Alarm disposal auxiliary method and device, equipment, storage medium and product

Abstract

The invention discloses an alarm processing auxiliary method and device, equipment, a storage medium and a product, and relates to the technical field of artificial intelligence, a set of alarm knowledge database is constructed in advance according to data of alarm processing manuals of different manufacturers, so that alarm information is automatically retrieved aiming at an alarm event of the equipment, and the alarm processing efficiency is improved. The corresponding operation and maintenance knowledge (namely the target alarm processing knowledge block) is obtained through matching, so that the operation and maintenance knowledge serves as background knowledge, a large language model is guided to generate more accurate alarm processing reference information for reference of operation and maintenance personnel, experience dependence of front-line operation and maintenance experts is reduced, and alarm processing efficiency and accuracy are improved.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence technology, and in particular to an alarm handling auxiliary method, device, equipment, storage medium and product. Background Art

[0002] In the internal enterprise environment, with the continuous development of digitalization, the scale of business systems continues to expand, and the number of managed devices continues to grow, which directly leads to a surge in the types and number of alarms, greatly increasing the difficulty of alarm investigation and handling for operation and maintenance personnel, and affecting system fault recovery.

[0003] Currently, many network and storage equipment manufacturers may have relatively comprehensive alarm systems and can produce comprehensive alarm manuals to guide operations and maintenance personnel in alarm handling. However, actual business scenarios may involve the operation and maintenance of different manufacturers and equipment, which greatly increases the difficulty of alarm handling, prolongs the troubleshooting window, and increases human resource costs.

[0004] Therefore, how to improve the efficiency and accuracy of alarm processing is an urgent problem to be solved. Summary of the Invention

[0005] The main purpose of this application is to provide an alarm handling auxiliary method, device, equipment, storage medium and product, aiming to solve the technical problem of improving the efficiency and accuracy of alarm processing.

[0006] To achieve the above objectives, the present application proposes an auxiliary method for alarm handling, which includes: Get alarm information; Retrieving at least one target alarm handling knowledge block from an alarm knowledge database, wherein a correlation between the target alarm handling knowledge block and the alarm information satisfies a first set condition, the alarm knowledge database includes a plurality of alarm handling knowledge blocks, and the alarm handling knowledge blocks are obtained based on a manufacturer's alarm handling manual; The target alarm handling knowledge block is used as background knowledge and a preset general large language model is used to generate alarm handling reference information corresponding to the alarm information.

[0007] In some embodiments, retrieving at least one target alarm handling knowledge block from the alarm knowledge database includes: Generate a warning word embedding vector corresponding to the warning information; In an index database of the alarm knowledge database, at least one target index is retrieved according to the alarm word embedding vector; the index database includes titles corresponding to various alarm events in the original alarm file; In the alarm knowledge database, the alarm handling knowledge block associated with the target index is used as the target alarm handling knowledge block.

[0008] In some embodiments, before searching the alarm knowledge database for a plurality of target alarm knowledge blocks whose relevance to the alarm information satisfies a first set condition, the method further includes: Extracting alarm knowledge corresponding to various alarm events from the manufacturer's alarm handling manual, wherein the alarm knowledge includes the title, alarm description, system impact, alarm cause, and alarm handling process corresponding to the alarm event; Generating a knowledge summary corresponding to the alarm knowledge; For the alarm knowledge, a corresponding alarm handling knowledge block is generated based on the title, source file and knowledge block summary after word embedding.

[0009] In some embodiments, the target alarm handling knowledge block is used as background knowledge, and the alarm handling reference information corresponding to the alarm information is generated by a preset general language model, including: For each target alarm handling knowledge block, generate prior alarm handling information based on the corresponding word-embedded title and the corresponding knowledge block summary; splicing the priori alarm handling information and the alarm information based on a set template to generate a prompt word; The prompt word is input into a preset large language model to obtain alarm handling reference information corresponding to the alarm information.

[0010] In some embodiments, the method further comprises: Determining the target network element to which the alarm information belongs from a preset network element topology map; wherein the preset network element topology map includes connection relationships of multiple network elements; Determining adjacent network elements of the target network element from a preset network element topology map; Determining a correlation between the alarm information and an associated alarm event of the adjacent network element; When the correlation degree satisfies a second set condition, related alarm information corresponding to the alarm information is generated based on the associated alarm event.

[0011] In some embodiments, the preset network element topology map further includes the services corresponding to each network element and the association relationship between services of adjacent network elements; The method further comprises: Based on the preset network element topology map, obtaining a first service corresponding to the target network element to which the alarm information belongs; Based on the preset network element topology map, obtaining a second service associated with the first service; Based on the current network element, the first service, the second service, and the network element device where the second service is located, an alarm impact range is output.

[0012] In addition, to achieve the above-mentioned purpose, the present application also proposes an alarm handling auxiliary device, which includes: Alarm acquisition module, used to obtain alarm information; a data retrieval module, configured to retrieve at least one target alarm handling knowledge block from an alarm knowledge database, wherein a correlation between the target alarm handling knowledge block and the alarm information satisfies a first set condition, the alarm knowledge database including a plurality of alarm handling knowledge blocks, and the alarm handling knowledge blocks being obtained based on a manufacturer's alarm handling manual; The information generation module is used to use the target alarm handling knowledge block as background knowledge and generate alarm handling reference information corresponding to the alarm information through a preset general large language model.

[0013] In addition, to achieve the above-mentioned purpose, the present application also proposes an alarm handling auxiliary device, which includes: a memory, a processor, and a computer program stored in the memory and runnable on the processor, wherein the computer program is configured to implement the steps of the alarm handling auxiliary method as described above.

[0014] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable storage medium. A computer program is stored on the storage medium. When the computer program is executed by the processor, the steps of the alarm handling auxiliary method described above are implemented.

[0015] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the steps of the alarm handling auxiliary method as described above are implemented.

[0016] One or more technical solutions proposed in this application have at least the following technical effects: Based on data from alarm handling manuals of different manufacturers, an alarm knowledge database was constructed. When an alarm event occurs on a device, alarm information is automatically retrieved and matched to the corresponding operation and maintenance knowledge (i.e., the target alarm handling knowledge block). This operation and maintenance knowledge is used as background knowledge to guide the large language model to generate more accurate alarm handling reference information for operation and maintenance personnel to refer to, reducing reliance on the experience of front-line operation and maintenance experts and improving the efficiency and accuracy of alarm processing. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0018] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0019] Figure 1 A flowchart of an auxiliary method for handling alarms provided in one embodiment of the present application is shown; Figure 2 A flowchart of an auxiliary method for alarm handling provided by another embodiment of the present application is shown; Figure 3 A flowchart of an auxiliary method for handling alarms provided in another embodiment of the present application is shown; Figure 4 A topology diagram of a preset network element provided by an exemplary embodiment of the present application is shown; Figure 5 A flowchart of an auxiliary method for handling alarms provided in another embodiment of the present application is shown; Figure 6 A topology diagram of a preset network element provided by another exemplary embodiment of the present application is shown; Figure 7 A schematic diagram of the structure of an alarm handling auxiliary device provided in an embodiment of the present application is shown; Figure 8 A schematic diagram of the structure of the alarm handling auxiliary equipment provided in an embodiment of the present application is shown.

[0020] The purpose, features and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0021] It should be understood that the specific embodiments described herein are merely used to explain the technical solutions of the present application and are not intended to limit the present application.

[0022] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0023] The main solution of the embodiment of the present application is: obtaining alarm information; retrieving at least one target alarm handling knowledge block from an alarm knowledge database, wherein the correlation between the target alarm handling knowledge block and the alarm information satisfies a first set condition, and the alarm knowledge database includes multiple alarm handling knowledge blocks, and the alarm handling knowledge blocks are obtained based on the manufacturer's alarm handling manual; using the target alarm handling knowledge block as background knowledge, through a preset general large language model, generating alarm handling reference information corresponding to the alarm information.

[0024] In related technologies, in recent years, while online business has flourished, people's requirements for system stability have also been continuously increasing. The impact of a service failure is huge, and failure is inevitable, so fault recovery capabilities and system fault tolerance elasticity are particularly important.

[0025] Currently, many network and storage equipment manufacturers may have relatively comprehensive alarm systems and can produce comprehensive alarm manuals to guide operations and maintenance personnel in alarm handling. However, actual business scenarios may involve the operation and maintenance of different manufacturers and equipment, which greatly increases the difficulty of alarm handling and extends the window for troubleshooting.

[0026] However, the implementation method based on label classification and rule matching relies on manually defined rules and is difficult to cover complex and diverse alarms; the method of generating alarm handling solutions based on training large language models based on large-scale private domain data has high requirements for data and resources.

[0027] In summary, how to improve the efficiency and accuracy of alarm processing is an urgent problem that needs to be solved.

[0028] Based on this, this application provides a solution that significantly improves the efficiency and accuracy of alarm processing and reduces the reliance on the experience of front-line operation and maintenance experts.

[0029] It should be noted that the execution subject of this embodiment can be a computing service device with data processing, network communication, and program execution functions, such as a tablet computer, personal computer, mobile phone, etc., or an alarm handling auxiliary device capable of performing the above functions. The following uses alarm handling assistance as an example to illustrate this embodiment and the following embodiments.

[0030] Reference Figure 1 , Figure 1 The alarm handling assistance method provided by an embodiment of the present application is shown. The alarm handling assistance method can be applied to an alarm handling assistance device, and includes the following steps S110 to S130: Step S110: Obtain alarm information.

[0031] Alarm information refers to the signal generated when a service device fails and the cloud platform detects the failure, generating an alarm for the failure. When the cloud platform monitors service devices and a failure occurs, it can combine information such as the fault name, the model, manufacturer, and network element type of the relevant service device to generate the alarm information described in the embodiments of this application.

[0032] Step S120: Retrieve at least one target alarm handling knowledge block from the alarm knowledge database.

[0033] The correlation between the target alarm handling knowledge block and the alarm information satisfies a first set condition, the alarm knowledge database includes a plurality of alarm handling knowledge blocks, and the alarm handling knowledge blocks are obtained based on the manufacturer's alarm handling manual.

[0034] Specifically, the alarm knowledge database contains detailed information about alarm events recorded in the manufacturer's alarm handling manual. Based on the alarm knowledge database, detailed descriptions of alarm events related to the current alarm event (i.e., alarm information) can be retrieved to serve as a reference for handling the current alarm event.

[0035] In some embodiments, before step S110, an alarm knowledge database may be pre-established through the following steps S210 to S230: Step S210: extracting alarm knowledge corresponding to various alarm events from the manufacturer's alarm handling manual.

[0036] The alarm knowledge includes the title, alarm description, system impact, alarm cause and alarm handling process corresponding to the alarm event.

[0037] Specifically, alarm handling manuals are standardized response documents compiled by various manufacturers for different equipment models. They explain the content of each alarm (including title and description), the cause of the alarm, the system impact, and the alarm handling process. Each alarm knowledge can include multiple levels of headings, and each level of heading can correspond to specific content.

[0038] Typically, the alarm handling manual is a file in PDF format. In some implementations, the Python toolkit pypdf can be used to obtain the directory layout information of the PDF file and parse it to obtain a list of titles at each level. The PDFPlumberLoader tool in langchain can also be used to read the text information of each page in the PDF file page by page, and replace irrelevant information such as the header and footer of each page with empty space using regular expressions. After obtaining the text information of each page, the preface, directory, etc. can be truncated and excluded based on the first level title to obtain all the text information in the main text. All the text information in the main text can be spliced ​​together to obtain the full text information.

[0039] After obtaining the full text information, in order to facilitate subsequent retrieval, the title lists of each level obtained in the above embodiment can be used to locate each title position, and a special identifier for reflecting the hierarchical relationship of the title can be added to the title position.

[0040] The MarkdownHeaderTextSplitter tool in Langchain is used to split the full-text information with special identifiers to obtain the document class of each alarm knowledge. It represents the specific information contained in each alarm knowledge, such as the alarm title, alarm description, system impact, alarm cause, and alarm handling process.

[0041] By processing the alarm handling manuals of equipment of different manufacturers and models through the above processing method, the alarm knowledge corresponding to various alarm events can be obtained.

[0042] Step S220: Generate a knowledge summary corresponding to the alarm knowledge.

[0043] As previously mentioned, alarm knowledge is raw information extracted from the original alarm handling manual, which contains a certain amount of redundant content. Since subsequent steps require inputting certain content from the alarm knowledge into the universal large language model to execute the relevant steps in the subsequent embodiments, the alarm knowledge needs to be refined so that the refined content meets the token number limit of the universal large language model.

[0044] In some implementations, prompt words with a special summary function may be designed, and the alarm knowledge may be refined based on the prompt words to obtain a knowledge summary.

[0045] Specifically, the prompt word can be: "As an operations and maintenance expert, you have the ability to extract and summarize alarm knowledge. The following knowledge passage is provided to you. Summarize {{alarm description, system impact, alarm cause, alarm handling process}} from it. {knowledge} ########################## Output requirements: 1. Only output the above 4 items. The summary of each item should be organized and logical, covering key information, concise and smooth. Do not add extra information. Do not repeat the content between items and do not make up your own ideas. 2. The solution should be numbered, and if there are jumps between steps, the jumps should be clear; 3. Output format: 1. Alarm Description: - xxx (specific contents of the alarm description) 2. System Impact: - xxx (impact on the system) 3. Causes: - Reason 1. - Reason 2. 4. Disposal plan: - Step 1. - Step 2. ########################## The summary is as follows: ……”.

[0046] Among them, {knowledge} refers to the original information of the alarm knowledge.

[0047] Based on the prompt word, for each alarm knowledge, the general large language model is guided to output the corresponding knowledge summary, which contains part of the content of the alarm knowledge.

[0048] Step S230 , for the alarm knowledge, based on the title, source document, and knowledge block summary after word embedding, a corresponding alarm handling knowledge block is generated.

[0049] After obtaining the alarm knowledge, a vector index may be established for the alarm knowledge to enable accurate query of the alarm knowledge.

[0050] Specifically, an alarm knowledge database can be established, and an index database can be established in the alarm knowledge database. The index database can be established using ChromaDB and used to store and query vector data. In an embodiment of the present application, in order to achieve accurate retrieval of alarm knowledge, the alarm titles in the alarm knowledge can be word embedded to obtain an index corresponding to each alarm knowledge, and each index is a vector data. It can be understood that the alarm title should be one of the multi-level titles. By storing the alarm title after word embedding in the index database, the alarm knowledge can be effectively identified and retrieved in the vector space.

[0051] In some embodiments, after establishing the index database, for each index, the corresponding multi-level title, the source file of the alarm, and the knowledge block summary generated in step S220 can be combined to form an alarm handling knowledge block corresponding to the alarm knowledge and stored in the alarm knowledge database.

[0052] Based on this, after the target index is retrieved in the index database, the alarm handling knowledge block related to the target index can be extracted from the alarm knowledge database, so that the subsequent steps can be executed smoothly.

[0053] For example, the alarm handling knowledge block may include the following elements: Ids: unique identification information of the text; Embeddings: alert title after word embedding; Metadatas: source documents, titles at all levels, and knowledge block summaries; Documents: Alarm title.

[0054] After the alarm knowledge database is established through steps S210 to S230 , the alarm information obtained this time in step S120 can be searched in the alarm knowledge database.

[0055] In some implementations, a warning word embedding vector corresponding to the warning information may be generated first.

[0056] Specifically, the alarm description in the alarm information is converted into a vector form through a word embedding model, that is, an alarm word embedding vector is generated.

[0057] Then, in the index database of the alarm knowledge database, retrieval is performed based on the alarm word embedding vector.

[0058] Specifically, a similarity calculation can be performed directly between the warning word embedding vector and the vectors in the index database to obtain a first similarity. In some embodiments, vectors with a first similarity greater than a first preset value can be determined as target indexes; in other embodiments, the first n vectors with the highest first similarity can be determined as target indexes. The value of n can be determined by the user based on actual needs and is not limited in this embodiment of the present application.

[0059] Because alarm descriptions are automatically generated by the cloud platform system (or proactively reported by relevant staff), there may be some semantic deviations from the alarm titles in the alarm handling manual. To further ensure retrieval accuracy, in some implementations, the knowledge block summary of the alarm handling knowledge block corresponding to the acquired target index can be further obtained, and a second similarity between the alarm description corresponding to the alarm information and the knowledge block summary can be calculated.

[0060] Specifically, the TextRank algorithm may be used to extract keywords from the alarm description in the alarm information. Indicates the The word embedding vector of keywords, Indicates the total number of keywords, Embedding vector representing the alarm description. Indicates the keyword representation that combines the semantic information of the alarm description. is the preset weight coefficient. Indicates the The word embedding vector of the alarm description summary in the alarm handling knowledge block, Indicates the number of alarm handling knowledge blocks. Indicates the The relevance score between each alarm handling knowledge block and the alarm description is calculated by the similarity between the alarm description keywords and the alarm description summary, the similarity between the alarm description and the alarm description summary, and the similarity between the alarm description and the alarm handling knowledge block title. The similarity is composed of three parts. The specific formula is as follows:

[0061]

[0062] Similarly, a second preset value can be further set to eliminate indexes with similarities lower than the second preset value, and the remaining part can be used as the final target index; the m value can also be further set to use the first m items with the second highest similarity among the n target indexes as the final target index; preferably, m can be 2.

[0063] Step S130 : Using the target alarm handling knowledge block as background knowledge, and using a preset general language model, generate alarm handling reference information corresponding to the alarm information.

[0064] To further improve the generation effect of the preset general large language model for alarm handling reference information and make the ultimately generated reference information more reliable, this embodiment, based on the idea of ​​Retrieval-Augmented Generation (RAG), integrates the target alarm handling knowledge block obtained in step S120 as background knowledge into the preset general large language model (for example, an LLM) to enhance its generation capability.

[0065] For each target alarm handling knowledge block, prior alarm handling information can be generated based on the corresponding word-embedded title and the corresponding knowledge block summary. It can be understood that the prior alarm handling information is the above-mentioned "reference information".

[0066] Specifically, similar to the step of constructing the prompt word in step S220, in this embodiment, the priori alarm handling information and the alarm information can be spliced ​​based on the set template to generate the prompt word in the following manner. In this embodiment, the prompt word can be: "As an operations expert, I want you to explain the alarm from the perspective of {{alarm description, system impact, alarm cause, and alarm handling process}}. I will provide you with some examples.

[0067] Alarm title: First alarm title Alarm Explanation: First Knowledge Block Summary Alarm title: Second alarm title Alarm Explanation: Summary of the Second Knowledge Block ########################### Alarm title: (Alarm description in the alarm information) Alarm explanation:..." By inputting the prompt word into the preset large language model, the preset large language model can be guided to refer to the background knowledge (i.e., the target alarm handling knowledge block) to generate alarm handling reference information corresponding to the alarm information.

[0068] This embodiment provides an auxiliary method for alarm handling. By constructing an alarm knowledge database in advance based on data from alarm handling manuals of different manufacturers, it is possible to automatically retrieve alarm information for alarm events occurring on equipment and match it with corresponding operation and maintenance knowledge (i.e., target alarm handling knowledge blocks). This allows the operation and maintenance knowledge to be used as background knowledge, guiding the large language model to generate more accurate alarm handling reference information for reference by operation and maintenance personnel, reducing reliance on the experience of front-line operation and maintenance experts and improving the efficiency and accuracy of alarm handling.

[0069] In some implementations, in order to further correct the alarm handling reference information, the general large language model may be adjusted based on historical alarm records.

[0070] Specifically, the historical alarm record may include alarm handling reference information and alarm information of the above steps S110 to S130 executed within a period of time.

[0071] In some implementations, a preset universal large language model can be optimized through fine-tuning of high-quality small samples.

[0072] Reinforcement Learning with Hindsight Fine-tuning (RLHF) is a method that combines reinforcement learning and fine-tuning techniques. It can be used to fine-tune a pre-set large general language model to achieve better performance on specific tasks. RLHF includes a reward model and a policy model. The reward model is used to predict human preferences, while the policy model aligns the large general language model with human preferences.

[0073] Taking the preset universal large language model in steps S110 to S130 as an example, for LLM, the probability of generating text can be expressed by the cumulative multiplication of the conditional probabilities of each token.

[0074] For high-frequency cloud platform alarms, we take two LLM generation results and ask operation and maintenance experts to manually select the description that is closest to the actual operation and maintenance scenario based on their professional knowledge. , For input, There are two outputs, is the preference label of the operation and maintenance expert, taking values ​​of 0, 1, Represents the training dataset. Given In the case of ( ), according to the probability formula , that is, strategy , the output is .

[0075]

[0076] Reward Model The input collection , output set Mapping to the set of real numbers .Will Initialize to strategy The final embedding output of random linear function is used. Training the reward model , are the learnable parameters in the reward model, is the expected function, Represents the sigmoid function. Parameter learning is achieved by maximizing the expected difference between the rewards of the preferred output and the non-preferred output.

[0077]

[0078]

[0079] Proximal Policy Optimization (PPO) is a reinforcement learning method for updating policy models. Its purpose is to make the fine-tuned policy model The generated text has higher rewards and is more in line with human preferences.

[0080] will have parameters The reinforcement learning RL strategy to be learned is recorded as , in order to prevent keep away , add a penalty term to the reward function, whose expected value is the coefficient The product of the relative entropy between the two (i.e., Kullback-Leibler divergence, KL divergence), that is, , and the reward value of this process is recorded as .Will Initialized to , updated through PPO according to the award .

[0081]

[0082] Through reinforcement learning with human feedback, we obtain fine-tuned reward and strategy models adapted to alarm analysis task scenarios. The reward model can predict the preferences of operation and maintenance personnel, and the strategy model makes the model output content more in line with operation and maintenance needs.

[0083] In other implementations, the reliability of the final output can be guaranteed by embedding trusted means.

[0084] Specifically, historical alarm information and corresponding alarm analysis expert experience can be associated and stored to form an expert experience library. When step S110 obtains alarm information, a mapping search can be performed in the expert experience library based on the alarm information. If a corresponding association is found, the expert experience can be directly output, thereby ensuring reliable output. If no corresponding association is found, steps S120 to S130 of the above embodiment of the present application are executed, and intelligent generation is performed using a preset universal large language model.

[0085] In some implementations, in order to enrich the alarm handling reference information and better analyze the accompanying alarm events associated with the current alarm information, such as Figure 3 As shown, the alarm handling auxiliary method may further include the following steps S310 to S340.

[0086] Step S310: determining the target network element to which the alarm information belongs from a preset network element topology map.

[0087] Specifically, such as Figure 4 As shown, the preset network element topology diagram includes the connection relationship of multiple network elements, and each network element corresponds to one (group) of software and hardware devices.

[0088] In some embodiments, a map can be pre-built based on historical alarm events (alarm information) within a set time range and a preset network element topology map. , Indicates a network element. Indicates the connection relationship between network elements. is the network element feature matrix, with a total of historical alarm events, each network element has Dimensional features, indicating the frequency of each alarm event on the corresponding network element, through Indicates network element characteristics.

[0089] Step S320: Determine the neighboring network elements of the target network element from the preset network element topology map.

[0090] Step S330: Determine the correlation between the alarm information and the accompanying alarm events of the adjacent network elements.

[0091] In some implementations, a supervised learning model may be trained first to calculate the correlation between two alarm events. Specifically, the model may be trained using historical alarm events (alarm information) within the set time range described in step S310 and a preset network element topology.

[0092] Assume that the alarm event pair contains two alarm events. , first embed its text description, using Represents embedding, adding a subscript index to get the embedding representation corresponding to the corresponding event, , Then encode the physical topology environment, for the network elements that the above two alarm events depend on , respectively integrating their own characteristics and those of their one-hop neighbors (i.e., adjacent network elements):

[0093] ) in, Indicates a set of one-hop neighbors. It reflects the alarm frequency characteristics of the interaction between the alarm network element and the surrounding network elements. is the weighted global alarm semantic feature at the network element level based on frequency and alarm embedding, where: express The sum of the elements of a vector, express The sum of the elements of a vector, , Respectively , No. Dimensional elements.

[0094]

[0095]

[0096] For the time between two events, ,Calculate time correlation, , is the mapping matrix. The final correlation between the two events is as follows, is the mapping matrix, It is the element-wise multiplication operation.

[0097]

[0098] Consider this task as a supervised learning task, and the operation and maintenance experts will construct a set of positive event pairs in advance. , that is, there is a correlation between the two events. For each positive event pair, randomly replace one of them to obtain the corresponding negative event pair set .make is the label corresponding to a given event pair, with positive event pairs taking 1 and negative event pairs taking 0. The cross entropy loss function is as follows,

[0099] At this point, the supervised learning model is established. In practical applications, alarm information can be input into the supervised learning model, and the supervised learning model can automatically output the correlation between the alarm information and the accompanying alarm events of adjacent network elements.

[0100] Step S340 : When the correlation degree satisfies the second set condition, generating associated alarm information corresponding to the alarm information based on the associated alarm event.

[0101] Based on step S330, the correlation between the alarm information and the accompanying alarm events of the adjacent network elements (set as ) After that, you can The set activation function is used to perform the operation, so that the value obtained by the operation (set as ) to determine whether it meets the second setting condition.

[0102] In some embodiments, the second setting condition may be "within a preset value range". For example, the setting value range is as well as ,if in , then it can be considered that The two corresponding alarm events are not related; if in , then it can be considered that The two corresponding alarm events are associated.

[0103] By calculating the results of the current alarm information and the associated alarm events of the adjacent network elements one by one according to the above method, the associated alarm information corresponding to the current alarm information can be obtained. It is understandable that the associated alarm information may include the associated alarm events associated with the current alarm information.

[0104] For example, the associated alarm information may be "Network Element Alarms that occurred on With network elements Alarm events that occurred , and network elements Alarm events that occurred Related", or it can be "network element Alarms that occurred on It is not related to any associated alarm event of any adjacent network element."

[0105] In some other implementations, in order to further enrich the alarm handling reference information and further analyze the impact of the business associated with the current alarm information, such as Figure 5 As shown, the alarm handling auxiliary method further includes the following steps S410 to S430.

[0106] Step S410: Based on a preset network element topology map, a first service corresponding to a target network element to which the alarm information belongs is obtained.

[0107] Step S420: Based on the preset network element topology map, a second service associated with the first service is obtained.

[0108] The preset network element topology diagram may further include the services corresponding to each network element and the association relationship between services of adjacent network elements.

[0109] Specifically, such as Figure 6 As shown, the pre-set service intercommunication relationship and service deployment network element information can be retrieved and integrated with the network element topology diagram to obtain the preset network element topology diagram in the embodiment of the present application.

[0110] For real-time alarm information monitored by the cloud platform, the target network element corresponding to the alarm information can be searched in the preset network element topology map to obtain the first service corresponding to the target network element. At the same time, based on the service interoperability relationships in the preset network element topology map, multiple second services associated with the first service can be traced and the network elements corresponding to each of the multiple second services can be located.

[0111] Step S430: Output the alarm impact range based on the current network element, the first service, the second service, and the network element device where the second service is located.

[0112] Through the above steps S110 to S140, S310 to S340, and S410 to S430, for the real-time alarm information monitored by the cloud platform, the alarm description, system impact, alarm cause, and handling process can be generated through the preset general large language model, and alarm correlation analysis can be performed to determine the impact scope of the alarm information and the related alarm information, providing more accurate and detailed reference for operation and maintenance personnel.

[0113] This application also provides an alarm handling auxiliary device, please refer to Figure 7 , the alarm handling auxiliary device 100 includes: The alarm acquisition module 110 is used to obtain alarm information; a data retrieval module 120 configured to retrieve at least one target alarm handling knowledge block from an alarm knowledge database, wherein the relevance of the target alarm handling knowledge block to the alarm information satisfies a first set condition, the alarm knowledge database including a plurality of alarm handling knowledge blocks, and the alarm handling knowledge blocks being obtained based on a manufacturer's alarm handling manual; The information generation module 130 is configured to use the target alarm handling knowledge block as background knowledge and a preset general language model to generate alarm handling reference information corresponding to the alarm information.

[0114] The alarm handling assistance device 100 provided in this application, employing the alarm handling assistance method of the aforementioned embodiment, can solve the technical problem of improving the efficiency and accuracy of alarm handling. Compared with the prior art, the beneficial effects of the alarm handling assistance device 100 provided in this application are the same as those of the alarm handling assistance method provided in the aforementioned embodiment. Other technical features of the alarm handling assistance device 100 are the same as those disclosed in the aforementioned embodiment and are not further described here.

[0115] The present application provides an alarm handling assistance device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the alarm handling assistance method in the above-mentioned embodiment one.

[0116] Reference below Figure 8 , which shows a schematic diagram of the structure of an alarm handling auxiliary device suitable for implementing the embodiments of the present application. The alarm handling auxiliary device in the embodiments of the present application may include, but is not limited to, mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), in-vehicle terminals (such as in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 8 The alarm handling auxiliary device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0117] like Figure 8As shown, the alarm handling assistance device 200 may include a processing device 210 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes based on programs stored in a read-only memory (ROM) 220 or programs loaded from a storage device 230 into a random access memory (RAM) 240. RAM 240 also stores various programs and data required for the operation of the alarm handling assistance device. Processing device 210, ROM 220, and RAM 240 are interconnected via a bus 250. An input / output (I / O) interface 260 is also connected to the bus. Typically, the following systems may be connected to I / O interface 260: input devices 270, such as a touchscreen, touchpad, keyboard, mouse, image sensor, microphone, accelerometer, gyroscope, etc.; output devices 280, such as a liquid crystal display (LCD), speaker, vibrator, etc.; storage device 230, such as a magnetic tape or hard disk; and communication device 290. The communication device 290 can allow the alarm handling auxiliary device to communicate with other devices wirelessly or by wire to exchange data. Although the figure shows an alarm handling auxiliary device with various systems, it should be understood that it is not required to implement or have all of the systems shown. More or fewer systems can be implemented or provided instead.

[0118] In particular, according to the embodiments disclosed in the present application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, the embodiments disclosed in the present application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program comprising program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network via a communication device, or installed from a storage device 230, or installed from a ROM 220. When the computer program is executed by the processing device 210, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0119] The alarm handling assistance device provided in this application, employing the alarm handling assistance method of the aforementioned embodiment, can solve the technical problem of how to improve the efficiency and accuracy of alarm processing. Compared with the prior art, the beneficial effects of the alarm handling assistance device provided in this application are the same as those of the alarm handling assistance method provided in the aforementioned embodiment, and the other technical features of the alarm handling assistance device are the same as those disclosed in the method of the aforementioned embodiment, and are not further described here.

[0120] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0121] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

[0122] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, a computer program) stored thereon, wherein the computer-readable program instructions are used to execute the alarm handling auxiliary method in the above-mentioned embodiment.

[0123] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems or devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0124] The computer-readable storage medium may be included in the alarm handling auxiliary device; or may exist independently without being assembled into the alarm handling auxiliary device.

[0125] The computer-readable storage medium carries one or more programs. When the one or more programs are executed by the alarm handling auxiliary device, the alarm handling auxiliary device can write computer program code for performing the operations of the present application in one or more programming languages ​​or a combination thereof. The programming languages ​​include object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as "C" or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (for example, via the Internet using an Internet service provider).

[0126] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present application. In this regard, each box in the flow chart or block diagram can represent a module, program segment or a part of code, and the module, program segment or a part of code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order than that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented by a dedicated hardware-based system that performs the specified function or operation, or can be implemented by a combination of dedicated hardware and computer instructions.

[0127] The modules described in the embodiments of the present application may be implemented in software or hardware, wherein the name of a module does not necessarily limit the unit itself.

[0128] The computer-readable storage medium provided in this application stores computer-readable program instructions (i.e., a computer program) for executing the aforementioned auxiliary alarm handling method. This computer-readable storage medium can address the technical problem of improving the efficiency and accuracy of alarm handling. Compared to the prior art, the beneficial effects of the computer-readable storage medium provided in this application are similar to those of the auxiliary alarm handling method provided in the aforementioned embodiments, and are not further elaborated here.

[0129] The present application also provides a computer program product, including a computer program, which implements the steps of the above-mentioned alarm handling auxiliary method when executed by a processor.

[0130] The computer program product provided in this application can solve the technical problem of how to improve the efficiency and accuracy of alarm processing. Compared with the prior art, the beneficial effects of the computer program product provided in this application are the same as those of the alarm handling auxiliary method provided in the above embodiment, and will not be repeated here.

[0131] The above description is only part of the embodiments of the present application and does not limit the patent scope of the present application. All equivalent structural transformations made by using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect application in other related technical fields are included in the patent protection scope of the present application.

Claims

1. An alarm handling auxiliary method, characterized in that: The alarm handling auxiliary method comprises: Get alarm information; Retrieving at least one target alarm handling knowledge block from an alarm knowledge database, wherein the correlation between the target alarm handling knowledge block and the alarm information satisfies a first set condition, the alarm knowledge database includes a plurality of alarm handling knowledge blocks, and the alarm handling knowledge blocks are obtained based on a manufacturer's alarm handling manual; The target alarm handling knowledge block is used as background knowledge and a preset general large language model is used to generate alarm handling reference information corresponding to the alarm information.

2. The alarm handling auxiliary method according to claim 1, characterized in that: The retrieving at least one target alarm handling knowledge block from the alarm knowledge database comprises: Generate a warning word embedding vector corresponding to the warning information; In the index database of the alarm knowledge database, at least one target index is retrieved according to the alarm word embedding vector; the index database includes titles corresponding to various alarm events in the original alarm file; In the alarm knowledge database, the alarm handling knowledge block associated with the target index is used as the target alarm handling knowledge block.

3. In response to monitoring the alarm information, before retrieving multiple target alarm knowledge blocks whose correlation with the alarm information meets the first set condition from the alarm knowledge database, the method further includes: Extracting alarm knowledge corresponding to various alarm events from the manufacturer's alarm handling manual, wherein the alarm knowledge includes a title, alarm description, system impact, alarm cause, and alarm handling process corresponding to the alarm event; Generating a knowledge summary corresponding to the alarm knowledge; For the alarm knowledge, a corresponding alarm handling knowledge block is generated based on the title, source file and knowledge block summary after word embedding.

4. The alarm handling auxiliary method according to claim 2, characterized in that: The method of using the target alarm handling knowledge block as background knowledge and presetting a universal large language model to generate alarm handling reference information corresponding to the alarm information includes: For each target alarm handling knowledge block, generate prior alarm handling information based on the corresponding word embedded title and the corresponding knowledge block summary; splicing the priori alarm handling information and the alarm information based on a set template to generate a prompt word; The prompt word is input into a preset large language model to obtain alarm handling reference information corresponding to the alarm information.

5. The alarm handling auxiliary method according to claim 1, characterized in that: The method further comprises: Determine the target network element to which the alarm information belongs from a preset network element topology map; wherein the preset network element topology map includes connection relationships of multiple network elements; Determine the adjacent network elements of the target network element from a preset network element topology map; Determining the correlation between the alarm information and the associated alarm event of the adjacent network element; When the correlation degree satisfies a second set condition, related alarm information corresponding to the alarm information is generated based on the associated alarm event.

6. The alarm handling auxiliary method according to claim 5, characterized in that: The preset network element topology diagram also includes the services corresponding to each network element and the association relationship between the services of adjacent network elements; The method further comprises: Based on the preset network element topology map, obtaining a first service corresponding to the target network element to which the alarm information belongs; Based on the preset network element topology map, acquiring a second service associated with the first service; Based on the current network element, the first service, the second service and the network element device where the second service is located, an alarm impact range is output.

7. An alarm handling auxiliary device, characterized in that: The alarm handling auxiliary device comprises: An alarm acquisition module is used to obtain alarm information; A data retrieval module is used to retrieve at least one target alarm handling knowledge block from an alarm knowledge database, wherein the correlation between the target alarm handling knowledge block and the alarm information satisfies a first set condition, the alarm knowledge database includes a plurality of alarm handling knowledge blocks, and the alarm handling knowledge blocks are obtained based on a manufacturer's alarm handling manual; The information generation module is used to use the target alarm handling knowledge block as background knowledge and to generate alarm handling reference information corresponding to the alarm information by using a preset general large language model.

8. An alarm handling auxiliary device, characterized in that: The alarm handling assistance device comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the alarm handling assistance method according to any one of claims 1 to 6.

9. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the alarm handling auxiliary method according to any one of claims 1 to 6 are implemented.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the steps of the alarm handling assistance method according to any one of claims 1 to 6 are implemented.

Images