Fault reason analysis method and device for IT operation and maintenance scene

Abstract

The invention discloses a fault reason analysis method and device for an IT operation and maintenance scene. A server side method comprises the steps that a question request sent by a client side is received; the question request carries a to-be-analyzed operation and maintenance question; converting the problem into high-dimensional vector representation as a target vector; calculating the similarity between the target vector and a vectorized object of each entity stored in a preset dynamic vector knowledge base, and taking the entity of which the similarity is greater than a preset similarity threshold as a target entity; querying a target vectorization object and a target field attribute corresponding to each target entity from a preset dynamic knowledge graph; according to the target vectorization object and the target field attribute, constructing a plurality of prompt words used for guiding a large language model to carry out fault reason analysis; and inputting the plurality of prompt words into a pre-fine-tuned large language model, outputting a fault reason corresponding to the operation and maintenance problem, and sending the fault reason to the client. Therefore, by adopting the method and the device, the fault reason of the system can be quickly positioned, so that the stability of the system is improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method and device for analyzing the cause of a fault in an IT operation and maintenance scenario. Background Art

[0002] In modern enterprises, IT operation and maintenance is a key link to ensure the stable operation of information systems. Take a large e-commerce platform as an example. The platform needs to manage a huge microservice architecture to ensure that the user experience is not affected under high traffic. Therefore, the IT operation and maintenance team needs to monitor key performance indicators such as service status, database query efficiency, and network latency in real time, and quickly locate the root cause of the problem when abnormal service response time is detected.

[0003] In related technologies, the operation and maintenance team usually identifies the cause of the failure by manually checking log files, monitoring indicators and alarm notifications. This method relies on the professional knowledge and experience of the operation and maintenance personnel and is inefficient. Especially when facing large-scale distributed systems, it is impossible to quickly locate the cause of the failure, thereby reducing the stability of the system. Summary of the invention

[0004] The embodiments of the present application provide a method and device for analyzing the cause of a fault in an IT operation and maintenance scenario. In order to have a basic understanding of some aspects of the disclosed embodiments, a simple summary is given below. This summary is not a general review, nor is it intended to identify key / important components or describe the scope of protection of these embodiments. Its only purpose is to present some concepts in a simple form as a preface to the detailed description that follows.

[0005] In a first aspect, an embodiment of the present application provides a method for analyzing the cause of a fault in an IT operation and maintenance scenario, which is applied to a server and includes: Receive a question request sent by a client; wherein the question request carries an operation and maintenance problem to be analyzed for an IT operation and maintenance scenario; Convert the operation and maintenance problem to be analyzed into a high-dimensional vector representation as the target vector; Calculate the similarity between the target vector and the vectorized objects of each entity stored in the preset dynamic vector knowledge base, and take the entity with a similarity greater than a preset similarity threshold as the target entity; From the preset dynamic knowledge graph, query the target vectorized object and target field attribute corresponding to each target entity; wherein the preset dynamic vector knowledge base and the preset dynamic knowledge graph are obtained by real-time updating of the initial knowledge graph and the initial vector knowledge base according to the real-time IT operation data, and the initial knowledge graph and the initial vector knowledge base are constructed based on the data set including log information, event information and system configuration information in the IT operation and maintenance scenario; According to the target vectorized object and the target field attributes, multiple prompt words are constructed to guide the pre-fine-tuned large language model to perform fault cause analysis; Multiple prompt words are input into a pre-fine-tuned large language model, and the fault cause corresponding to the operation and maintenance problem is output and sent to the client.

[0006] Optionally, the preset dynamic knowledge graph and the preset dynamic vector knowledge base are generated according to the following steps, including: Extract and preprocess data sets including log information, event information, and configuration information in IT operation and maintenance scenarios from traditional databases to obtain target data sets; Through the pre-fine-tuned large language model, deep semantic analysis is performed on the target dataset to identify multiple entities and the field attributes corresponding to each entity; Using the embedding model, each entity is converted into a vector representation to obtain the vectorized object corresponding to each entity; Construct a mapping relationship between each entity, the vectorized object corresponding to each entity and the field attribute to obtain multiple mapping pairs; Based on multiple mapping pairs, an initial knowledge graph is generated, and the mapping relationship between each entity and the vectorized object corresponding to each entity is stored to obtain an initial vector knowledge base; According to the real-time IT operation data, the initial knowledge graph and the initial vector knowledge base are dynamically updated to obtain the preset dynamic knowledge graph and the preset dynamic vector knowledge base.

[0007] Optionally, each mapping pair includes an entity, a vectorized object corresponding to the entity, and field attributes; Based on multiple mapping pairs, an initial knowledge graph is generated, including: In the default knowledge graph, a node is created for each entity, and the node includes a unique identifier; Analyze the field attributes between entities and determine the semantic relationship between entities; Define the semantic relationships as edges between entities, connect the nodes through edges, and map the vectorized objects and field attributes corresponding to the entities to the corresponding nodes to obtain the initial knowledge graph.

[0008] Optionally, based on real-time IT operation data, the initial knowledge graph and initial vector knowledge base are dynamically updated, including: Collect real-time IT operation data within a preset period; Clean and format real-time IT operation data to obtain system logs, event reports, and system performance indicators; Use a pre-fine-tuned large language model to perform deep semantic analysis on system logs, event reports, and system performance indicators to identify new first entities and their first attribute fields; Vectorize the first entity using the embedding model to obtain a first vectorized object; In the initial vector knowledge base, query the historical vectorized object corresponding to the first entity; When the historical vectorized object corresponding to the first entity is found, the historical vectorized object corresponding to the first entity is replaced with the first vectorized object; or, when the historical vector corresponding to the first entity is not found, the mapping relationship between the first entity and the first vectorized object is stored; Constructing a mapping relationship between the first entity and the first vectorized object and the first field attribute to obtain a first mapping pair; Based on the first mapping pair, the initial knowledge graph is updated to obtain a preset dynamic knowledge graph.

[0009] Optionally, based on the first mapping pair, the initial knowledge graph is updated to obtain a preset dynamic knowledge graph, including: Determine whether the initial knowledge graph contains an identifier of the first entity; If not, create a first node corresponding to the first entity; determine the semantic relationship between the first entity and each entity in the initial knowledge graph; based on the semantic relationship, determine the insertion position of the first entity in the initial knowledge graph; insert the first node corresponding to the first entity at the insertion position; map the first vectorized object and the first field attribute to the first node to obtain a preset dynamic knowledge graph; If so, based on the first vectorized object and the first field attribute, the historical vectorized objects and historical field attributes of the entity to which the identifier of the first entity belongs in the initial knowledge graph are updated.

[0010] Optionally, generate a pre-fine-tuned large language model by following these steps, including: Collect and pre-process IT operation and maintenance related data to obtain sample data, including historical failure cases, log files, system documents, and expert maintenance records; For sample data, identify sample entities and sample field attributes; Use the embedding model to convert each sample entity into a sample vectorized object; Label the sample field attributes of each sample entity and the sample vectorized object for faults, and obtain labeled model fine-tuning samples; Obtaining parameters to be fine-tuned from a preset large language model, where the parameters to be fine-tuned are some parameters in the preset large language model that are suitable for fault cause analysis; Fine-tune the preset large language model according to the model fine-tuning samples and some parameters to obtain the pre-fine-tuned large language model.

[0011] Optionally, fine-tune the preset large language model according to the model fine-tuning samples and some parameters to obtain a pre-fine-tuned large language model, including: Divide the model fine-tuning samples into training sets and test sets according to the preset division ratio; Decomposing the parameters to be fine-tuned to obtain a first decomposition matrix and a second decomposition matrix, wherein the first decomposition matrix includes column parameters of an initial weight matrix in a preset large language model, and the second decomposition matrix includes row parameters of the initial weight matrix in the preset large language model; Calculate the forward propagation factor of the model according to each training data in the training set, the first decomposition matrix and the second decomposition matrix; The model parameters in the original loss function of the preset large language model are removed and replaced with the first decomposition matrix and the second decomposition matrix to obtain the preset model loss function; Calculate the model loss value of the preset large language model according to the forward propagation factor and the preset model loss function; When the model loss value reaches the minimum, the pre-fine-tuned large language model is obtained.

[0012] Optional, , is the initial weight matrix, For a size of The matrix of Representation Matrix the number of rows, Representation Matrix The number of columns, is a vector in the decomposition, used to control the accuracy of the approximation and the number of parameters, is the first decomposition matrix, is the second decomposition matrix; The default model loss function is:

[0013] in, is at the time step The forward propagation factor of is the original weight matrix, is the bias term, is the activation function, is the time step For each training data in the training set, is the parameter to be fine-tuned, The optimization goal is to maximize the set of parameters The loss value, For each training data, is the label of the training data, is the training data set, Represents the output sequence Length, is the logarithmic probability, To preset the original parameters of the large language model, is the update parameter during decomposition, is the time step Data labels.

[0014] Optionally, based on the target vectorized object and the target field attributes, multiple prompt words are constructed to guide the pre-fine-tuned large language model to perform fault cause analysis, including: Extract key information from the target vectorized object and target field attributes, including entity name, attribute value, associated event, and time information; Based on the extracted keywords, multiple basic prompt words are constructed to reflect system logs, historical fault records, and configuration changes within a period of time. According to the preset fault analysis goals and preset guiding language, multiple basic prompt words are optimized to generate multiple target prompt words with problem orientation; The multiple target prompt words are formatted into a format suitable for input to the large language model, so as to obtain the multiple prompt words used to guide the pre-fine-tuned large language model to perform fault cause analysis.

[0015] In a second aspect, an embodiment of the present application provides a fault cause analysis device for an IT operation and maintenance scenario, the device comprising: A receiving module, used to receive a question request sent by a client; wherein the question request carries an operation and maintenance problem to be analyzed for an IT operation and maintenance scenario; The conversion module is used to convert the operation and maintenance problem to be analyzed into a high-dimensional vector representation as the target vector; A calculation module, used to calculate the similarity between the target vector and the vectorized objects of each entity stored in a preset dynamic vector knowledge base, and take the entity with a similarity greater than a preset similarity threshold as the target entity; A query module is used to query the target vectorized object and target field attribute corresponding to each target entity from the preset dynamic knowledge graph; wherein the preset dynamic vector knowledge base and the preset dynamic knowledge graph are obtained by updating the initial knowledge graph and the initial vector knowledge base in real time according to the real-time IT operation data, and the initial knowledge graph and the initial vector knowledge base are constructed based on the data set including log information, event information and system configuration information in the IT operation and maintenance scenario; A construction module, used to construct multiple prompt words for guiding a pre-fine-tuned large language model to perform fault cause analysis according to a target vectorized object and a target field attribute; The output module is used to input multiple prompt words into a pre-fine-tuned large language model, output the fault cause corresponding to the operation and maintenance problem, and send it to the client.

[0016] The technical solution provided by the embodiments of the present application may have the following beneficial effects: In an embodiment of the present application, on the one hand, the operation and maintenance problem to be analyzed is converted into a high-dimensional vector representation, and then similarity is calculated with the entities in a preset dynamic vector knowledge base to identify the most relevant entities. The vectorized objects and their attributes of these entities are used to construct prompt words, which can guide the pre-fine-tuned large language model to perform in-depth analysis and quickly locate the cause of the system failure, thereby shortening the fault response time and improving the speed of problem solving; on the other hand, the preset dynamic vector knowledge base and knowledge graph are updated in real time, so that the data in the knowledge base and the knowledge graph can reflect the latest operation and maintenance knowledge at the current moment, ensuring that the fault analysis is based on the latest operation and maintenance data, and ensuring the timeliness and accuracy of the fault analysis.

[0017] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0019] Figure 1 This is a method flow diagram of a method for analyzing the cause of a fault in an IT operation and maintenance scenario provided by an embodiment of the present application; Figure 2 It is a conversion data table from operation and maintenance problems to vectors provided in an embodiment of the present application; Figure 3 It is a similarity data table between a target vector and an entity vectorized object in a knowledge base provided in an embodiment of the present application; Figure 4 It is a data table of vectorized objects and values ​​corresponding to each entity name provided in an embodiment of the present application; Figure 5 It is a data table of prompt words generated based on vectorized objects corresponding to each entity name and numerical values ​​provided in an embodiment of the present application; Figure 6 This is an interface diagram of a fault cause received by a client provided in an embodiment of the present application; Figure 7 This is a schematic diagram of the overall process of fault cause analysis for IT operation and maintenance scenarios provided by the present application; Figure 8 It is a flowchart of a large language model fine-tuning method provided by this application; Fig. 9It is a structural schematic diagram of a fault cause analysis device for IT operation and maintenance scenarios provided by the present application; Fig.10 It is a structural schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0020] The following description and the accompanying drawings sufficiently illustrate specific embodiments of the present application to enable those skilled in the art to practice them.

[0021] It should be clear that the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present application.

[0022] When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present application. Instead, they are only examples of devices and methods consistent with some aspects of the present application as detailed in the attached claims.

[0023] In the description of the present application, it should be understood that the terms "first", "second", etc. are used for descriptive purposes only and should not be understood as indicating or implying relative importance. For those of ordinary skill in the art, the specific meanings of the above terms in the present application can be understood according to the specific circumstances. In addition, in the description of the present application, unless otherwise specified, "multiple" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the objects associated before and after are in an "or" relationship.

[0024] Currently, operations teams usually identify the cause of failures by manually checking log files, monitoring indicators, and alarm notifications.

[0025] The inventors realize that the current method relies on the professional knowledge and experience of operation and maintenance personnel, which is inefficient. Especially when facing large-scale distributed systems, the cause of the failure cannot be quickly located, thereby reducing the stability of the system.

[0026] In order to solve the above problems, the present application provides a method and device for fault cause analysis in IT operation and maintenance scenarios to solve the problems existing in the above-mentioned related technical problems. In the embodiment of the present application, on the one hand, by converting the operation and maintenance problem to be analyzed into a high-dimensional vector representation, and then calculating the similarity with the entities in the preset dynamic vector knowledge base to identify the most relevant entities, the vectorized objects of these entities and their attributes are used to construct prompt words, which can guide the pre-fine-tuned large language model to conduct in-depth analysis, and quickly locate the cause of the system failure, thereby shortening the fault response time and improving the speed of problem solving; on the other hand, by updating the preset dynamic vector knowledge base and knowledge graph in real time, the data in the knowledge base and knowledge graph can reflect the latest operation and maintenance knowledge at the current moment, ensuring that the fault analysis is based on the latest operation and maintenance data, ensuring the timeliness and accuracy of the fault analysis, and the following uses an exemplary embodiment for detailed description.

[0027] The following will be combined with the attached Figure 1 -Attached Figure 8 , a method for fault cause analysis for IT operation and maintenance scenarios provided in an embodiment of the present application is introduced in detail. The method can be implemented by a computer program and can be run on a fault cause analysis device for IT operation and maintenance scenarios based on the von Neumann system. The computer program can be integrated into an application or run as an independent tool application.

[0028] See also Figure 1 , a flowchart of a method for analyzing the cause of a fault in an IT operation and maintenance scenario is provided for an embodiment of the present application, and is applied to a server. Figure 1 As shown, the method of the embodiment of the present application may include the following steps: S101, receiving a question request sent by a client; wherein the question request carries an operation and maintenance problem to be analyzed for an IT operation and maintenance scenario; In the IT operation and maintenance scenario, the client is an IT operation and maintenance team member or an automated monitoring system. A question request is a request that contains information or questions that need to be processed. In the IT operation and maintenance scenario, question requests involve system failures, performance monitoring, security incidents, etc. Operation and maintenance issues to be analyzed refer to problems encountered during the IT operation and maintenance process that require further analysis. These problems include but are not limited to system crashes, service interruptions, performance bottlenecks, security vulnerabilities, etc.

[0029] In some embodiments, the IT operation and maintenance team discovers through the monitoring system that the response time of the trading system is abnormal, and then initiates a question request through the client, which is submitted to the client. The question request contains the operation and maintenance problem to be analyzed, such as "the response time of the trading system is delayed during the promotional activity." The server receives the question request from the client and obtains the operation and maintenance problem to be analyzed from the question request.

[0030] S102, converting the operation and maintenance problem to be analyzed into a high-dimensional vector representation as a target vector; Among them, high-dimensional vector representation is a method of converting text data into mathematical vectors, which represent the semantic features of the original text in a high-dimensional space. The target vector refers to the high-dimensional vector obtained by converting the operation and maintenance problem to be analyzed. It will be used to search for similar vectors in the vector knowledge base to identify related entities.

[0031] In some embodiments of the present application, the text of the operation and maintenance problem to be analyzed is cleaned to remove irrelevant information, such as emotional language, irrelevant background information, etc. The preprocessed text is converted into a high-dimensional vector representation using an embedding model, such as BERT and Word2Vec. For example, the text "cloud storage service access speed is slow" is converted into a vector containing 768 elements. This 768-dimensional vector is the target vector, which captures the semantic information of the original text and is ready for similarity search in the vector knowledge base.

[0032] For example Figure 2 As shown in the figure, the original problem description recorded by the operation and maintenance personnel or the system can be input to obtain the original operation and maintenance problem description. After the text is preprocessed (such as word segmentation, stop word removal, stem extraction, etc.), the preprocessed text can be obtained. The high-dimensional vector representation after the preprocessed text is converted by the embedding model can obtain the target vector.

[0033] S103, calculating the similarity between the target vector and the vectorized objects of each entity stored in the preset dynamic vector knowledge base, and taking the entity with a similarity greater than a preset similarity threshold as the target entity; Among them, the preset dynamic vector knowledge base stores the vectorized objects of entities. These entities can be components, services, events, etc. in the IT system, and their vectorized objects are high-dimensional vectors obtained after processing by the embedding model. Similarity is an indicator to measure the similarity between two vectors in the vector space. Commonly used similarity calculation methods include cosine similarity, Euclidean distance, etc. The preset similarity threshold is a pre-set value used to determine whether the similarity between two vectors is high enough to be considered similar. Entities with similarity higher than this threshold will be selected as target entities.

[0034] In some embodiments of the present application, the IT operation and maintenance team records a problem: "The response time of the database service suddenly increased", and converts the problem description into a high-dimensional vector representation to obtain a target vector. Calculate the similarity between the target vector and the vectorized objects of each entity stored in the preset dynamic vector knowledge base. Select entities with a similarity greater than a preset similarity threshold as target entities. For example, if the threshold is set to 0.5, all entities with a similarity greater than 0.5 will be selected. Suppose there are several entities in the knowledge base related to database services, such as "missing database index", "network delay", "server CPU overload", etc., and the similarities between their vectorized objects and the target vector are 0.6, 0.45, and 0.55, respectively. According to the similarity calculation results, "missing database index" and "server CPU overload" are selected as target entities because their similarities exceed the preset threshold.

[0035] For example Figure 3 As shown in the figure, the target vector can be obtained by converting the operation and maintenance problem to be analyzed into a high-dimensional vector representation. The numerical value of the vectorized object of each entity stored in the preset dynamic vector knowledge base is the specific value of the entity vectorized object. The similarity between the target vector and each entity vectorized object is calculated and displayed. The similarity can be calculated using the cosine similarity formula.

[0036] S104, querying the target vectorized object and target field attribute corresponding to each target entity from the preset dynamic knowledge graph; wherein the preset dynamic vector knowledge base and the preset dynamic knowledge graph are obtained by updating the initial knowledge graph and the initial vector knowledge base in real time according to the real-time IT operation data, and the initial knowledge graph and the initial vector knowledge base are constructed based on a data set including log information, event information and system configuration information in the IT operation and maintenance scenario; Among them, the preset dynamic knowledge graph is a knowledge graph that is continuously updated based on real-time IT operation data. It is used to store and manage entities and their relationships in the IT system and can reflect the latest operation and maintenance knowledge at the current moment. The target vectorized object refers to the high-dimensional vector representation converted from the operation and maintenance problem to be analyzed, which is used to query relevant information in the knowledge graph. The target field attributes are specific attribute information related to the target entity. These attributes can be the entity's status, configuration, history, etc. The initial knowledge graph and initial vector knowledge base are original knowledge graphs and vector knowledge bases built based on data sets (including log information, event information, and system configuration information) in IT operation and maintenance scenarios. They are the basis of dynamic knowledge graphs and vector knowledge bases.

[0037] In some embodiments of the present application, the target entity is used to query related entities in the preset dynamic knowledge graph, such as "trading system", "database", "network delay", etc. The vectorized objects and field attributes of each target entity are extracted from the query results, such as the CPU usage and memory usage of the "trading system", for example Figure 4 shown.

[0038] In some embodiments of the present application, the specific process of generating a preset dynamic knowledge graph and a preset dynamic vector knowledge base includes: extracting and preprocessing a data set including log information, event information and configuration information in an IT operation and maintenance scenario from a traditional database to obtain a target data set; performing deep semantic analysis on the target data set through a pre-fine-tuned large language model to identify multiple entities and field attributes corresponding to each entity; using an embedding model, converting each entity into a vector representation to obtain a vectorized object corresponding to each entity; constructing a mapping relationship between each entity, the vectorized object corresponding to each entity and the field attribute to obtain multiple mapping pairs; based on multiple mapping pairs, generating an initial knowledge graph, and storing the mapping relationship between each entity and the vectorized object corresponding to each entity to obtain an initial vector knowledge base; dynamically updating the initial knowledge graph and the initial vector knowledge base according to real-time IT operation data to obtain a preset dynamic knowledge graph and a preset dynamic vector knowledge base.

[0039] Among them, traditional database refers to the database system that stores IT operation and maintenance related data, such as relational database or NoSQL database. Field attributes are specific characteristics or properties of entities, such as the IP address of the server, the startup time of the service, etc.

[0040] In some embodiments of the present application, logs, events, and configuration information are extracted from the company's database, cleaned and formatted to obtain a target data set. The target data set is analyzed using a pre-fine-tuned large language model to identify entities (such as "Server A") and field attributes (such as "CPU load"). The identified entities are converted into vector representations using an embedding model. A mapping relationship between entities, vectorized objects, and field attributes is constructed to form a mapping pair. Based on the mapping pair, an initial knowledge graph is generated to display the relationship between entities. The mapping relationship between each entity and its vectorized object is stored to form an initial vector knowledge base. The initial knowledge graph and vector knowledge base are dynamically updated based on real-time IT operation data, such as new system logs and event information, to form a preset dynamic knowledge graph and vector knowledge base.

[0041] Each mapping pair includes an entity, a vectorized object corresponding to the entity, and field attributes.

[0042] In some embodiments of the present application, the specific process of generating an initial knowledge graph based on multiple mapping pairs includes: in the default knowledge graph, creating a node for each entity, and the node includes a unique identifier; analyzing the field attributes between the entities to determine the semantic relationship between the entities; defining the edges between the entities with the semantic relationship, and connecting the nodes through the edges, and mapping the vectorized objects and field attributes corresponding to the entities to the corresponding nodes to obtain the initial knowledge graph.

[0043] In some embodiments of the present application, the specific process of dynamically updating the initial knowledge graph and the initial vector knowledge base based on real-time IT operation data includes: collecting real-time IT operation data within a preset period; cleaning and formatting the real-time IT operation data to obtain system logs, event reports, and system performance indicators; using a pre-fine-tuned large language model to perform deep semantic analysis on system logs, event reports, and system performance indicators to identify a new first entity and its first attribute field; vectorizing the first entity using an embedding model to obtain a first vectorized object; in the initial vector knowledge base, querying the historical vectorized object corresponding to the first entity; when the historical vectorized object corresponding to the first entity is queried, replacing the historical vectorized object corresponding to the first entity with the first vectorized object; or, when the historical vector corresponding to the first entity is not queried, storing the mapping relationship between the first entity and the first vectorized object; constructing a mapping relationship between the first entity and the first vectorized object and the first field attribute to obtain a first mapping pair; based on the first mapping pair, updating the initial knowledge graph to obtain a preset dynamic knowledge graph.

[0044] Among them, real-time IT operation data refers to data collected within a specific period about the operating status of the IT system, including system logs, event reports, and performance indicators. System logs are records generated by IT systems during operation, which are used to monitor system activities and diagnose problems. Event reports are records that describe specific events that occurred in the IT system, such as errors, warnings, or security events. System performance indicators are quantitative data that measure the performance of IT systems, such as CPU utilization, memory usage, network traffic, etc.

[0045] In an embodiment of the present application, by collecting and analyzing real-time IT operation data within a preset period, including system logs, event reports, and performance indicators, a pre-fine-tuned large language model can be used for deep semantic analysis to identify new entities and their attributes. These newly identified entities are converted into vectorized objects through the embedding model, so that they can be compared and analyzed in the vector space. In the initial vector knowledge base, the vectorized objects of these new entities can replace the old vectorized objects, or be stored without the old objects, thereby constructing new mapping pairs. This process not only enriches the vector knowledge base, but also forms a dynamic knowledge graph that reflects the latest IT operation knowledge by updating the initial knowledge graph. Such a dynamic knowledge graph can provide more accurate and timely insights for IT operation and maintenance, helping to quickly locate problems, predict faults, and optimize system performance.

[0046] In some embodiments of the present application, based on the first mapping pair, the initial knowledge graph is updated, and the specific process of obtaining a preset dynamic knowledge graph includes: determining whether the initial knowledge graph contains the identifier of the first entity; if not, creating a first node corresponding to the first entity; determining the semantic relationship between the first entity and each entity in the initial knowledge graph; based on the semantic relationship, determining the insertion position of the first entity in the initial knowledge graph; inserting the first node corresponding to the first entity at the insertion position; mapping the first vectorized object and the first field attribute to the first node to obtain the preset dynamic knowledge graph; if yes, based on the first vectorized object and the first field attribute, updating the historical vectorized object and historical field attribute of the entity to which the identifier of the first entity belongs in the initial knowledge graph.

[0047] The first node is the node created for the new entity in the knowledge graph, representing the existence of the entity in the graph. Semantic relations are the meanings or logical connections between entities, such as "belongs to", "is located in", "leads to", etc. The insertion position is the position in the knowledge graph where the new entity node should be added.

[0048] In an embodiment of the present application, by determining whether an identifier of a newly identified entity already exists in the initial knowledge graph, the system can intelligently decide whether to create a new node or update an existing node. For a new entity, the system determines its semantic relationship with other entities in the knowledge graph, finds a suitable insertion position based on this, and then maps the vectorized object and field attributes of the new entity to the newly created node. If the entity already exists, the system updates its historical vectorized objects and field attributes to reflect the latest information. This method enables the knowledge graph to dynamically reflect the latest changes in the field of IT operations and maintenance, improves the timeliness and accuracy of the knowledge graph, and thus provides a more reliable data foundation for fault diagnosis, system monitoring, and decision support.

[0049] In some embodiments of the present application, the specific process of generating a pre-fine-tuned large language model includes: collecting and pre-processing data related to IT operation and maintenance to obtain sample data, including historical fault cases, log files, system documents, and expert maintenance records; for the sample data, identifying sample entities and sample field attributes; using an embedding model to convert each sample entity into a sample vectorized object; labeling fault problems for the sample field attributes of each sample entity and the sample vectorized object to obtain labeled model fine-tuning samples; obtaining parameters to be fine-tuned from the preset large language model, the parameters to be fine-tuned are some parameters in the preset large language model that are suitable for fault cause analysis; fine-tuning the preset large language model according to the model fine-tuning samples and some parameters to obtain a pre-fine-tuned large language model.

[0050] Among them, sample data refers to data extracted and preprocessed from IT operation and maintenance related data, which is used to train or fine-tune the model. Historical fault cases are records of past fault events, including fault descriptions, causes, solutions, etc. Log files are record files generated during system operation, which are used to monitor and analyze system behavior. System documents are documents that describe system design, architecture, configuration and other information. Expert maintenance records are maintenance processes, problems found and solutions recorded by experts. Sample entities are entities identified in sample data, such as servers, services, software modules, etc. Sample field attributes are specific attributes of sample entities, such as CPU usage, memory size, service status, etc. Sample vectorized objects are vector representations of sample entities after being converted by the embedding model. Annotated model fine-tuning samples are sample data with fault problem annotations, which are used to guide model fine-tuning. The parameters to be fine-tuned are parameters selected from the preset large language model for fine-tuning. The pre-fine-tuned large language model is a fine-tuned large language model specifically used for fault cause analysis.

[0051] In an embodiment of the present application, a comprehensive sample data set can be constructed by collecting and preprocessing data related to IT operation and maintenance, including historical fault cases, log files, system documents, and expert maintenance records. Identifying and labeling sample entities and their field attributes and vectorized objects provides rich training information for model fine-tuning. Using an embedding model to convert entities into vectorized objects enhances the model's understanding of entity semantics. By fine-tuning specific parameters of a preset large language model, the model can more accurately analyze the cause of the fault. This method improves the level of automation of fault diagnosis, reduces reliance on manual analysis, and thus improves the efficiency and accuracy of IT operation and maintenance.

[0052] Specifically, the specific process of fine-tuning the preset large language model according to the model fine-tuning samples and some parameters to obtain the pre-fine-tuned large language model includes: dividing the model fine-tuning samples into a training set and a test set according to a preset division ratio; decomposing the parameters to be fine-tuned to obtain a first decomposition matrix and a second decomposition matrix, the first decomposition matrix includes column parameters of the initial weight matrix in the preset large language model, and the second decomposition matrix includes row parameters of the initial weight matrix in the preset large language model; calculating the forward propagation factor of the model according to each training data in the training set, the first decomposition matrix and the second decomposition matrix; eliminating the model parameters in the original loss function of the preset large language model and replacing them with the first decomposition matrix and the second decomposition matrix to obtain the preset model loss function; calculating the model loss value of the preset large language model according to the forward propagation factor and the preset model loss function; and obtaining the pre-fine-tuned large language model when the model loss value reaches the minimum.

[0053] Specifically, , is the initial weight matrix, For a size of The matrix of Representation Matrix the number of rows, Representation Matrix The number of columns, is a vector in the decomposition, used to control the accuracy of the approximation and the number of parameters, is the first decomposition matrix, is the second decomposition matrix; The default model loss function is:

[0054] in, is at the time step The forward propagation factor of is the original weight matrix, is the bias term, is the activation function, is the time step For each training data in the training set, is the parameter to be fine-tuned, The optimization goal is to maximize the set of parameters The loss value, For each training data, is the label of the training data, is the training data set, Represents the output sequence Length, is the logarithmic probability, To preset the original parameters of the large language model, is the update parameter during decomposition, is the time step Data labels.

[0055] S105, constructing multiple prompt words for guiding the pre-fine-tuned large language model to perform fault cause analysis according to the target vectorized object and the target field attribute; Among them, the prompt word is the input text used to guide the large language model to generate a specific type of output, which can be a question, command or description.

[0056] In some embodiments of the present application, the specific process of constructing multiple prompt words for guiding a pre-fine-tuned large language model to perform fault cause analysis based on target vectorized objects and target field attributes includes: extracting key information from target vectorized objects and target field attributes, the key information including entity name, attribute value, associated event, and time information; constructing multiple basic prompt words that can reflect system logs, historical fault records, and configuration changes over a period of time based on the extracted keywords; optimizing multiple basic prompt words based on preset fault analysis goals and preset guiding language to generate multiple target prompt words with problem orientation; formatting multiple target prompt words into a format suitable for large language model input to obtain multiple prompt words for guiding the pre-fine-tuned large language model to perform fault cause analysis.

[0057] Among them, key information is important data extracted from the target vectorized objects and field attributes, which are used to construct prompt words. The entity name is the name of the entity in the knowledge graph, such as "Server A". The attribute value is the specific attribute value of the entity, such as "CPU usage: 90%". Associated events are events related to the entity, such as "Service interruption". Time information is the time when the event occurred, such as "2024-12-16 14:30". Basic prompt words are preliminary prompt words constructed based on key information to guide model analysis. Target prompt words are optimized prompt words for specific fault analysis, such as Figure 5 Guiding language is the language used to guide model analysis, such as "analyze the reasons".

[0058] In some embodiments of the present application, key information is extracted, such as "database server B", "CPU usage: 95%", "service interruption", "2024-12-16 14:30". Based on the extracted key information, basic prompt words are constructed, such as "database server B CPU usage 95% service interruption". According to the objectives and guiding language of the fault analysis, the basic prompt words are optimized to generate target prompt words, such as "analyze the cause of the service interruption caused by the 95% CPU usage of database server B at 2024-12-16 14:30". The target prompt words are formatted into a format suitable for large language model input, such as "[Analysis of causes] Database server B CPU usage is abnormally high: 95% Time: 2024-12-16 14:30".

[0059] S106, inputting multiple prompt words into a pre-fine-tuned large language model, outputting the fault cause corresponding to the operation and maintenance problem, and sending it to the client.

[0060] In some embodiments, the formatted prompt word is input into a pre-adjusted large language model. The large language model analyzes the prompt word and outputs possible fault causes, such as "the abnormally high CPU usage of database server B may be caused by unoptimized queries", which is finally sent to the client. The client displays content such as Figure 6 shown.

[0061] For example Figure 7 As shown in the figure, the user enters the query through the FastGPT interface, the process controller receives the user query and performs preprocessing, including noise removal and formatting. The preprocessed query is converted into a vector representation through OpenAI Embedding or M3E (Massive Multitask Embedding). The vectorized query is used to perform similarity search in the vector knowledge base to find the most relevant entities. According to the results of the vector similarity search, the relevant knowledge base entries are retrieved from the knowledge graph. The retrieved knowledge base entries are sent to the language model for further processing, and the fault cause corresponding to the operation and maintenance problem is output. During the knowledge base training process, the content is split into QA, the questions and answers are separated, and the text is segmented. Finally, the processed content is fused and vectorized to obtain the vector knowledge base.

[0062] In an embodiment of the present application, on the one hand, the operation and maintenance problem to be analyzed is converted into a high-dimensional vector representation, and then similarity is calculated with the entities in a preset dynamic vector knowledge base to identify the most relevant entities. The vectorized objects and their attributes of these entities are used to construct prompt words, which can guide the pre-fine-tuned large language model to perform in-depth analysis and quickly locate the cause of the system failure, thereby shortening the fault response time and improving the speed of problem solving; on the other hand, the preset dynamic vector knowledge base and knowledge graph are updated in real time, so that the data in the knowledge base and the knowledge graph can reflect the latest operation and maintenance knowledge at the current moment, ensuring that the fault analysis is based on the latest operation and maintenance data, and ensuring the timeliness and accuracy of the fault analysis.

[0063] See also Figure 8 , which is a flowchart of a personalized travel demand identification model training method provided in an embodiment of the present application. Figure 8 As shown, the method of the embodiment of the present application may include the following steps: S201, collect and pre-process data related to IT operation and maintenance to obtain sample data, including historical failure cases, log files, system documents, and expert maintenance records; S202, identifying sample entities and sample field attributes for the sample data; S203, using the embedding model to convert each sample entity into a sample vectorized object; S204, labeling fault problems of sample field attributes and sample vectorized objects of each sample entity to obtain labeled model fine-tuning samples; S205, obtaining parameters to be fine-tuned from the preset large language model, where the parameters to be fine-tuned are some parameters in the preset large language model that are suitable for fault cause analysis; S206, fine-tuning the preset large language model according to the model fine-tuning samples and some parameters to obtain a pre-fine-tuned large language model.

[0064] In an embodiment of the present application, on the one hand, the operation and maintenance problem to be analyzed is converted into a high-dimensional vector representation, and then similarity is calculated with the entities in a preset dynamic vector knowledge base to identify the most relevant entities. The vectorized objects and their attributes of these entities are used to construct prompt words, which can guide the pre-fine-tuned large language model to perform in-depth analysis and quickly locate the cause of the system failure, thereby shortening the fault response time and improving the speed of problem solving; on the other hand, the preset dynamic vector knowledge base and knowledge graph are updated in real time, so that the data in the knowledge base and the knowledge graph can reflect the latest operation and maintenance knowledge at the current moment, ensuring that the fault analysis is based on the latest operation and maintenance data, and ensuring the timeliness and accuracy of the fault analysis.

[0065] The following are device embodiments of the present application, which can be used to execute the method embodiments of the present application. For details not disclosed in the device embodiments of the present application, please refer to the method embodiments of the present application.

[0066] See also Fig. 9 , which shows a schematic diagram of the structure of a fault cause analysis device for IT operation and maintenance scenarios provided by an exemplary embodiment of the present application. The fault cause analysis device for IT operation and maintenance scenarios can be implemented as all or part of an electronic device through software, hardware, or a combination of both. The device 1 includes a receiving module 10, a conversion module 20, a calculation module 30, a query module 40, a construction module 50, and an output module 60.

[0067] The receiving module 10 is used to receive a question request sent by a client; wherein the question request carries an operation and maintenance problem to be analyzed for an IT operation and maintenance scenario; A conversion module 20, used to convert the operation and maintenance problem to be analyzed into a high-dimensional vector representation as a target vector; A calculation module 30, used to calculate the similarity between the target vector and the vectorized objects of each entity stored in a preset dynamic vector knowledge base, and take the entity with a similarity greater than a preset similarity threshold as the target entity; A query module 40 is used to query the target vectorized object and target field attribute corresponding to each target entity from the preset dynamic knowledge graph; wherein the preset dynamic vector knowledge base and the preset dynamic knowledge graph are obtained by updating the initial knowledge graph and the initial vector knowledge base in real time according to the real-time IT operation data, and the initial knowledge graph and the initial vector knowledge base are constructed based on a data set including log information, event information and system configuration information in the IT operation and maintenance scenario; A construction module 50 is used to construct a plurality of prompt words for guiding the pre-fine-tuned large language model to perform fault cause analysis according to the target vectorized object and the target field attribute; The output module 60 is used to input multiple prompt words into a pre-fine-tuned large language model, output the fault cause corresponding to the operation and maintenance problem, and send it to the client.

[0068] It should be noted that the fault cause analysis device for IT operation and maintenance scenarios provided in the above embodiments only uses the division of the above functional modules as an example when executing the fault cause analysis method for IT operation and maintenance scenarios. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the fault cause analysis device for IT operation and maintenance scenarios provided in the above embodiments and the fault cause analysis method embodiment for IT operation and maintenance scenarios belong to the same concept. The implementation process is detailed in the method embodiment and will not be repeated here.

[0069] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0070] In an embodiment of the present application, on the one hand, the operation and maintenance problem to be analyzed is converted into a high-dimensional vector representation, and then similarity is calculated with the entities in a preset dynamic vector knowledge base to identify the most relevant entities. The vectorized objects and their attributes of these entities are used to construct prompt words, which can guide the pre-fine-tuned large language model to perform in-depth analysis and quickly locate the cause of the system failure, thereby shortening the fault response time and improving the speed of problem solving; on the other hand, the preset dynamic vector knowledge base and knowledge graph are updated in real time, so that the data in the knowledge base and the knowledge graph can reflect the latest operation and maintenance knowledge at the current moment, ensuring that the fault analysis is based on the latest operation and maintenance data, and ensuring the timeliness and accuracy of the fault analysis.

[0071] The present application also provides a computer-readable medium having program instructions stored thereon, which, when executed by a processor, implements the fault cause analysis method for IT operation and maintenance scenarios provided by the above-mentioned various method embodiments.

[0072] The present application also provides a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute the fault cause analysis method for IT operation and maintenance scenarios of the above-mentioned various method embodiments.

[0073] See also Fig.10 , is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Fig.10 As shown, the electronic device 1000 may include: at least one processor 1001 , at least one network interface 1004 , a user interface 1003 , a memory 1005 , and at least one communication bus 1002 .

[0074] The communication bus 1002 is used to realize the connection and communication between these components.

[0075] The user interface 1003 may include a display screen (Display) and a camera (Camera). Optionally, the user interface 1003 may also include a standard wired interface and a wireless interface.

[0076] The network interface 1004 may optionally include a standard wired interface or a wireless interface (such as a WI-FI interface).

[0077] Among them, the processor 1001 may include one or more processing cores. The processor 1001 uses various interfaces and lines to connect various parts of the entire electronic device 1000, and executes various functions and processes data of the electronic device 1000 by running or executing instructions, programs, code sets or instruction sets stored in the memory 1005, and calling data stored in the memory 1005. Optionally, the processor 1001 can be implemented in at least one hardware form of digital signal processing (Digital Signal Processing, DSP), field programmable gate array (Field-Programmable Gate Array, FPGA), and programmable logic array (Programmable Logic Array, PLA). The processor 1001 can integrate one or a combination of a central processing unit (Central Processing Unit, CPU), a graphics processing unit (Graphics Processing Unit, GPU) and a modem. Among them, the CPU mainly processes the operating system, user interface and application programs; the GPU is responsible for rendering and drawing the content to be displayed on the display screen; the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor 1001, and it can be implemented separately through a chip.

[0078] Among them, the memory 1005 may include a random access memory (Random Access Memory, RAM) and may also include a read-only memory (Read-Only Memory). Optionally, the memory 1005 includes a non-transitory computer-readable storage medium. The memory 1005 can be used to store instructions, programs, codes, code sets or instruction sets. The memory 1005 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the above-mentioned various method embodiments, etc.; the data storage area may store data involved in the above-mentioned various method embodiments, etc. The memory 1005 may also be optionally at least one storage system located away from the aforementioned processor 1001. As Fig.10 As shown, the memory 1005 as a computer storage medium may include an operating system, a network communication module, a user interface module, and a fault cause analysis application for IT operation and maintenance scenarios.

[0079] exist Fig.10In the electronic device 1000 shown, the user interface 1003 is mainly used to provide an input interface for the user and obtain data input by the user; and the processor 1001 can be used to call the fault cause analysis application for IT operation and maintenance scenarios stored in the memory 1005, and specifically perform the following operations: Receive a question request sent by a client; wherein the question request carries an operation and maintenance problem to be analyzed for an IT operation and maintenance scenario; Convert the operation and maintenance problem to be analyzed into a high-dimensional vector representation as the target vector; Calculate the similarity between the target vector and the vectorized objects of each entity stored in the preset dynamic vector knowledge base, and take the entity with a similarity greater than a preset similarity threshold as the target entity; From the preset dynamic knowledge graph, query the target vectorized object and target field attribute corresponding to each target entity; wherein the preset dynamic vector knowledge base and the preset dynamic knowledge graph are obtained by real-time updating of the initial knowledge graph and the initial vector knowledge base according to the real-time IT operation data, and the initial knowledge graph and the initial vector knowledge base are constructed based on the data set including log information, event information and system configuration information in the IT operation and maintenance scenario; According to the target vectorized object and the target field attributes, multiple prompt words are constructed to guide the pre-fine-tuned large language model to perform fault cause analysis; Multiple prompt words are input into a pre-fine-tuned large language model, and the fault cause corresponding to the operation and maintenance problem is output and sent to the client.

[0080] In one embodiment, when the processor 1001 generates a preset dynamic knowledge graph and a preset dynamic vector knowledge base, the processor 1001 specifically performs the following operations: Extract and preprocess data sets including log information, event information, and configuration information in IT operation and maintenance scenarios from traditional databases to obtain target data sets; Through the pre-fine-tuned large language model, deep semantic analysis is performed on the target dataset to identify multiple entities and the field attributes corresponding to each entity; Using the embedding model, each entity is converted into a vector representation to obtain the vectorized object corresponding to each entity; Construct a mapping relationship between each entity, the vectorized object corresponding to each entity and the field attribute to obtain multiple mapping pairs; Based on multiple mapping pairs, an initial knowledge graph is generated, and the mapping relationship between each entity and the vectorized object corresponding to each entity is stored to obtain an initial vector knowledge base; According to the real-time IT operation data, the initial knowledge graph and the initial vector knowledge base are dynamically updated to obtain the preset dynamic knowledge graph and the preset dynamic vector knowledge base.

[0081] In one embodiment, when the processor 1001 generates an initial knowledge graph based on multiple mapping pairs, the processor 1001 specifically performs the following operations: In the default knowledge graph, a node is created for each entity, and the node includes a unique identifier; Analyze the field attributes between entities and determine the semantic relationship between entities; Define the semantic relationships as edges between entities, connect the nodes through edges, and map the vectorized objects and field attributes corresponding to the entities to the corresponding nodes to obtain the initial knowledge graph.

[0082] In one embodiment, when the processor 1001 dynamically updates the initial knowledge graph and the initial vector knowledge base according to the real-time IT operation data, the processor 1001 specifically performs the following operations: Collect real-time IT operation data within a preset period; Clean and format real-time IT operation data to obtain system logs, event reports, and system performance indicators; Use a pre-fine-tuned large language model to perform deep semantic analysis on system logs, event reports, and system performance indicators to identify new first entities and their first attribute fields; Vectorize the first entity using the embedding model to obtain a first vectorized object; In the initial vector knowledge base, query the historical vectorized object corresponding to the first entity; When the historical vectorized object corresponding to the first entity is found, the historical vectorized object corresponding to the first entity is replaced with the first vectorized object; or, when the historical vector corresponding to the first entity is not found, the mapping relationship between the first entity and the first vectorized object is stored; Constructing a mapping relationship between the first entity and the first vectorized object and the first field attribute to obtain a first mapping pair; Based on the first mapping pair, the initial knowledge graph is updated to obtain a preset dynamic knowledge graph.

[0083] In one embodiment, when the processor 1001 updates the initial knowledge graph based on the first mapping pair to obtain a preset dynamic knowledge graph, the processor 1001 specifically performs the following operations: Determine whether the initial knowledge graph contains an identifier of the first entity; If not, create a first node corresponding to the first entity; determine the semantic relationship between the first entity and each entity in the initial knowledge graph; based on the semantic relationship, determine the insertion position of the first entity in the initial knowledge graph; insert the first node corresponding to the first entity at the insertion position; map the first vectorized object and the first field attribute to the first node to obtain a preset dynamic knowledge graph; If so, based on the first vectorized object and the first field attribute, the historical vectorized objects and historical field attributes of the entity to which the identifier of the first entity belongs in the initial knowledge graph are updated.

[0084] In one embodiment, when the processor 1001 generates a pre-fine-tuned large language model, the processor 1001 specifically performs the following operations: Collect and pre-process IT operation and maintenance related data to obtain sample data, including historical failure cases, log files, system documents, and expert maintenance records; For sample data, identify sample entities and sample field attributes; Use the embedding model to convert each sample entity into a sample vectorized object; Label the sample field attributes of each sample entity and the sample vectorized object for faults, and obtain labeled model fine-tuning samples; Obtaining parameters to be fine-tuned from a preset large language model, where the parameters to be fine-tuned are some parameters in the preset large language model that are suitable for fault cause analysis; Fine-tune the preset large language model according to the model fine-tuning samples and some parameters to obtain the pre-fine-tuned large language model.

[0085] In one embodiment, when the processor 1001 fine-tunes the preset large language model according to the model fine-tuning samples and some parameters to obtain the pre-fine-tuned large language model, the processor 1001 specifically performs the following operations: Divide the model fine-tuning samples into training sets and test sets according to the preset division ratio; Decomposing the parameters to be fine-tuned to obtain a first decomposition matrix and a second decomposition matrix, wherein the first decomposition matrix includes column parameters of an initial weight matrix in a preset large language model, and the second decomposition matrix includes row parameters of the initial weight matrix in the preset large language model; Calculate the forward propagation factor of the model according to each training data in the training set, the first decomposition matrix and the second decomposition matrix; The model parameters in the original loss function of the preset large language model are removed and replaced with the first decomposition matrix and the second decomposition matrix to obtain the preset model loss function; Calculate the model loss value of the preset large language model according to the forward propagation factor and the preset model loss function; When the model loss value reaches the minimum, the pre-fine-tuned large language model is obtained.

[0086] In one embodiment, when the processor 1001 constructs multiple prompt words for guiding the pre-fine-tuned large language model to perform fault cause analysis according to the target vectorized object and the target field attribute, the processor 1001 specifically performs the following operations: Extract key information from the target vectorized object and target field attributes, including entity name, attribute value, associated event, and time information; Based on the extracted keywords, multiple basic prompt words are constructed to reflect system logs, historical fault records, and configuration changes within a period of time. According to the preset fault analysis goals and preset guiding language, multiple basic prompt words are optimized to generate multiple target prompt words with problem orientation; The multiple target prompt words are formatted into a format suitable for input to the large language model, so as to obtain the multiple prompt words used to guide the pre-fine-tuned large language model to perform fault cause analysis.

[0087] In an embodiment of the present application, on the one hand, the operation and maintenance problem to be analyzed is converted into a high-dimensional vector representation, and then similarity is calculated with the entities in a preset dynamic vector knowledge base to identify the most relevant entities. The vectorized objects and their attributes of these entities are used to construct prompt words, which can guide the pre-fine-tuned large language model to perform in-depth analysis and quickly locate the cause of the system failure, thereby shortening the fault response time and improving the speed of problem solving; on the other hand, the preset dynamic vector knowledge base and knowledge graph are updated in real time, so that the data in the knowledge base and the knowledge graph can reflect the latest operation and maintenance knowledge at the current moment, ensuring that the fault analysis is based on the latest operation and maintenance data, and ensuring the timeliness and accuracy of the fault analysis.

[0088] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing related hardware through a computer program, and the program for fault cause analysis in IT operation and maintenance scenarios can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, the storage medium of the program for fault cause analysis in IT operation and maintenance scenarios can be a disk, an optical disk, a read-only storage memory, or a random access memory, etc.

[0089] The above disclosure is only the preferred embodiment of the present application, which certainly cannot be used to limit the scope of rights of the present application. Therefore, equivalent changes made according to the claims of the present application are still within the scope covered by the present application.

Claims

1. A method for analyzing the cause of a fault in an IT operation and maintenance scenario, characterized in that: Applied to the server, the method includes: Receive a question request sent by a client; wherein the question request carries an operation and maintenance problem to be analyzed for an IT operation and maintenance scenario; Convert the operation and maintenance problem to be analyzed into a high-dimensional vector representation as a target vector; Calculating the similarity between the target vector and the vectorized objects of each entity stored in a preset dynamic vector knowledge base, and taking the entity with a similarity greater than a preset similarity threshold as the target entity; From the preset dynamic knowledge graph, query the target vectorized object and target field attribute corresponding to each target entity; wherein the preset dynamic vector knowledge base and the preset dynamic knowledge graph are obtained by real-time updating of the initial knowledge graph and the initial vector knowledge base according to the real-time IT operation data, and the initial knowledge graph and the initial vector knowledge base are constructed based on the data set including log information, event information and system configuration information in the IT operation and maintenance scenario; Constructing, according to the target vectorized object and the target field attribute, a plurality of prompt words for guiding the pre-fine-tuned large language model to perform fault cause analysis; The multiple prompt words are input into a pre-fine-tuned large language model, and the fault cause corresponding to the operation and maintenance problem is output and sent to the client.

2. The method according to claim 1, characterized in that The following steps are followed to generate a preset dynamic knowledge graph and a preset dynamic vector knowledge base, including: Extract and preprocess data sets including log information, event information, and configuration information in IT operation and maintenance scenarios from traditional databases to obtain target data sets; Performing deep semantic analysis on the target dataset by using a pre-fine-tuned large language model to identify multiple entities and field attributes corresponding to each entity; Using the embedding model, each entity is converted into a vector representation to obtain a vectorized object corresponding to each entity; Constructing a mapping relationship between each entity, the vectorized object corresponding to each entity and the field attribute to obtain a plurality of mapping pairs; Based on the multiple mapping pairs, an initial knowledge graph is generated, and a mapping relationship between each entity and the vectorized object corresponding to each entity is stored to obtain an initial vector knowledge base; According to the real-time IT operation data, the initial knowledge graph and the initial vector knowledge base are dynamically updated to obtain a preset dynamic knowledge graph and a preset dynamic vector knowledge base.

3. The method according to claim 2, characterized in that Each mapping pair includes an entity, a vectorized object corresponding to the entity, and field attributes; The initial knowledge graph is generated based on multiple mapping pairs, including: In a default knowledge graph, a node is created for each entity, the node including a unique identifier; Analyze the field attributes between entities and determine the semantic relationship between entities; The semantic relationship is defined as the edges between the entities, and the nodes are connected through the edges, and the vectorized objects and field attributes corresponding to the entities are mapped to the corresponding nodes to obtain an initial knowledge graph.

4. The method according to claim 2, characterized in that: The dynamically updating the initial knowledge graph and the initial vector knowledge base according to the real-time IT operation data includes: Collect real-time IT operation data within a preset period; Cleaning and formatting the real-time IT operation data to obtain system logs, event reports, and system performance indicators; Using a pre-fine-tuned large language model, deep semantic analysis is performed on the system log, event report, and system performance indicator to identify a new first entity and its first attribute field; Vectorize the first entity using an embedding model to obtain a first vectorized object; In the initial vector knowledge base, query the historical vectorized object corresponding to the first entity; When the historical vectorized object corresponding to the first entity is found, the historical vectorized object corresponding to the first entity is replaced with the first vectorized object; or, when the historical vector corresponding to the first entity is not found, the mapping relationship between the first entity and the first vectorized object is stored; Constructing a mapping relationship between the first entity and the first vectorized object and the first field attribute to obtain a first mapping pair; Based on the first mapping pair, the initial knowledge graph is updated to obtain a preset dynamic knowledge graph.

5. The method according to claim 4, characterized in that The updating of the initial knowledge graph based on the first mapping pair to obtain a preset dynamic knowledge graph includes: Determining whether the initial knowledge graph contains an identifier of the first entity; If not, create a first node corresponding to the first entity; determine the semantic relationship between the first entity and each entity in the initial knowledge graph; based on the semantic relationship, determine the insertion position of the first entity in the initial knowledge graph; insert the first node corresponding to the first entity at the insertion position; map the first vectorized object and the first field attribute to the first node to obtain a preset dynamic knowledge graph; If so, based on the first vectorized object and the first field attribute, the historical vectorized objects and historical field attributes of the entity to which the identifier of the first entity belongs in the initial knowledge graph are updated.

6. The method according to claim 1, characterized in that Follow these steps to generate a pre-fine-tuned large language model, including: Collect and pre-process IT operation and maintenance related data to obtain sample data, including historical failure cases, log files, system documents, and expert maintenance records; For the sample data, identifying sample entities and sample field attributes; Use the embedding model to convert each sample entity into a sample vectorized object; Label the sample field attributes of each sample entity and the sample vectorized object for faults, and obtain labeled model fine-tuning samples; Obtaining parameters to be fine-tuned from a preset large language model, where the parameters to be fine-tuned are some parameters in the preset large language model that are suitable for fault cause analysis; The preset large language model is fine-tuned according to the model fine-tuning sample and the partial parameters to obtain a pre-fine-tuned large language model.

7. The method according to claim 6, characterized in that The step of fine-tuning a preset large language model according to the model fine-tuning sample and the partial parameters to obtain a pre-fine-tuned large language model includes: Dividing the model fine-tuning samples into a training set and a test set according to a preset division ratio; Decomposing the parameters to be fine-tuned to obtain a first decomposition matrix and a second decomposition matrix, wherein the first decomposition matrix includes column parameters of an initial weight matrix in a preset large language model, and the second decomposition matrix includes row parameters of the initial weight matrix in the preset large language model; Calculate the forward propagation factor of the model according to each training data in the training set, the first decomposition matrix and the second decomposition matrix; Eliminate the model parameters in the original loss function of the preset large language model and replace them with the first decomposition matrix and the second decomposition matrix to obtain a preset model loss function; Calculating a model loss value of a preset large language model according to the forward propagation factor and a preset model loss function; When the model loss value reaches the minimum, a pre-fine-tuned large language model is obtained.

8. The method according to claim 7, characterized in that , is the initial weight matrix, For a size of The matrix of Representation Matrix the number of rows, Representation Matrix The number of columns, is a vector in the decomposition, used to control the accuracy of the approximation and the number of parameters, is the first decomposition matrix, is the second decomposition matrix; The preset model loss function is: in, is at the time step The forward propagation factor of is the original weight matrix, is the bias term, is the activation function, is the time step For each training data in the training set, is the parameter to be fine-tuned, The optimization goal is to maximize the set of parameters The loss value, For each training data, is the label of the training data, is the training data set, Represents the output sequence Length, is the logarithmic probability, To preset the original parameters of the large language model, is the update parameter during decomposition, is the time step Data labels.

9. The method according to claim 1, characterized in that: The step of constructing a plurality of prompt words for guiding the pre-fine-tuned large language model to perform fault cause analysis according to the target vectorized object and the target field attribute includes: Extract key information from the target vectorized object and target field attributes, the key information including entity name, attribute value, associated event, and time information; Based on the extracted keywords, multiple basic prompt words are constructed to reflect system logs, historical fault records, and configuration changes within a period of time. According to the preset fault analysis objectives and the preset guiding language, the multiple basic prompt words are optimized to generate multiple target prompt words with problem orientation; The multiple target prompt words are formatted into a format suitable for input to a large language model, so as to obtain multiple prompt words for guiding the pre-fine-tuned large language model to perform fault cause analysis.

10. A fault cause analysis device for IT operation and maintenance scenarios, characterized in that: The device comprises: A receiving module, configured to receive a question request sent by a client; wherein the question request carries an operation and maintenance problem to be analyzed for an IT operation and maintenance scenario; A conversion module, used to convert the operation and maintenance problem to be analyzed into a high-dimensional vector representation as a target vector; A calculation module, used to calculate the similarity between the target vector and the vectorized objects of each entity stored in a preset dynamic vector knowledge base, and take the entity with a similarity greater than a preset similarity threshold as the target entity; A query module is used to query the target vectorized object and target field attribute corresponding to each target entity from the preset dynamic knowledge graph; wherein the preset dynamic vector knowledge base and the preset dynamic knowledge graph are obtained by updating the initial knowledge graph and the initial vector knowledge base in real time according to the real-time IT operation data, and the initial knowledge graph and the initial vector knowledge base are constructed based on a data set including log information, event information and system configuration information in the IT operation and maintenance scenario; A construction module, used to construct a plurality of prompt words for guiding a pre-fine-tuned large language model to perform fault cause analysis according to the target vectorized object and the target field attribute; The output module is used to input the multiple prompt words into a pre-fine-tuned large language model, output the fault cause corresponding to the operation and maintenance problem, and send it to the client.

Images