Information system fault classification method, device, equipment, medium and product

Abstract

The invention discloses an information system fault classification method, device and equipment, a medium and a product. The method comprises the following steps: acquiring log data to be subjected to fault classification corresponding to an information system; inputting the log data into a fault detection model to obtain a fault description text; and determining a fault classification result according to the fault description text. Through the technical scheme of the invention, the fault types can be accurately classified based on the log data when the system fault occurs, and maintenance personnel are helped to perform efficient and targeted fault processing, so that the loss caused by the fault is reduced.

Description

Technical Field

[0001] Embodiments of the present invention relate to the technical field of fault classification, and in particular, to an information system fault classification method, device, equipment, medium and product. Background Art

[0002] With the rapid development of cloud computing, microservice architecture and big data processing technology, large-scale distributed software systems have become the core infrastructure of modern enterprises and Internet services. Such systems are usually composed of hundreds to thousands of nodes, and each node collaborates through network communication to complete complex computing tasks. They are widely used in many fields such as finance, e-commerce, and social networks.

[0003] The fault life cycle of a software system is usually divided into three stages: the alert stage, the engagement stage, and the resolution stage. In the alert stage, when a service fails or anomalies occur, the system will automatically generate an alarm and create a related record in the fault database. At the same time, a system log is generated to record the performance indicators and service operation status at the time, such as CPU usage, memory usage, network latency and other data. In the engagement stage, operation and maintenance personnel analyze these logs through manual identification or automated tools, preliminarily determine the approximate category of the fault, and assign it to the relevant technical team for processing. In the resolution stage, the technical team conducts in-depth analysis based on the fault type, logs, user feedback and other information, proposes solutions and repairs the fault. Accurate classification of faults is a key step in rapid repair. Accurate classification can significantly improve repair efficiency and reduce the impact of faults on the system.

[0004] Existing fault classification methods are mainly divided into manual log analysis and rule-based classification methods. However, when classifying large-scale distributed software system faults, manual log analysis methods require a lot of time and effort, and are prone to ignoring implicit fault clues. Rule-based classification methods may miss or misreport when the fault mode is complex or unknown. At the same time, manually maintaining rule systems has great limitations and high maintenance costs when facing dynamically changing distributed environments. Therefore, how to achieve fast and accurate fault classification is a problem that needs to be solved urgently. Summary of the invention

[0005] Embodiments of the present invention provide an information system fault classification method, apparatus, device, medium and product, so as to realize accurate classification of fault types based on log data when a system fault occurs.

[0006] According to one aspect of the present invention, there is provided a method for classifying information system faults, comprising:

[0007] Obtaining log data corresponding to the information system for fault classification;

[0008] Inputting the log data into a fault detection model to obtain a fault description text;

[0009] A fault classification result is determined according to the fault description text.

[0010] In some embodiments of the present invention, before inputting the log data into a fault detection model to obtain a fault description text, the method further includes:

[0011] Acquire a fault data set, and construct a fault knowledge graph based on the fault data set;

[0012] Obtaining a fault report, and constructing a fault knowledge base according to the fault knowledge graph and the fault report;

[0013] A fault detection model is constructed based on the fault knowledge base.

[0014] In some embodiments of the present invention, obtaining a fault data set and constructing a fault knowledge graph according to the fault data set includes:

[0015] Acquire a fault data set, and preprocess the fault data set to obtain an entity set;

[0016] Obtaining point mutual information between each entity pair in the entity set;

[0017] The fault knowledge graph is constructed based on the point mutual information between each entity pair.

[0018] In some embodiments of the present invention, obtaining a fault report and constructing a fault knowledge base according to the fault knowledge graph and the fault report includes:

[0019] Obtain a fault report and extract a title corresponding to the fault report;

[0020] Determine a fault cluster set according to a title corresponding to the fault report;

[0021] Determine, according to the fault knowledge graph, a related entity set corresponding to each fault cluster in the fault cluster set;

[0022] According to each fault cluster, the corresponding related entity set is determined to construct the fault knowledge base.

[0023] In some embodiments of the present invention, determining a fault classification result according to the fault description text includes:

[0024] Matching the fault description text with the fault knowledge graph to obtain a matching result;

[0025] A fault classification result is determined according to the matching result and the fault knowledge base.

[0026] In some embodiments of the present invention, after obtaining a fault data set and constructing a fault knowledge graph according to the fault data set, the method further includes:

[0027] If the first error information exists in the fault knowledge graph, modify the fault knowledge graph;

[0028] If the second error information exists in the fault knowledge graph, the operation of obtaining a fault data set and constructing a fault knowledge graph according to the fault data set is returned to be executed.

[0029] According to another aspect of the present invention, there is provided an information system fault classification device, the device comprising:

[0030] An acquisition module is used to acquire log data corresponding to the information system for fault classification;

[0031] An input module, used for inputting the log data into a fault detection model to obtain a fault description text;

[0032] A determination module is used to determine a fault classification result according to the fault description text.

[0033] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0034] at least one processor; and

[0035] a memory communicatively connected to the at least one processor; wherein,

[0036] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the information system fault classification method described in any embodiment of the present invention.

[0037] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the information system fault classification method described in any embodiment of the present invention when executed.

[0038] According to another aspect of the present invention, an embodiment of the present invention further provides a computer program product, the computer program product includes a computer program, and when the computer program is executed by a processor, the information system fault classification method described in any embodiment of the present invention is implemented.

[0039] The embodiment of the present invention obtains the log data to be classified for faults corresponding to the information system, inputs the log data into the fault detection model, obtains the fault description text, and determines the fault classification result according to the fault description text. Through the technical solution of the present invention, it is possible to accurately classify the fault type based on the log data when the system fault occurs, and help maintenance personnel to perform efficient and targeted fault processing, thereby reducing the losses caused by the fault.

[0040] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0042] Figure 1 is a flow chart of a method for classifying information system faults in an embodiment of the present invention;

[0043] Figure 2 is a structural diagram of an information system fault classification device in an embodiment of the present invention;

[0044] Figure 3 It is a structural schematic diagram of an electronic device for implementing the information system fault classification method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0045] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0046] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and their meanings are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0047] It is understandable that before using the technical solutions disclosed in the embodiments of the present disclosure, the types, scope of use, usage scenarios, etc. of the personal information involved in the present disclosure should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0048] Embodiment 1

[0049] Figure 1 is a flow chart of an information system fault classification method in an embodiment of the present invention. This embodiment is applicable to the case of large-scale distributed software system fault classification. The method can be executed by an information system fault classification device in an embodiment of the present invention. The device can be implemented in software and / or hardware, such as Figure 1 As shown, the method specifically comprises the following steps:

[0050] S101: Obtain log data corresponding to an information system for fault classification.

[0051] The information system fault classification method of the embodiment of the present invention can be applied to a large-scale distributed software system. The information system can be, for example, a large-scale distributed software system. In this embodiment, the log data can be data in the log of the large-scale distributed software system when a system fault occurs.

[0052] It should be noted that the information system fault classification method of the embodiment of the present invention can classify faults not only on log data, but also on fault report data. Specifically, users can upload log data or fault report data of a large distributed software system, and quickly analyze it through a fault detection model to generate a fault classification result.

[0053] The technical solution of the embodiment of the present invention adopts a classification method based on log data, so that a large-scale distributed software system can quickly identify the fault type when facing an actual fault, thereby helping maintenance personnel to perform repairs more specifically and improving the efficiency of fault handling.

[0054] S102: Input the log data into a fault detection model to obtain a fault description text.

[0055] In this embodiment, the fault detection model may be a large language model for analyzing the log data or fault report data uploaded by the user, and this embodiment does not limit the specific type of the fault detection model. Among them, the fault description text may be a simplified fault description text generated by the fault detection model after analyzing the log data or fault report data uploaded by the user.

[0056] Specifically, users upload log data or fault report data to the system, and use the large language model to generate concise fault description text.

[0057] S103: Determine a fault classification result according to the fault description text.

[0058] The fault classification result may be a result of determining the specific type of fault that a system fault occurring in a large-scale distributed software system belongs to.

[0059] Specifically, the large language model analyzes the log data or fault report data uploaded by the user and generates a concise fault description text, and then determines the final fault classification result based on the fault description text.

[0060] The embodiment of the present invention obtains the log data to be classified for faults corresponding to the information system, inputs the log data into the fault detection model, obtains the fault description text, and determines the fault classification result according to the fault description text. Through the technical solution of the present invention, it is possible to accurately classify the fault type based on the log data when the system fault occurs, and help maintenance personnel to perform efficient and targeted fault processing, thereby reducing the losses caused by the fault.

[0061] Optionally, before inputting the log data into the fault detection model to obtain the fault description text, the following is further included:

[0062] Obtain a fault data set and build a fault knowledge graph based on the fault data set.

[0063] The information system fault classification method according to the embodiment of the present invention may be applicable to a large-scale distributed software system. In this embodiment, the fault data set may be log data of the large-scale distributed software system when a system fault occurs.

[0064] It should be noted that the fault knowledge graph may be a knowledge graph used to represent the relationship between fault entities in a fault data set corresponding to a large distributed software system.

[0065] Specifically, this embodiment can collect fault logs of a large-scale distributed software system when a system failure occurs, and perform relevant calculations based on the collected fault logs to construct a fault knowledge graph.

[0066] In actual operation, logs can be obtained from multiple data sources, including: VM management platform (Virtual Machine Management Platform) and SDDC controller (Software-Defined Data Center Controller) (monitoring individual hosts and virtual networks in turn), physical network devices (routers, switches, firewalls, etc.), public cloud providers' APIs (Application Programming Interfaces), and Netflow (Network Flow) / IPFIX (Internet Protocol Flow Information Export) data sources to obtain data flow information.

[0067] Obtain fault reports and construct a fault knowledge base based on the fault knowledge graph and fault reports.

[0068] The fault report may be a fault report of a large-scale distributed software system when a system fault occurs.

[0069] In this embodiment, the fault knowledge base may be a knowledge base for storing the relationships between related entities corresponding to various fault types in a system fault report corresponding to a large-scale distributed software system.

[0070] Specifically, the fault reports of large-scale distributed software systems are obtained, and a system fault knowledge base is constructed according to the system fault knowledge graph and the system fault reports.

[0071] Build a fault detection model based on the fault knowledge base.

[0072] Specifically, a large-scale distributed software system fault detection model is constructed based on the system fault knowledge base.

[0073] Optionally, a fault data set is obtained, and a fault knowledge graph is constructed based on the fault data set, including:

[0074] Obtain a fault data set, preprocess the fault data set, and obtain an entity set.

[0075] Specifically, relevant system logs of system failures of large-scale distributed software systems are collected and aggregated to form a failure data set, and then the failure data set is preprocessed. In actual operation, the preprocessing process can be to clean the failure data set, and the steps of cleaning the failure data can specifically include: using regular expressions and parsers to remove tables with more than two columns in the event description and clear HTML (Hyper Text Markup Language) tags; using line breaks to split information into sentences; cleaning extra spaces and other special characters; using NLTK (Natural Language Toolkit) and other word segmentation technologies to split sentences into multiple words.

[0076] It should be noted that the entity set may be a set of entity pairs in the form of key-value pairs composed of some information included in the fault data set, wherein the entity type name is the key and the entity value is the part after the key. Exemplarily, the entity type name may include: problem type, operation name, tenant ID, VnetID, connection details, source IP address, and status code, etc.

[0077] Specifically, a fault data set is obtained, data cleaning is performed on the fault data set, a candidate entity set is determined, and a common structural pattern of the fault data set is parsed in the form of key-value pairs, where the entity type name is the key and the entity value is the part after the key.

[0078] In the actual operation process, it is also necessary to clean up the candidate entity set, remove the candidate entity type names containing symbols or numbers, and then further extract n-grams (n: 1 to 3) from the candidate entity type names, and select the most frequently occurring top K (K value can be set by the user according to actual needs or experience, and this embodiment does not limit this value) n-grams as new entity type names.

[0079] Get the pointwise mutual information between each pair of entities in the entity collection.

[0080] It is known that Pointwise Mutual Information (PMI) is a statistic that measures the correlation between two events, especially in natural language processing to measure the co-occurrence relationship between words. PMI can be applied to binary relations, that is, the relationship between two variables, to assess whether they tend to appear together.

[0081] In this embodiment, the co-occurrence of entity pairs in the same sentence is used to extract binary relations, and point mutual information is used to measure the relevance of two entities in the entity pair. The point mutual information calculation formula is as follows:

[0082]

[0083] Among them, p(x,y) is the probability of two entities in the entity pair occurring simultaneously, that is, the joint probability of the two, p(x) is the probability of one entity in the entity pair occurring, and p(y) is the probability of the other entity in the entity pair occurring.

[0084] Specifically, if the pmi(x;y) value is greater than 0, it means that the frequency of the two entities in the entity pair appearing together is higher than the product of their independent probabilities, which means that there is a positive correlation between the two entities in the entity pair; if the pmi(x;y) value is less than 0, it means that the frequency of the two entities in the entity pair appearing together is lower than the product of their independent probabilities, which means that there is a negative correlation between the two entities in the entity pair; if the pmi(x;y) value is 0, it means that the two entities in the entity pair are independent of each other. Therefore, in the actual operation process, all entity pairs with pmi(x;y) values ​​less than 0 can be removed as noise to obtain a binary entity relationship set.

[0085] The technical solution of the embodiment of the present invention effectively reduces the influence of noise data and improves the robustness of the model by using point mutual information technology.

[0086] The fault knowledge graph is constructed based on the point mutual information between each entity pair.

[0087] Specifically, the binary entity relationship set obtained above is used to construct an undirected knowledge graph G = (V, E), that is, a fault knowledge graph, where V is an entity, E is a binary relationship between entity pairs, and the edge weight is the value of pmi (x; y) between two entity pairs.

[0088] Optionally, obtain a fault report and construct a fault knowledge base based on the fault knowledge graph and the fault report, including:

[0089] Get the fault report and extract the title corresponding to the fault report.

[0090] Specifically, a fault report of a large distributed software system is obtained, and a title of the fault report is extracted.

[0091] The fault cluster set is determined according to the title corresponding to the fault report.

[0092] It should be noted that the fault cluster set may be a set consisting of a series of fault clusters obtained by clustering the titles of the fault reports.

[0093] In this embodiment, after extracting the system fault report title, NLTK technology can be used to segment it, and then it is converted into GloVe (Global Vectors for Word Representation, a technology for generating word vectors, which learns the vector representation of words by capturing the co-occurrence statistics between words in a large-scale corpus) vectors based on the segmentation, and the GloVe vector of each word is averaged to obtain the embedding vector of the title. Then, DBSCAN (Density-Based Spatial Clustering of Applications with Noise, a density-based clustering algorithm that can find clusters of any shape in a spatial data set with noise) clustering analysis algorithm is used to cluster the title to obtain a series of fault clusters, and the faults in each fault cluster belong to the same fault type.

[0094] According to the fault knowledge graph, the relevant entity set corresponding to each fault cluster in the fault cluster set is determined.

[0095] In this embodiment, the related entity set may be a set consisting of entities related to each fault cluster.

[0096] In the actual operation process, the system fault report and the constructed system fault knowledge graph are combined to infer a set of related entities for each fault cluster. The specific process may include: for each fault cluster, extract the top 5 entities with the highest event occurrence frequency in the fault cluster, and among these 5 entities, find the first entity that exists in the previously constructed fault knowledge graph G = (V, E) as the main entity of the fault cluster (which can be expressed as e p , with the main entity e p As the source node, find the shortest path to other reachable entities and calculate the correlation between the reachable entities and the fault cluster based on the shortest path. The correlation calculation formula is:

[0097]

[0098] Among them, relation-score(e x ; C) represents the reachable entity e x The association between the fault clusters, path(ep,ex) represents the shortest path from the primary entity ep to the reachable entity ex, and C represents the fault cluster.

[0099] Then, the first k related entities related to the fault cluster are selected according to the correlation size (k can be specified by the user and is not limited in this embodiment) to construct a related entity set for this type of fault.

[0100] According to each fault cluster, the corresponding related entity set is determined to construct the fault knowledge base.

[0101] Specifically, based on the fault types in the system fault report, the relevant entity sets of each type of fault are summarized to construct a system fault knowledge base.

[0102] Based on the above construction of the system fault knowledge base according to the system fault knowledge graph and the system fault report, the log data is input into the fault detection model, and the detailed process of obtaining the fault description text can be described as follows: In the actual operation process, the large-scale distributed software system fault classification large model (i.e., fault detection model) processing method is: Text parsing: Parse the key components, services and fault modes in the fault description text, and extract related entities and relationships; Semantic merging and supplementing: For multiple fault cause descriptions, the large language model will perform semantic analysis, identify possible similar or repeated information, and merge the same or similar fault causes. At the same time, the large language model can automatically supplement the missing information according to the context to ensure the integrity and coherence of the text; Generate concise text: After processing, the generated fault cause text is more concise and structured, highlighting the root cause of the system failure, the scope of influence and related components; Output classification results: The large language model outputs the fault category corresponding to the fault description text based on the system fault knowledge base.

[0103] Optionally, the fault classification result is determined according to the fault description text, including:

[0104] Match the fault description text with the fault knowledge graph to obtain the matching result.

[0105] In this embodiment, the matching result may be the key entities and the connections between entities contained in the log data obtained after analyzing the fault description text and matching it with the fault knowledge graph.

[0106] Specifically, the user uploads the log data to be classified for faults, uses the large language model to generate concise fault description text, analyzes it and matches it with the fault knowledge graph to obtain the connection between key entities.

[0107] The fault classification result is determined based on the matching result and the fault knowledge base.

[0108] Specifically, the final classification result is output based on the matching result and the data in the system fault knowledge base.

[0109] The technical solution of the embodiment of the present invention, by combining knowledge graph and large language model technology, can effectively handle the differences in log structures of different components in large-scale distributed software systems, thereby enhancing the accuracy of fault classification.

[0110] Optionally, after obtaining the fault data set and constructing the fault knowledge graph according to the fault data set, it also includes:

[0111] If the first error information exists in the fault knowledge graph, the fault knowledge graph is modified.

[0112] In this embodiment, the first error information may be an entity relationship error or an inaccurate attribute value. For example, an attribute value of an individual entity in the fault knowledge graph is wrong, or a relationship description of an edge is wrong.

[0113] In actual operation, the fault knowledge graph can be checked regularly. This process requires careful checking whether there is any erroneous information in the fault knowledge graph, such as entity relationship errors, inaccurate attribute values, etc., as well as whether there is outdated information. When it is found that the information in the fault knowledge graph needs to be updated, different measures need to be taken according to the scale and nature of the update.

[0114] For example, if a small amount of information needs to be modified, such as a change in an attribute value of an individual entity, or a relationship description of an edge needs to be fine-tuned, it can be edited directly in the fault knowledge graph.

[0115] If the second error information exists in the fault knowledge graph, the operation of obtaining the fault data set and constructing the fault knowledge graph according to the fault data set is returned.

[0116] Exemplarily, in this embodiment, the presence of the second error information in the fault knowledge graph may refer to a situation in which a large number of entity relationship errors or inaccurate attribute values ​​exist in the fault knowledge graph and need to be reconstructed.

[0117] Specifically, if the fault knowledge graph involves the modification of a large amount of information, it is necessary to collect the system fault reports again, preprocess the system fault reports, and perform named entity recognition, entity relationship extraction and other steps based on the preprocessing results to rebuild the fault knowledge graph.

[0118] In actual operation, the fault knowledge base can be version controlled. Each time the fault knowledge base is updated, a new version is created, and the updated content and reasons are recorded in detail to ensure data consistency and traceability. The technical solution of the embodiment of the present invention provides a strong guarantee for the long-term maintenance and management of the fault knowledge base through the version control mechanism of the fault knowledge base, which helps to improve the stability and reliability of the fault knowledge base.

[0119] The technical solution of the embodiment of the present invention, by constructing a fault knowledge graph and a large language model, can make full use of the implicit relationship in the system fault data, comprehensively analyze the association between each performance indicator and different fault types, and make the fault classification result more credible. Specifically, the embodiment of the present invention adopts a classification method based on log data, so that the system can quickly identify the fault type when facing an actual fault, thereby helping maintenance personnel to repair more targetedly and improving the efficiency of fault handling. In addition, the embodiment of the present invention effectively reduces the influence of noise data and improves the robustness of the model by using point mutual information technology. In addition, the version control mechanism of the fault knowledge base in the embodiment of the present invention provides a strong guarantee for the long-term maintenance and management of the fault knowledge base, which helps to improve the stability and reliability of the fault knowledge base. The method for classifying faults of large-scale distributed software systems constructed based on the embodiment of the present invention can classify faults based on the log data generated when a large-scale distributed software system fails, and can comprehensively consider the differences in the log structures of different components of the distributed system, as well as the degree of association between each performance indicator and each type of fault, which not only improves the operating efficiency of the model used in the method of this embodiment, but also makes the results output by the method of this embodiment have a certain degree of credibility.

[0120] Embodiment 2

[0121] Figure 2 is a schematic diagram of the structure of an information system fault classification device in an embodiment of the present invention. This embodiment is applicable to the case of large-scale distributed software system fault classification. The device can be implemented in software and / or hardware. The device can be integrated in any device that provides the function of information system fault classification, such as Figure 2 As shown, the information system fault classification device specifically includes: an acquisition module 201, an input module 202 and a determination module 203.

[0122] Wherein, the acquisition module 201 is used to acquire the log data to be classified for faults corresponding to the information system;

[0123] An input module 202 is used to input the log data into a fault detection model to obtain a fault description text;

[0124] The determination module 203 is used to determine a fault classification result according to the fault description text.

[0125] Optionally, the device further comprises:

[0126] A first construction module is used to obtain a fault data set and construct a fault knowledge graph according to the fault data set;

[0127] A construction module, used for obtaining a fault report and constructing a fault knowledge base according to the fault knowledge graph and the fault report;

[0128] The second building module is used to build a fault detection model based on the fault knowledge base.

[0129] Optionally, the first building module is specifically used for:

[0130] Acquire a fault data set, and preprocess the fault data set to obtain an entity set;

[0131] Obtaining point mutual information between each entity pair in the entity set;

[0132] The fault knowledge graph is constructed based on the point mutual information between each entity pair.

[0133] Optionally, the construction module is specifically used for:

[0134] Obtain a fault report and extract a title corresponding to the fault report;

[0135] Determine a fault cluster set according to a title corresponding to the fault report;

[0136] Determine, according to the fault knowledge graph, a related entity set corresponding to each fault cluster in the fault cluster set;

[0137] According to each fault cluster, the corresponding related entity set is determined to construct the fault knowledge base.

[0138] Optionally, the determining module 203 is specifically configured to:

[0139] Matching the fault description text with the fault knowledge graph to obtain a matching result;

[0140] A fault classification result is determined according to the matching result and the fault knowledge base.

[0141] Optionally, the device further comprises:

[0142] A modification module, configured to modify the fault knowledge graph if first error information exists in the fault knowledge graph;

[0143] The execution module is used to return to the operation of obtaining a fault data set and constructing a fault knowledge graph according to the fault data set if there is second error information in the fault knowledge graph.

[0144] The above-mentioned product can execute the information system fault classification method provided by any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0145] Embodiment 3

[0146] Figure 3A schematic diagram of the structure of an electronic device 30 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0147] like Figure 3 As shown, the electronic device 30 includes at least one processor 31, and a memory connected to the at least one processor 31, such as a read-only memory (ROM) 32, a random access memory (RAM) 33, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 31 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 32 or the computer program loaded from the storage unit 38 to the random access memory (RAM) 33. In the RAM 33, various programs and data required for the operation of the electronic device 30 can also be stored. The processor 31, the ROM 32, and the RAM 33 are connected to each other through a bus 34. An input / output (I / O) interface 35 is also connected to the bus 34.

[0148] A number of components in the electronic device 30 are connected to the I / O interface 35, including: an input unit 36, such as a keyboard, a mouse, etc.; an output unit 37, such as various types of displays, speakers, etc.; a storage unit 38, such as a disk, an optical disk, etc.; and a communication unit 39, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 39 allows the electronic device 30 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0149] The processor 31 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 31 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The processor 31 executes the various methods and processes described above, such as the information system fault classification method:

[0150] Obtaining log data corresponding to the information system for fault classification;

[0151] Inputting the log data into a fault detection model to obtain a fault description text;

[0152] A fault classification result is determined according to the fault description text.

[0153] In some embodiments, the information system fault classification method can be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 38. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 30 via the ROM 32 and / or the communication unit 39. When the computer program is loaded into the RAM 33 and executed by the processor 31, one or more steps of the information system fault classification method described above can be performed. Alternatively, in other embodiments, the processor 31 can be configured to execute the information system fault classification method in any other appropriate manner (for example, by means of firmware).

[0154] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0155] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0156] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0157] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0158] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0159] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0160] In one embodiment, the present invention further includes a computer program product, the computer program product includes a computer program, and when the computer program is executed by a processor, the information system fault classification method of any embodiment of the present invention is implemented.

[0161] In the process of implementation, the computer program product can be written in one or more programming languages ​​or a combination thereof to perform the computer program code of the present invention, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (for example, using an Internet service provider to connect through the Internet).

[0162] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0163] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for classifying information system faults, characterized in that: include: Obtaining log data corresponding to the information system for fault classification; Inputting the log data into a fault detection model to obtain a fault description text; A fault classification result is determined according to the fault description text.

2. The method according to claim 1, characterized in that Before inputting the log data into the fault detection model to obtain the fault description text, the method further includes: Acquire a fault data set, and construct a fault knowledge graph based on the fault data set; Obtaining a fault report, and constructing a fault knowledge base according to the fault knowledge graph and the fault report; A fault detection model is constructed based on the fault knowledge base.

3. The method according to claim 2, characterized in that Obtaining a fault data set and constructing a fault knowledge graph based on the fault data set, including: Acquire a fault data set, and preprocess the fault data set to obtain an entity set; Obtaining point mutual information between each entity pair in the entity set; The fault knowledge graph is constructed based on the point mutual information between each entity pair.

4. The method according to claim 2, characterized in that: Obtaining a fault report and constructing a fault knowledge base according to the fault knowledge graph and the fault report, including: Obtain a fault report and extract a title corresponding to the fault report; Determine a fault cluster set according to a title corresponding to the fault report; Determine, according to the fault knowledge graph, a related entity set corresponding to each fault cluster in the fault cluster set; According to each fault cluster, the corresponding related entity set is determined to construct the fault knowledge base.

5. The method according to claim 2, characterized in that: Determining a fault classification result according to the fault description text includes: Matching the fault description text with the fault knowledge graph to obtain a matching result; A fault classification result is determined according to the matching result and the fault knowledge base.

6. The method according to claim 2, characterized in that After obtaining the fault data set and constructing the fault knowledge graph according to the fault data set, the method further includes: If the first error information exists in the fault knowledge graph, modify the fault knowledge graph; If the second error information exists in the fault knowledge graph, the operation of obtaining a fault data set and constructing a fault knowledge graph according to the fault data set is returned to be executed.

7. An information system fault classification device, characterized in that: include: An acquisition module is used to acquire log data corresponding to the information system for fault classification; An input module, used for inputting the log data into a fault detection model to obtain a fault description text; A determination module is used to determine a fault classification result according to the fault description text.

8. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the information system fault classification method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the information system fault classification method according to any one of claims 1 to 6 when executed.

10. A computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the computer program implements the information system fault classification method according to any one of claims 1 to 6.

Images