Alarm information processing method and device, equipment, storage medium and program product

Abstract

The invention discloses an alarm information processing method and device, equipment, a storage medium and a program product, relates to the technical field of computers, and discloses an alarm information processing method which comprises the following steps: obtaining alarm information of an alarm event and a user demand; according to the alarm information and the user demand, determining a target expert model in candidate expert models, each expert model corresponding to a different data processing strategy; and inputting the alarm information and the user demand into a target expert model, and obtaining a processing result of the alarm information output by the target expert model. According to the method, the most suitable expert model is selected according to different data processing requirements, so that resources are utilized more effectively, and the operation and maintenance efficiency is improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method, device, equipment, storage medium and program product for processing alarm information. Background Art

[0002] As the scale of enterprises and business complexity increase, traditional manual operation and maintenance methods can no longer meet the needs of accuracy and efficiency. Existing intelligent operation and maintenance technology solutions rely on predefined rules and processes to handle events and problems. They are not flexible enough to handle complex problems, and are difficult to adapt to changing business needs and technical environments, resulting in low operation and maintenance efficiency. Summary of the invention

[0003] The main purpose of this application is to provide a method, device, equipment, storage medium and program product for processing alarm information, aiming to solve the technical problem of low operation and maintenance efficiency.

[0004] To achieve the above purpose, the present application proposes a method for processing alarm information, the method comprising:

[0005] Obtain alarm information and user requirements of alarm events;

[0006] Determine a target expert model from candidate expert models according to the alarm information and the user demand, each of the expert models corresponding to a different data processing strategy;

[0007] The alarm information and the user demand are input into a target expert model, and a processing result of the alarm information output by the target expert model is obtained.

[0008] In one embodiment, the step of determining a target expert model from candidate expert models according to the alarm information and the user demand includes:

[0009] Determining the activation probability of each of the candidate expert models according to the alarm information and the user demand;

[0010] The target expert model is determined from among the candidate expert models according to the activation probability.

[0011] In one embodiment, the step of inputting the alarm information and the user demand into a target expert model and obtaining a processing result of the alarm information output by the target expert model includes:

[0012] When the target expert model is used for alarm association analysis, a first relationship between an alarm entity and a network element entity, a second relationship between the alarm entities, and a third relationship between the network element entities are obtained;

[0013] Based on the alarm entity, the network element entity, the first relationship, the second relationship and the third relationship, generating a hyper-relationship knowledge graph between historical alarm events;

[0014] Based on the hyper-relational knowledge graph, the convergence alarm set to which the alarm event belongs is determined and output.

[0015] In one embodiment, the step of inputting the alarm information and the user demand into a target expert model and obtaining a processing result of the alarm information output by the target expert model includes:

[0016] When the target expert model is used for alarm analysis, the key information of the alarm instance and the network element instance of the alarm information and the hyper-relation knowledge graph are determined to determine the hyper-relation mapping subgraph corresponding to the alarm event;

[0017] Determine the associated event corresponding to the alarm event according to the hyperrelation mapping subgraph;

[0018] According to the associated event, an alarm cause and an alarm impact of the alarm event are generated.

[0019] In one embodiment, the step of inputting the alarm information and the user demand into a target expert model and obtaining a processing result of the alarm information output by the target expert model includes:

[0020] When the target expert model is used to generate operation and maintenance disposal suggestions, at least one similarity between the alarm information and the preset operation and maintenance knowledge is determined, and each similarity corresponds to a different similarity algorithm;

[0021] Determining a comprehensive similarity based on the at least one similarity;

[0022] Determine associated operation and maintenance knowledge according to the comprehensive similarity, and generate an operation and maintenance disposal suggestion according to the associated operation and maintenance knowledge.

[0023] In one embodiment, the step of inputting the alarm information and the user demand into a target expert model and obtaining a processing result of the alarm information output by the target expert model includes:

[0024] When the target expert model is used to generate an operation and maintenance script, an initial code is generated according to the operation and maintenance disposal suggestion, preset instruction knowledge and interface information;

[0025] A prompt word is constructed based on the initial code, the prompt word is input into a large language model, and a target code output by the large language model is obtained.

[0026] In addition, to achieve the above-mentioned purpose, the present application also proposes a device for processing alarm information, the device for processing alarm information comprising:

[0027] The acquisition module is used to obtain the alarm information and user requirements of the alarm event;

[0028] A determination module, used to determine a target expert model from candidate expert models according to the alarm information and the user requirements, each of the expert models corresponding to a different data processing strategy;

[0029] The processing module is used to input the alarm information and the user demand into the target expert model, and obtain the processing result of the alarm information output by the target expert model.

[0030] In addition, to achieve the above-mentioned purpose, the present application also proposes a device for processing alarm information, which includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, and the computer program is configured to implement the steps of the method for processing alarm information as described above.

[0031] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by the processor, the steps of the method for processing alarm information as described above are implemented.

[0032] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, the steps of the method for processing alarm information as described above are implemented.

[0033] One or more technical solutions proposed in this application have at least the following technical effects:

[0034] By matching alarm information and user needs to specific expert models, the accuracy of processing results is improved. The most appropriate expert model is selected according to different data processing needs, so that resources are used more efficiently. The model is allowed to use different learning strategies on different data areas, effectively responding to a variety of complex alarm scenarios and improving operation and maintenance efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0036] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0037] Figure 1 A flowchart of the first embodiment of the method for processing alarm information of this application is provided;

[0038] Figure 2 This is a structural diagram of the MoE model base in the method for processing alarm information in this application;

[0039] Figure 3 A flowchart of the second embodiment of the method for processing alarm information of this application is provided;

[0040] Figure 4 This is a structural diagram of the MoE model base in the method for processing alarm information in this application;

[0041] Figure 5 A flowchart of the third embodiment of the method for processing alarm information of this application is provided;

[0042] Figure 6 A flowchart of the fourth embodiment of the method for processing alarm information of this application is provided;

[0043] Figure 7 A flowchart of the fifth embodiment of the method for processing alarm information of this application is provided;

[0044] Figure 8 A flowchart of the processing method and disposal suggestions for the alarm information of this application;

[0045] Fig. 9 A flowchart of the sixth embodiment of the method for processing alarm information of this application is provided;

[0046] Fig.10 This is a schematic diagram of the data processing flow of the operation and maintenance script expert module in the method for processing alarm information of this application;

[0047] Fig.11 This is a flowchart of the code generation in the method for processing alarm information of this application;

[0048] Fig.12 This is a schematic diagram of attention calculation in the method for processing warning information of this application;

[0049] Fig.13 This is a structural diagram of the MoE model base in the method for processing alarm information in this application;

[0050] Fig.14This is a schematic diagram of the module structure of the alarm information processing device according to the embodiment of the present application;

[0051] Fig.15 A schematic diagram of the device structure of the hardware operating environment involved in the method for processing alarm information in an embodiment of the present application.

[0052] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0053] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0054] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0055] The main solution of the embodiment of the present application is: obtaining the alarm information and user needs of the alarm event; determining the target expert model from the candidate expert models based on the alarm information and user needs, each expert model corresponding to a different data processing strategy; inputting the alarm information and user needs into the target expert model, and obtaining the processing result of the alarm information output by the target expert model.

[0056] In this embodiment, for the convenience of description, the following description is made with the alarm information processing device as the execution subject.

[0057] Because existing intelligent operation and maintenance technology solutions rely on predefined rules and processes to handle events and problems, they are not flexible enough to handle complex problems, and are difficult to adapt to changing business needs and technical environments, resulting in low operation and maintenance efficiency.

[0058] The present application provides a solution that improves the accuracy of processing results by matching alarm information and user needs to specific expert models, selects the most appropriate expert model according to different data processing needs, makes more efficient use of resources, allows the model to use different learning strategies in different data areas, effectively responds to a variety of complex alarm scenarios, and improves operation and maintenance efficiency.

[0059] It should be noted that the execution subject of this embodiment may be a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc., or an electronic device capable of realizing the above functions, an alarm information processing device, etc. The following takes the alarm information processing device as an example to illustrate this embodiment and the following embodiments.

[0060] Based on this, the present application embodiment provides a method for processing alarm information, referring to Figure 1 , Figure 1This is a flowchart of the first embodiment of the method for processing alarm information of the present application.

[0061] In this embodiment, the method for processing the alarm information includes steps S10 to S30:

[0062] Step S10, obtaining alarm information of the alarm event and user requirements.

[0063] The hybrid expert model is a sparse gate-controlled deep learning model. Compared with the traditional dense Transformer model structure, each feedforward network (FFN) layer in the hybrid expert model is replaced by a MoE (Mixture of Experts) layer. Figure 2 As shown in the figure, the MoE layer consists of a gating network (GatingNetwork) and a set of expert models (Experts). The basic idea is to assign input data to the most suitable expert for processing. Each expert model is responsible for learning a specific area or feature of the input data. In traditional dense models, all parameters process all input data, while the gating network can learn how to activate the most suitable expert based on the input data, which means that only a part of the parameter set is called and run. This method can effectively handle complex data distributions and allow the model to use different learning strategies on different data areas.

[0064] The input module of the hybrid expert model receives data such as alarm information, user needs, and public and private knowledge. After cleaning and vectorization, the model divides it into multiple tokens and then transmits it to the gated network.

[0065] Optionally, the alarm information mainly includes alarm title, location information, trigger time, alarm level, event status, etc. User needs are questions or requests raised by users for different business scenarios. Alarm information and user needs serve as the basis for subsequent model routing, such as alarm analysis requests, association analysis requests, professional operation and maintenance issues, etc. Public and private knowledge can be retrieved from public or private databases, and plays a role in enhancing the ability of expert model reasoning generation. For example, providing code knowledge can assist in enhancing code generation capabilities.

[0066] Step S20: determining a target expert model from candidate expert models according to the alarm information and the user demand, each of the expert models corresponding to a different data processing strategy.

[0067] It should be noted that the candidate expert model is an expert model in the hybrid expert model, and the target expert model is an expert model used to process the current alarm information.

[0068] Optionally, key fields are determined based on alarm information and user needs, and compared with reference fields corresponding to data processing strategies corresponding to the expert model. When the similarity between the key fields and the reference fields is greater than a preset similarity threshold, the expert model is determined to be the target expert model.

[0069] Based on the MoE model foundation, four expert models for operation and maintenance are designed around the capacity building of the operation and maintenance decision-making center, such as Figure 2 As shown in the figure, they are: alarm correlation analysis expert model, alarm resolution expert model, operation and maintenance disposal suggestion expert model, and operation and maintenance script generation expert model. The expert models work together to achieve flexible reuse of operation and maintenance capabilities.

[0070] When dealing with complex alarm scenarios, the gating network determines which expert models are activated and adjusts the weights of each expert according to their contribution, thereby more accurately capturing the key information of the alarm scenario and improving the accuracy and reliability of the response. By sharing knowledge between expert models, when faced with a new alarm scenario, the characteristics of the new scenario can be quickly learned, reducing over-reliance on labeled data.

[0071] Step S30: input the alarm information and the user demand into a target expert model, and obtain a processing result of the alarm information output by the target expert model.

[0072] It should be noted that after determining the target expert model, the alarm information is processed accordingly based on the data processing strategy and network model of the target expert model to obtain the processing result of the alarm information. When processing an alarm event, the gating network automatically decides which expert models to activate. Each expert model is responsible for learning a specific area or feature of the input data, while the gating network learns how to select the most appropriate expert based on the input data. It can effectively handle complex data distributions, allowing the model to use different learning strategies on different data areas, and effectively respond to a variety of complex alarm scenarios.

[0073] In the technical solution of this embodiment, by matching alarm information and user needs to specific expert models, the accuracy of the processing results is improved, and the most suitable expert model is selected according to different data processing needs, so that resources are used more efficiently, allowing the model to use different learning strategies on different data areas, effectively responding to various complex alarm scenarios, and improving operation and maintenance efficiency.

[0074] Based on the first embodiment of the present application, in the second embodiment of the present application, the same or similar contents as those in the above embodiment can refer to the above introduction, and will not be repeated later. Figure 3 , step S20 comprises:

[0075] Step S21, determining the activation probability of each of the candidate expert models according to the alarm information and the user demand;

[0076] Step S22: determining the target expert model from the candidate expert models according to the activation probability.

[0077] The gated network receives input data and calculates and outputs a set of weighted data, which corresponds to the activation probability of each expert and also represents the contribution value of each expert to the processing of the input data. Figure 4 As shown, an expert model is selected based on the activation probability, and the output results of the expert model are weighted and output.

[0078] The gated network is usually a network with a softmax function, which automatically learns to activate the corresponding expert according to the input data through weighted multiplication operations. σ (x) can be expressed by the following formula:

[0079] G σ (x) = Softmax(x·W g );

[0080] Where x is the input vector received by the gating network, W g is the weight matrix of the gating network. Assuming the input dimension is d and there are n experts, then W g The expanded representation is:

[0081]

[0082] Among them, w ij Represents the connection weights from the input to a candidate expert model. The gating network uses these weights to calculate the relevance of the input to the candidate expert model.

[0083] Substitute x with W g Multiplying and normalizing with the softmax function, we can output a vector G with a weight sum of 1 σ (x), G σ Each element g in (x) i The activation weight corresponding to the input x for an expert.

[0084] Sort the weights of the gated outputs from high to low, and select a preset number k of expert models. The selected expert models will be activated to process the input data, and other expert models will be ignored. This can significantly reduce the computational cost. The activated experts process the token of the input alarm information and generate output. All outputs are weighted and combined according to the weights of the gated network to obtain the final model output.

[0085] In the technical solution of this embodiment, the weight of each expert model is adjusted according to its contribution, so as to more accurately capture the key information of the alarm scene and improve the accuracy and reliability of the response. By sharing knowledge among the expert models, the characteristics of the new scene can be quickly learned when facing a new alarm scene, reducing excessive reliance on labeled data.

[0086] Based on the first or second embodiment of the present application, in the third embodiment of the present application, the same or similar contents as those in the above embodiment can be referred to the above introduction, and will not be repeated in the following. Figure 5 , step S30 comprises:

[0087] Step S31, when the target expert model is used for alarm association analysis, obtaining a first relationship between an alarm entity and a network element entity, a second relationship between the alarm entities, and a third relationship between the network element entities;

[0088] Step S32, generating a hyper-relationship knowledge graph between historical alarm events based on the alarm entity, the network element entity, the first relationship, the second relationship and the third relationship;

[0089] Step S33: determine the convergence alarm set to which the alarm event belongs based on the hyper-relational knowledge graph and output it.

[0090] It should be noted that the expert model of alarm correlation analysis is used to quickly collect and accurately converge massive alarm information.

[0091] When the gating network receives a request for alarm correlation analysis, the expert model is activated and the alarm information is used as the analysis subject.

[0092] Collect historical alarm information and network element topology data in advance, and further extract the data, including core elements such as identification equipment, network element location, and alarm level. Treat alarm events and network elements as two types of entities, and integrate alarm event units with network elements through algorithms such as entity alignment and key-value association to obtain the relationship between alarm entities and network element entities, the relationship between alarm entities, and the relationship between network element entities. Enter all entities and relationships into the graph database one by one to form a hyper-relational knowledge graph of alarm events.

[0093] When an alarm message is received, the hyper-relational knowledge graph is combined with the preset rule parallel matching algorithm to quickly collect and accurately converge the massive amount of alarm information, and output a converged alarm set. Exemplary formats include: Set A {alarm 1, alarm 2, alarm 3}; Set B {alarm 4, alarm 5, alarm 6}.

[0094] Through this expert model, the pressure of massive alarms caused by alarm storms can be resolved, and the current situation where alarm convergence rules are highly dependent on expert experience can be alleviated. At the same time, tools can be called to assist in analyzing related alarms, alleviating the pressure of front-line operation and maintenance personnel in handling orders.

[0095] In the technical solution of this embodiment, by obtaining multiple relationships between alarm entities and network element entities, it is possible to identify and analyze the complex relationships between alarm entities and network element entities, improve the accuracy of alarm association, and generate a hyper-relationship knowledge graph including alarm entities, network element entities and their relationships, thereby providing comprehensive background information for alarm analysis.

[0096] Based on any one of the first to third embodiments of the present application, in the fourth embodiment of the present application, the same or similar contents as those in the above embodiments can refer to the above introduction, and will not be repeated later. Figure 6 , step S30 comprises:

[0097] Step S34, when the target expert model is used for alarm analysis, determining the key information of the alarm instance and the network element instance of the alarm information, as well as the hyper-relationship knowledge graph, and determining the hyper-relationship mapping subgraph corresponding to the alarm event;

[0098] Step S35, determining the associated event corresponding to the alarm event according to the super-relationship mapping subgraph;

[0099] Step S36: Generate the alarm cause and alarm impact of the alarm event according to the associated event.

[0100] It should be noted that the expert model of alarm analysis is used to determine the root alarm network elements and alarm events, summarize the alarm causes, and evaluate the alarm impact.

[0101] When the gated network receives an alarm analysis request, the expert model of alarm analysis is activated. At this time, the converged alarm set output by the above-mentioned association analysis expert will serve as the main body of the business process. After the alarm is converged, the key information of the alarm instance and the associated network element instance is extracted based on the network element link retrieval and traffic collection engine to determine the hyper-relationship mapping subgraph.

[0102] After the hyper-relation mapping subgraph is extracted, the alarm instance, network element instance, and hyper-relation data set are combined and input into a multi-model framework composed of multiple reasoning models linked by the equipment document database, rule base, and knowledge graph. Through multi-model association matching and processing, the hit associated events are output, and the root alarm network element and alarm event are finally determined, and the alarm cause and alarm impact are output.

[0103] By building the ability to predict alarm causes and analyze impacts, we can improve the efficiency of alarm cause investigation, locate problems more quickly, more accurately assess the impact scope of alarms, and reduce fault repair time.

[0104] In the technical solution of this embodiment, by acquiring multiple relationships between the alarm entity and the network element entity, the complex relationship between the alarm entity and the network element entity can be identified and analyzed, and disposal suggestions can be generated, thereby improving the efficiency and accuracy of alarm processing and enhancing the flexibility and reliability of alarm processing.

[0105] Based on any one of the first to fourth embodiments of the present application, in the fifth embodiment of the present application, the same or similar contents as those in the above embodiments can be referred to the above introduction, and will not be repeated in the following. Figure 7 , step S30 comprises:

[0106] Step S37, when the target expert model is used to generate operation and maintenance disposal suggestions, at least one similarity between the alarm information and the preset operation and maintenance knowledge is determined, and each similarity corresponds to a different similarity algorithm;

[0107] Step S38, determining a comprehensive similarity based on the at least one similarity;

[0108] Step S39: determining associated operation and maintenance knowledge according to the comprehensive similarity, and generating operation and maintenance disposal suggestions according to the associated operation and maintenance knowledge.

[0109] It should be noted that the expert model for operation and maintenance disposal suggestions generates disposal procedures by extracting and analyzing the core operation and maintenance requirements under the alarm scenario, automatically retrieving and matching the corresponding operation and maintenance knowledge. When an alarm event is triggered, the device anomaly detection capability module is called to collect data such as alarm information, logs, performance indicators, and configuration settings, extract the core operation and maintenance requirements, and activate the expert model for the corresponding alarm disposal suggestions based on the alarm characteristics and context information.

[0110] Reference Figure 8 , Figure 8 Generate a flowchart for disposal suggestions. Based on the generative language model capability, by extracting and analyzing the core operation and maintenance requirements in the alarm scenario, automatically retrieve and match the corresponding operation and maintenance knowledge from public and private knowledge bases, and generate a disposal process for reference by operation and maintenance personnel, reducing the reliance on the experience of front-line operation and maintenance experts and improving the accuracy and speed of alarm investigation and disposal.

[0111] The process of generating operation and maintenance disposal suggestions is as follows:

[0112] An indexing mechanism and similarity calculation method are used to accurately match core operation and maintenance requirements with public and private operation and maintenance knowledge. The generative model framework is called in parallel, and context-aware technology is applied to generate logically rigorous inspection items, inspection methods, core indicator evaluation basis, operational suggestions and other process-based disposal suggestions.

[0113] Faiss (Facebook AI Similarity Search) and m3e-base are used as vector index library and vectorization model respectively. After vectorization of alarm information, the vector set is encapsulated into an index database to accelerate the retrieval of similar vectors. The index database is built based on the HNSW64 (HierarchicalNavigable Small World 64-bit) algorithm. This index consumes a lot of memory, greatly reduces the retrieval time, and also has a relatively good performance in vector recall performance.

[0114] When a new alarm information vector is input, the similarity score between the vectors is calculated using Euclidean distance and cosine similarity. Among them, Euclidean distance is the most intuitive similarity measurement method, which is used to measure the straight-line distance between two points. Assuming that the two vectors in the multidimensional space are X(x1,x2,x3,...) and Y(y1,y2,y3,...), the Euclidean distance calculation formula between X and Y is as follows:

[0115]

[0116] Among them, the smaller the value of the Euclidean distance, the higher the similarity between the two vectors.

[0117] The cosine similarity measures the degree of similarity between two vectors in direction. The value range of cosine similarity is between [-1,1], where 1 indicates the exact same direction and -1 indicates the exact opposite direction. The formula for calculating cosine similarity is as follows:

[0118]

[0119] According to the idea of ​​Soft Voting, multiple similarity calculation results can be combined to obtain a final weighted decision according to the following example:

[0120] Assuming that the vector of the query alarm information is X, according to the Euclidean distance formula, the five vectors with the highest similarity to X are calculated, and they are ranked from high to low as A, B, C, D, and E, with corresponding similarities of 0.95, 0.85, 0.70, 0.62, and 0.31; according to the cosine similarity formula, the five vectors with the highest similarity to X are calculated, and they are ranked from high to low as B, A, D, E, and C, with corresponding similarities of 0.89, 0.78, 0.67, 0.60, and 0.55. The average similarity between each vector and the query vector X is obtained:

[0121] A: (0.95+0.78) / 2=0.865;

[0122] B: (0.85+0.89) / 2=0.87;

[0123] C: (0.70+0.55) / 2=0.625;

[0124] D: (0.62+0.67) / 2=0.654;

[0125] E: (0.31+0.60) / 2=0.455;

[0126] According to the average similarity, they are sorted from high to low as B, A, D, C, and E. It can be preliminarily inferred that vector B is the most similar to the query vector.

[0127] Referring to the above example, the average similarity is used as a basis to retrieve the alarm that is most similar to the input alarm from the database, fill the similar alarm information into the preset prompt words, enhance the large language model reasoning, and associate and generate alarm handling suggestions.

[0128] The core content of the alarm handling suggestion is a series of step description texts, as shown below:

[0129] Step 1: View the alarm network element, IP address and other details through the alarm SMS or alarm details.

[0130] Step 2, log in to the device to view the port details, display interface$ locate the port$ in the information. If the port of the peer device is abnormal, proceed to step 3, if the port of the local device is abnormal, proceed to step 4.

[0131] Step 3: Log in to the peer device for processing.

[0132] Step 4: Submit a system event tracking form on the support platform to replace the hardware. If the fault is eliminated, the process is complete; if the fault is still not eliminated, proceed to step 5.

[0133] Step 5: Collect device operation information and contact the operation and maintenance personnel.

[0134] When building a knowledge base, the original data is parsed and converted into knowledge vectors, which are stored in layers according to multiple retrieval dimensions. When retrieving vectors, dimension matching and similarity calculation are used to accelerate vector retrieval and enhance large model reasoning. The m3e-base text embedding model is used, which has excellent vector encoding capabilities and supports multi-language homogeneous text similarity calculation, heterogeneous text retrieval and other functions; for high-dimensional vectors with the same importance in each dimension, the Euclidean distance is used as the basis for similarity calculation. Combined with the vectorization capability of m3e-base, it can significantly improve the accuracy of similarity evaluation while maintaining computational efficiency. When processing large-scale text vectors, it can show better performance and adaptability.

[0135] In the technical solution of this embodiment, while maintaining computational efficiency, the accuracy of similarity evaluation is significantly improved, and when processing large-scale text vectors, it can demonstrate better performance and adaptability, thereby improving the accuracy of operation and maintenance disposal recommendations.

[0136] Based on any one of the first to fifth embodiments of the present application, in the sixth embodiment of the present application, the same or similar contents as those in the above embodiments can be referred to the above introduction, and will not be repeated in the following. Fig. 9 , step S30 comprises:

[0137] Step S310, when the target expert model is used to generate an operation and maintenance script, an initial code is generated according to the operation and maintenance disposal suggestion, preset instruction knowledge and interface information;

[0138] Step S311: construct prompt words based on the initial code, input the prompt words into a large language model, and obtain a target code output by the large language model.

[0139] It should be noted that the expert model generated by the operation and maintenance script is used to generate integrated instructions for the generated disposal suggestions.

[0140] Reference Fig.10 The schematic diagram of the operation and maintenance script expert module is shown in the figure. After the disposal suggestions are generated, the operation and maintenance instruction generation engine is activated for specific steps. Based on the open source generative model base, the engine builds a host and network equipment script data set according to massive operation and maintenance instructions and scripts, further fine-tunes the basic model, and improves the instruction generation capability. After the instructions are generated, the operation and maintenance instructions are intelligently arranged and functionally connected based on the operation and maintenance disposal suggestion process; finally, based on the specific data of the alarm and the relevant alarm disposal process, the integrated instructions are generated based on the public and private knowledge base retrieval enhancement.

[0141] refer to Fig.11 The code generation process based on knowledge base retrieval enhancement is carried out in the following steps:

[0142] Step S1, build a code vector knowledge base. Collect historical code, equipment, code execution purpose and other information from manual documents, databases and other data sources, and construct code description text after preprocessing, such as "display system hardware time", "check CPU (Central Processing Unit) utilization", and then input the text into the m3e-base model for vectorization, and generate vector index files in layers according to multiple dimensions such as device manufacturer, device type and device model. The file name format is: key_index_device type_manufacturer_model. The files store code description vectors within the corresponding range, and these persistent vectors constitute a complete vector knowledge base.

[0143] Step S2, start the three sub-modules of FastChat: controller, server, and worker. On the Worker side, select vLLM (Vectorized Large Language Model) as the inference engine, load the specified model file, create a model instance, accept the request scheduling of the Controller, respond to the inference request, and form parallel inference capabilities.

[0144] Among them, vLLM uses Paged Attention technology to greatly improve reasoning performance. Its inspiration comes from the virtual memory paging management technology of the operating system. In the typical LLM (Large Language Model) reasoning process, it is mainly divided into two stages: pre-filling and decoding. In the pre-filling stage, the model will process the input prompt word and calculate some necessary information, which is usually stored in a data structure called KV Cache (Key-ValueCache). In the decoding stage, the model uses this cache to generate subsequent tokens.

[0145] In Paged Attention, the KV Cache is divided into multiple smaller blocks, each of which contains a key vector (K) and a value vector (V) of a fixed number of tokens. When the model is in the decoding phase, it only needs to load the currently required blocks instead of the entire cache, which helps reduce the demand for video memory and improve memory usage efficiency.

[0146] Assume that the input is X=(x1,...,x n )∈R n×d , where n is the sequence length and d is the embedding dimension. The self-attention mechanism uses three matrices to transform each x i Transformed into query, key, and value vectors, exemplarily, as shown in the following formula:

[0147] q i =W q x i ;

[0148] k i =W k x i ;

[0149] v i =W v x i ;

[0150] Assuming the block size is B, define the B key vectors K in the jth blockj =(k (j-1)B+1 ,...,k jB ), B value vectors are V j =(v (j-1)B+1 ,...,v jB ), the following is the calculation formula of Paged Attention:

[0151]

[0152] After calculation, we get A ij =(a i,(j-1)B+1 ,...,a i,jB ) represents the attention score vector of the i-th token to the B tokens in the j-th block, and is combined with V j The matrix weighted summation obtains the attention output o i .

[0153] During attention calculation, the Paged Attention kernel identifies and obtains different KV blocks respectively, such as Fig.12 As shown in the figure, the key and value vectors are distributed on three blocks and stored in non-contiguous physical memory. Then the query vector is multiplied by the key vector in the block to obtain the partial attention score, and then multiplied by the value vector in the block to obtain the final attention output. This design makes the paging memory management in vLLM more flexible, improves the memory usage efficiency, and enables multiple sequences to be inferred simultaneously, thereby significantly improving the throughput.

[0154] Step S3, loading the code generation module and searching the code knowledge base.

[0155] Read the vector index file, build vector library index instances one by one, combine these instances into a complete knowledge base, and load it into the memory. Load the relationship dictionary between the code description text and the code, and the preset prompt word template. Read the configuration file and load the inference configuration information. Retrieve the k code description information closest to the input vector from the vector library, and then match and obtain the corresponding k codes from the code relationship dictionary. If the calculated k similarity scores are all lower than the set threshold, it can be determined that the retrieval is invalid, that is, there is no relevant knowledge.

[0156] Step S4, construct prompt, and generate complete code by model reasoning.

[0157] Parse the disposal process text and detect the instruction dependencies between disposal steps. If the current step has instructions to be executed, it depends on the data of the return value of the upstream step as a parameter, that is, there is a dependency relationship between the steps. As described in the step: "Execute displaylink-aggregation verbose Route-Aggregation$display redundancy group interface in non-Positive state$", the current instruction parameter is the interface information in the non-active Positive state in the upstream execution result. To this end, the current step and upstream step descriptions can be input into the model, and the process prompt words can be preset to guide the model step by step to verify whether there is a dependency relationship.

[0158] Construct the prompt word prompt. According to the above code retrieval results, automatically select the appropriate prompt word template. When there is no relevant knowledge in the search, fill in the processing step description text in the prompt word template, and the large model will generate the code by itself. Otherwise, the search results, step descriptions, and prompt word templates are combined to construct the prompt word, and the large model reasoning and analysis will select the optimal solution in the search results. Optionally, if there is a dependency relationship in the detection, the upstream execution output needs to be used as the prompt word supplement content to guide the model to detect key information and fill in the corresponding placeholders in the code.

[0159] The prompt and preset reasoning parameters generated by the above construction are encapsulated as reasoning requests that comply with the OpenAI interface specification of the Open AI Research Institute, and handed over to the model loaded in the FastChat backend for reasoning to generate execution code, code explanation and other information. For additional information of other codes, such as IP, port, interface name, etc., customized rule matching and large model reasoning are used to finally decide whether to add this information to the generated code, thereby enhancing the robustness of the code.

[0160] In order to solve the uncertainty and security risks of writing code for generative models and improve the availability of operation and maintenance scripts, it is necessary to automatically perform security and compliance checks on the generated instructions and instruction sets. For basic programming language testing, there are three types of checks: lexical, grammatical, and semantic. By learning the code style of the operation and maintenance script library, special inspection rules for the operation and maintenance field are constructed, and special inspections are performed on commonly used operation and maintenance commands (such as cat, awk, grep, etc.). Runtime error detection is performed through sandbox technology and container technology, and execution scripts are rehearsed to ensure that potential code risks are discovered before actual deployment. A model self-feedback mechanism is established, and self-feedback training of code detection results is performed to improve the quality of code generation and reduce the probability of code rework.

[0161] Driven by alarm events, the final executable processing script is integrated and constructed through processes such as operation and maintenance processing suggestion generation, code generation, and code verification, and is then handed over to automation tools for orchestration and execution.

[0162] Reference Fig.13 ,Integrating the capabilities of four model experts, focusing on user needs and alarm subjects, relying on public and private knowledge, and following the life cycle of alarm handling decisions, it successively outputs convergent alarm sets, alarm causes, alarm impacts, handling suggestions and handling scripts.

[0163] In the technical solution of this embodiment, the automatic generation of operation and maintenance codes reduces the workload of manual script writing, improves the automation level of operation and maintenance work, and the rapid generation of operation and maintenance scripts makes the response to operation and maintenance events faster, which helps to deal with system problems in a timely manner.

[0164] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the method for processing alarm information of the present application. More simple transformations based on this technical concept are all within the scope of protection of the present application.

[0165] This application also provides a device for processing alarm information, please refer to Fig.14 , the warning information processing device comprises:

[0166] The acquisition module 10 is used to obtain the alarm information and user requirements of the alarm event;

[0167] A determination module 20, configured to determine a target expert model from candidate expert models according to the alarm information and the user requirements, each of the expert models corresponding to a different data processing strategy;

[0168] The processing module 30 is used to input the alarm information and the user demand into the target expert model, and obtain the processing result of the alarm information output by the target expert model.

[0169] Obtain alarm information and user requirements of alarm events;

[0170] Determine a target expert model from candidate expert models according to the alarm information and the user demand, each of the expert models corresponding to a different data processing strategy;

[0171] The alarm information and the user demand are input into a target expert model, and a processing result of the alarm information output by the target expert model is obtained.

[0172] Optionally, the step of inputting the alarm information and the user demand into a target expert model and obtaining a processing result of the alarm information output by the target expert model includes:

[0173] When the target expert model is used for alarm association analysis, a first relationship between an alarm entity and a network element entity, a second relationship between the alarm entities, and a third relationship between the network element entities are obtained;

[0174] Based on the alarm entity, the network element entity, the first relationship, the second relationship and the third relationship, generating a hyper-relationship knowledge graph between historical alarm events;

[0175] Based on the hyper-relational knowledge graph, the convergence alarm set to which the alarm event belongs is determined and output.

[0176] Optionally, the step of inputting the alarm information and the user demand into a target expert model and obtaining a processing result of the alarm information output by the target expert model includes:

[0177] When the target expert model is used for alarm analysis, the key information of the alarm instance and the network element instance of the alarm information and the hyper-relation knowledge graph are determined to determine the hyper-relation mapping subgraph corresponding to the alarm event;

[0178] Determine the associated event corresponding to the alarm event according to the hyperrelation mapping subgraph;

[0179] According to the associated event, an alarm cause and an alarm impact of the alarm event are generated.

[0180] Optionally, the step of inputting the alarm information and the user demand into a target expert model and obtaining a processing result of the alarm information output by the target expert model includes:

[0181] When the target expert model is used to generate operation and maintenance disposal suggestions, at least one similarity between the alarm information and the preset operation and maintenance knowledge is determined, and each similarity corresponds to a different similarity algorithm;

[0182] Determining a comprehensive similarity based on the at least one similarity;

[0183] Determine associated operation and maintenance knowledge according to the comprehensive similarity, and generate an operation and maintenance disposal suggestion according to the associated operation and maintenance knowledge.

[0184] Optionally, the step of inputting the alarm information and the user demand into a target expert model and obtaining a processing result of the alarm information output by the target expert model includes:

[0185] When the target expert model is used to generate an operation and maintenance script, an initial code is generated according to the operation and maintenance disposal suggestion, preset instruction knowledge and interface information;

[0186] A prompt word is constructed based on the initial code, the prompt word is input into a large language model, and a target code output by the large language model is obtained.

[0187] The alarm information processing device provided by the present application adopts the alarm information processing method in the above embodiment, which can solve the technical problem of low operation and maintenance efficiency. Compared with the prior art, the beneficial effects of the alarm information processing device provided by the present application are the same as the beneficial effects of the alarm information processing method provided by the above embodiment, and other technical features in the alarm information processing device are the same as the features disclosed in the above embodiment method, which will not be repeated here.

[0188] The present application provides an alarm information processing device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the alarm information processing method in the above-mentioned embodiment one.

[0189] Reference below Fig.15 , which shows a schematic diagram of the structure of a warning information processing device suitable for implementing the embodiment of the present application. The warning information processing device in the embodiment of the present application may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Fig.15 The alarm information processing device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0190] like Fig.15As shown, the alarm information processing device may include a processing device 1001 (e.g., a central processing unit, a graphics processor, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM: Random Access Memory) 1004. In RAM1004, various programs and data required for the operation of the alarm information processing device are also stored. The processing device 1001, ROM1002, and RAM1004 are connected to each other through a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Generally, the following systems can be connected to the I / O interface 1006: an input device 1007 including, for example, a touch screen, a touch pad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; an output device 1008 including, for example, a liquid crystal display (LCD: Liquid Crystal Display), a speaker, a vibrator, etc.; a storage device 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 can allow the processing device of the alarm information to communicate with other devices wirelessly or by wire to exchange data. Although the figure shows the processing device of the alarm information with various systems, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems can be implemented or have alternatively.

[0191] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0192] The alarm information processing device provided by the present application adopts the alarm information processing method in the above embodiment, which can solve the technical problem of low operation and maintenance efficiency. Compared with the prior art, the beneficial effects of the alarm information processing device provided by the present application are the same as the beneficial effects of the alarm information processing method provided by the above embodiment, and the other technical features in the alarm information processing device are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0193] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0194] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0195] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, computer programs) stored thereon, and the computer-readable program instructions are used to execute the method for processing alarm information in the above-mentioned embodiment.

[0196] The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination of the above.

[0197] The computer-readable storage medium may be included in the alarm information processing device; or may exist independently without being installed in the alarm information processing device.

[0198] The above-mentioned computer-readable storage medium carries one or more programs. When the above-mentioned one or more programs are executed by the alarm information processing device, the alarm information processing device: improves the accuracy of the processing results by matching the alarm information and user needs to a specific expert model, selects the most suitable expert model according to different data processing needs, makes resources more efficiently utilized, allows the model to use different learning strategies on different data areas, effectively responds to a variety of complex alarm scenarios, and improves operation and maintenance efficiency.

[0199] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0200] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0201] The modules involved in the embodiments described in this application may be implemented by software or hardware, wherein the name of the module does not constitute a limitation on the unit itself in some cases.

[0202] The readable storage medium provided in this application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned method for processing alarm information, and can solve the technical problem of low operation and maintenance efficiency. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as the beneficial effects of the method for processing alarm information provided in the above-mentioned embodiment, and will not be repeated here.

[0203] The present application also provides a computer program product, including a computer program, which implements the steps of the above-mentioned method for processing alarm information when executed by a processor.

[0204] The computer program product provided by this application can solve the technical problem of low operation and maintenance efficiency. Compared with the prior art, the beneficial effects of the computer program product provided by this application are the same as the beneficial effects of the method for processing alarm information provided by the above embodiment, which will not be repeated here.

[0205] The above descriptions are only some embodiments of the present application, and are not intended to limit the patent scope of the present application. All equivalent structural changes made using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect applications in other related technical fields are included in the patent protection scope of the present application.

Claims

1. A method for processing alarm information, characterized in that: The method includes: Obtain alarm information and user requirements of alarm events; Determine a target expert model from candidate expert models according to the alarm information and the user demand, each of the expert models corresponding to a different data processing strategy; The alarm information and the user demand are input into a target expert model, and a processing result of the alarm information output by the target expert model is obtained.

2. The method according to claim 1, characterized in that The step of determining a target expert model from candidate expert models according to the alarm information and the user demand comprises: Determining the activation probability of each of the candidate expert models according to the alarm information and the user demand; The target expert model is determined from among the candidate expert models according to the activation probability.

3. The method according to claim 1, characterized in that The step of inputting the alarm information and the user demand into a target expert model and obtaining a processing result of the alarm information output by the target expert model comprises: When the target expert model is used for alarm association analysis, a first relationship between an alarm entity and a network element entity, a second relationship between the alarm entities, and a third relationship between the network element entities are obtained; Based on the alarm entity, the network element entity, the first relationship, the second relationship and the third relationship, generating a hyper-relationship knowledge graph between historical alarm events; Based on the hyper-relational knowledge graph, the convergence alarm set to which the alarm event belongs is determined and output.

4. The method according to claim 3, characterized in that The step of inputting the alarm information and the user demand into a target expert model and obtaining a processing result of the alarm information output by the target expert model comprises: When the target expert model is used for alarm analysis, the key information of the alarm instance and the network element instance of the alarm information and the hyper-relation knowledge graph are determined to determine the hyper-relation mapping subgraph corresponding to the alarm event; Determine the associated event corresponding to the alarm event according to the hyperrelation mapping subgraph; According to the associated event, an alarm cause and an alarm impact of the alarm event are generated.

5. The method according to claim 1, characterized in that The step of inputting the alarm information and the user demand into a target expert model and obtaining a processing result of the alarm information output by the target expert model comprises: When the target expert model is used to generate operation and maintenance disposal suggestions, at least one similarity between the alarm information and the preset operation and maintenance knowledge is determined, and each similarity corresponds to a different similarity algorithm; Determining a comprehensive similarity based on the at least one similarity; Determine associated operation and maintenance knowledge according to the comprehensive similarity, and generate an operation and maintenance disposal suggestion according to the associated operation and maintenance knowledge.

6. The method according to claim 5, characterized in that The step of inputting the alarm information and the user demand into a target expert model and obtaining a processing result of the alarm information output by the target expert model comprises: When the target expert model is used to generate an operation and maintenance script, an initial code is generated according to the operation and maintenance disposal suggestion, preset instruction knowledge and interface information; A prompt word is constructed based on the initial code, the prompt word is input into a large language model, and a target code output by the large language model is obtained.

7. A device for processing alarm information, characterized in that: The device comprises: The acquisition module is used to obtain the alarm information and user requirements of the alarm event; A determination module, used to determine a target expert model from candidate expert models according to the alarm information and the user requirements, each of the expert models corresponding to a different data processing strategy; The processing module is used to input the alarm information and the user demand into the target expert model, and obtain the processing result of the alarm information output by the target expert model.

8. A device for processing alarm information, characterized in that: The device comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the method for processing alarm information according to any one of claims 1 to 6.

9. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the method for processing alarm information according to any one of claims 1 to 6 are implemented.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the steps of the method for processing alarm information according to any one of claims 1 to 6 are implemented.

Images