, which can be stored in a storage medium such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes several instructions for enabling a computer device (which can be a personal computer, a mobile terminal, a server, or a network device, etc.) to execute the methods described in the various embodiments of the present application or certain parts of the embodiments.

[0072] The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld devices or portable devices, tablet devices, multi-processor systems, microprocessor-based systems, set-top boxes, programmable electronic devices, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc.

[0073] The specific embodiments described above further illustrate the purpose, technical solutions and beneficial effects of the present application. It should be understood that the above description is only a specific embodiment of the present application and is not intended to limit the scope of protection of the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application.

Claims

1. An intelligent warning method based on Transformer variational autoencoder network, which combines the long-term dependency capture, self-attention mechanism and parallel processing capability of Transformer to map input data to latent space and generate output data from it, thereby improving the accuracy of anomaly detection and real-time processing capability, characterized by: The following steps are involved: (1) Data preparation: Collect and prepare network data for training and testing; (2) Anomaly detection: The trained model inputs the input data into the encoder to obtain the potential representation of the data, and then reconstructs the data through the decoder. The reconstruction error and KL divergence indicators are used to evaluate whether the data is abnormal. Data exceeding a certain threshold will be considered abnormal. (3) Alarm generation: Generate alarm information for detected abnormal data, monitor the operation of the intelligent alarm system, collect user feedback, and tune and improve the model based on feedback and performance evaluation results; (4) Intelligent root cause analysis: Build a local knowledge graph based on expert prior knowledge and annotated data from the database operation and maintenance manual to establish an operation and maintenance knowledge network. Perform root cause analysis on system abnormal alarms and propose solutions for the abnormal alarms by combining AI big models.

2. The intelligent warning method based on the Transformer variational autoencoder network according to claim 1, characterized in that: In step (2), the Transformer variational autoencoder network is divided into an encoder and a decoder. The encoder encodes the input data into the distribution parameters of the latent space, and the decoder samples from the latent space and generates output data. When detecting anomalies, first, the dynamic weight parameter λ is calculated. l =αλ l-1 +(1-α)·P l , where α is the smoothing coefficient, l is the number of training iterations, P l is the performance indicator of the model on the validation set, then the loss function based on the Transformer variational autoencoder network is Where t is the time step index of the sequence, i is the index of each word in the vocabulary, and N vocab is the vocabulary size, x t,i is the actual value of word i at time step t in the initial input sequence, is the predicted value of word i at time step t in the sequence generated by the decoder; J is the size of the potential representation, σ j is the standard deviation of the potential representation in the jth dimension, μ j is the mean of the potential representation in the jth dimension; T is the sequence length, is the target sequence, and y is the sequence generated by the model.

3. The intelligent warning method based on the Transformer variational autoencoder network according to claim 1, characterized in that: In step (4), based on the enterprise's real database maintenance cases, database operation and maintenance work manuals, and expert prior knowledge unstructured data, tools are used to annotate entities and relationships in unstructured operation and maintenance knowledge, and a database operation and maintenance knowledge graph is constructed using a graph database, which includes "alarm item-cause-specific cause", "cause-how to solve-solution", and "cause-related alarm item-alarm item" triples; and combined with the calculation method of node importance, the weight attribute is set for the associated alarm item node of the cause. The larger the weight value, the more likely the cause is to be the root cause of the alarm exception.

4. An intelligent warning system based on the Transformer variational autoencoder network. The system combines the long-term dependency capture, self-attention mechanism and parallel processing capabilities of the Transformer to map input data to a latent space and generate output data from it, thereby improving the accuracy of anomaly detection and real-time processing capabilities. The system is characterized by: The system includes: (1) Data preparation module: This module collects and prepares network data for training and testing; (2) Anomaly detection module: This module uses the trained model to input the input data into the encoder to obtain the potential representation of the data, and then reconstructs the data through the decoder. The reconstruction error and KL divergence indicators are used to evaluate whether the data is abnormal. Data exceeding a certain threshold will be considered abnormal. (3) Alarm generation module: This module generates alarm information for detected abnormal data, monitors the operation of the intelligent alarm system, collects user feedback, and tunes and improves the model based on the feedback and performance evaluation results. (4) Intelligent root cause analysis module: This module builds a local knowledge graph based on expert prior knowledge and the annotated data of the database operation and maintenance manual, and establishes an operation and maintenance knowledge network. It performs root cause analysis on system abnormal alarms and proposes solutions for the abnormal alarms in combination with the AI ​​big model.

5. The intelligent warning system based on the Transformer variational autoencoder network according to claim 4, characterized in that: In the anomaly detection module, the Transformer variational autoencoder network is divided into an encoder and a decoder. The encoder encodes the input data into the distribution parameters of the latent space, and the decoder samples from the latent space and generates output data. When detecting anomalies, first, the dynamic weight parameter λ is calculated. l =αλ l-1 +(1-α)·P l , where α is the smoothing coefficient, l is the number of training iterations, P l is the performance indicator of the model on the validation set, then the loss function based on the Transformer variational autoencoder network is Where t is the time step index of the sequence, i is the index of each word in the vocabulary, and N vocab is the vocabulary size, x t,i is the actual value of word i at time step t in the initial input sequence, is the predicted value of word i at time step t in the sequence generated by the decoder; J is the size of the potential representation, σ j is the standard deviation of the potential representation in the jth dimension, μ j is the mean of the potential representation in the jth dimension; T is the sequence length, is the target sequence, and y is the sequence generated by the model.

6. The intelligent warning system based on the Transformer variational autoencoder network according to claim 4, characterized in that: In the intelligent root cause analysis module, based on the company's real database maintenance cases, database operation and maintenance work manuals, and unstructured data of expert prior knowledge, tools are used to annotate entities and relationships in unstructured operation and maintenance knowledge, and a graph database is used to build a database operation and maintenance knowledge graph, which includes "alarm item-cause-specific cause", "cause-how to solve-solution", and "cause-related alarm item-alarm item" triplets; and combined with the calculation method of node importance, the weight attribute is set for the associated alarm item node of the cause. The larger the weight value, the more likely the cause is to be the root cause of the alarm exception.

Images