Method and system for automatic analysis of inspection data

Abstract

The application provides a kind of inspection data automatic analysis method and system, by obtaining the inspection record text of abnormal identification recorded in inspection terminal in the process of machine room inspection, obtain inspection record text processing neural network, based on inspection record text processing neural network, the abnormal record identification of abnormal identification of inspection record text is carried out, and the abnormal record identification result is obtained, when the abnormal record identification result indicates that the abnormal record is identified, the abnormal record identified in the inspection terminal is displayed and marked.The application is based on the determination of a plurality of target abnormal record identification results for transfer learning, the transfer effect is better, at the same time, the relevance information between the contents in the same inspection record text is measured, and it is fused with the information based on the representation information and the information based on the output, so that the identification accuracy of the guided neural network is higher than that of the guide neural network, and the abnormal record identification effect of the inspection record text processing neural network is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, and particularly relates to a method and system for automatically analyzing inspection data. BACKGROUND

[0002] With the rapid development of information technology, the scale of data center rooms is continuously expanding, and there are numerous and complex devices in the room, including servers, network devices, storage devices, etc. In order to ensure the normal operation of the room, room inspection has become a crucial task. Traditional room inspection mainly relies on manual operation, and the inspection personnel checks the devices in the room one by one according to the predetermined inspection route and project, and manually records the running state, parameters and other information of the devices. However, this manual inspection method has many drawbacks.

[0003] In order to improve the efficiency and accuracy of room inspection, automatic inspection technology has emerged. The automatic inspection system can automatically collect the running data of the devices, such as obtaining the temperature, power and other information of the devices through sensors, and obtaining the configuration parameters and running state of the devices through network management protocols. However, when facing a large amount of inspection data, how to effectively analyze these data and accurately identify abnormal records remains a problem to be solved.

[0004] The existing data automatic analysis technology has some limitations when processing room inspection data. Some traditional data analysis methods may rely on simple threshold setting or rule-based judgment to identify abnormalities. For example, if the CPU usage rate of a server exceeds a certain fixed value (such as 80%), it is determined to be abnormal. However, this method lacks flexibility and cannot adapt to the dynamic changes of device running states, because in some cases, even if the CPU usage rate temporarily exceeds 80%, the device may be in a normal load peak state, not a real abnormality.

[0005] In addition, although the data analysis method based on machine learning has a certain intelligence, it also faces challenges when applied to room inspection data. For example, when constructing a neural network to identify abnormal records, traditional network training methods usually require manual sample arrangement, including proportional division of samples and other operations. This not only consumes time and effort, but also easily introduces human errors. Moreover, in order to guide the neural network to learn the key features in the data, text segment annotation is often performed in the sample text to guide transfer learning. This method not only increases the complexity of data preprocessing, but also greatly affects the final analysis results due to the accuracy and completeness of the annotation.

[0006] Meanwhile, some existing neural network models may not fully consider the relevance between different contents in the inspection record text when processing the machine room inspection data, resulting in insufficient accuracy in identifying abnormal records. For example, there is a correlation between the port connection state of the network device and the network communication condition of the server, but the traditional model may not be able to capture this correlation well, thereby affecting the judgment of the overall abnormal situation. SUMMARY

[0007] Therefore, the embodiments of the present application at least provide a kind of inspection data automatic analysis method and system. The technical scheme of the present application is realized as follows:

[0008] In one aspect, the present application provides a kind of inspection data automatic analysis method, the method comprises: obtaining the abnormal record identification of the inspection record text recorded in the inspection terminal in the process of machine room inspection;Obtain inspection record text processing neural network;The abnormal record identification of the inspection record text is carried out based on the inspection record text processing neural network, and abnormal record identification result is obtained;When the abnormal record identification result indicates that abnormal record is identified, the abnormal record identified in the inspection terminal is marked and displayed;Wherein, the inspection record text processing neural network is the guide neural network completed by prior debugging, and is obtained by self-knowledge refining according to the representation information transfer learning generation value, the relevance transfer learning generation value and the output transfer learning generation value, the representation information transfer learning generation value is obtained based on the error between the representation information of the guide neural network and the representation information of the inspection record text processing neural network, the relevance transfer learning generation value is obtained based on the relevance between different text segments in the same inspection record text, and the output transfer learning generation value is obtained based on the error between the output of the guide neural network and the output of the inspection record text processing neural network.

[0009] In another aspect, the present application provides a computer system comprising a memory and a processor, the memory storing a computer program executable on the processor, and the processor executes the program to realize the steps in the above method.

[0010] The beneficial effects of the present application include: the present application obtains the inspection record text of the suspected abnormality identification recorded in the inspection terminal in the machine room inspection process, and obtains the inspection record text processing neural network. The inspection record text processing neural network is a guided neural network completed through prior debugging. According to the feature information migration learning generation value, the correlation migration learning generation value, and the output migration learning generation value, self-knowledge refinement is performed to obtain the feature information migration learning generation value, the correlation migration learning generation value, and the output migration learning generation value. The feature information migration learning generation value is obtained based on the error between the feature information of the guided neural network and the feature information of the inspection record text processing neural network. The correlation migration learning generation value is obtained based on the correlation between different text segments in the same inspection record text. The output migration learning generation value is obtained based on the error between the output of the guided neural network and the output of the inspection record text processing neural network. Based on the inspection record text processing neural network, the inspection record text of the suspected abnormality identification is identified, and the abnormal record identification result is obtained. When the abnormal record identification result indicates that the abnormal record is identified, the identified abnormal record is displayed and marked in the inspection terminal. The present application performs migration learning based on the determination of the plurality of target abnormal record identification results, the migration effect is better, the correlation between the contents in the same inspection record text is measured, and the information based on the feature information and the information based on the output are fused, so that the identification accuracy of the guided neural network is higher than that of the guided neural network, and the abnormal record identification effect of the inspection record text processing neural network is improved. In addition, during network training, the present application does not need to artificially arrange samples, such as proportion division, and does not need to annotate text segments in sample texts to guide migration learning. Because the present application determines the target abnormal record identification result in the inspection record training text, which represents that there are different text segments with dense feature information in the inspection record training text, a model is constructed through the correlation information between the target abnormal record identification results, which can not only prevent migration learning using sample annotation segments related text paragraphs, but also combine the correlation information between different text segments in the inspection record training text to improve the robustness of the neural network. BRIEF DESCRIPTION OF DRAWINGS

[0011] Figure 1 An implementation flowchart of a kind of inspection data automatic analysis method provided by the embodiment of the present application.

[0012] Figure 2 A hardware entity schematic diagram of a kind of computer system provided by the embodiment of the present application. DETAILED DESCRIPTION

[0013] Embodiments of the present application provide a kind of automatic analysis method of inspection data, which can be executed by the processor of computer system. Wherein, computer system can refer to server, notebook computer, tablet computer, desktop computer and so on data processing capacity equipment. As shown in Figure 1 The method comprises:

[0014] Step S110: obtaining the inspection record text of abnormality identification recorded in the inspection terminal in the process of machine room inspection.

[0015] In the process of machine room inspection, a large number of data records will be generated, which exist in the form of text on the inspection terminal. In step S110, the computer system obtains the inspection record text of abnormality identification recorded in the inspection terminal in the process of machine room inspection.

[0016] Machine room inspection is an important work to ensure the normal operation of various equipment (such as server, network equipment, air conditioner, etc.) in machine room. During inspection, the inspector will check the equipment according to certain standards and procedures, and record the inspection results, which constitute the inspection record text. For example, the inspector may record the CPU usage, memory occupancy, temperature and other parameters of the server, the port connection state, traffic and other information of the network equipment, the temperature setting, running mode and other conditions of the air conditioner. These records may be numbers, state descriptions (such as "normal" "abnormal") or some operation records (such as "restart the device" "adjust the parameters") and so on. The inspection record text of abnormality identification refers to the inspection record that the computer system initially considers may contain abnormal condition. The computer system preliminarily screens out the records that may exist abnormality by some simple rules or algorithms. For example, for the CPU usage of server, if the normal range is set to 30%-70%, when the CPU usage in the record is 85%, the inspection record text containing the CPU usage record may be regarded as the inspection record text of abnormality identification by the computer system. For example, for the port connection state of network equipment, if the record shows that the port connection frequently interrupts, the inspection record text containing the port connection state record will also be regarded as the inspection record text of abnormality identification.

[0017] In the embodiments of the present application, the computer system can obtain the inspection record text for suspected anomaly identification by setting a threshold. For numerical inspection data, such as the temperature and usage rate of a device, upper and lower threshold values can be set. Assuming that the normal range of the temperature of a device is [18°C, 27°C], when the temperature value T in the inspection record satisfies T < 18°C or T > 27°C, the inspection record text containing the temperature value record is marked as the inspection record text for suspected anomaly identification. For state-type inspection data, such as the operating state (normal, fault, etc.) of a device, a state dictionary can be established. If the device state in the record does not match the definition in the normal state dictionary, the inspection record text containing the device state record is regarded as the inspection record text for suspected anomaly identification. For some operation records, such as the number of restarts of a device, if the number of restarts exceeds the set threshold value (such as more than 3 times per hour) within a certain time, the related inspection record text is also regarded as the inspection record text for suspected anomaly identification. This way of obtaining the inspection record text for suspected anomaly identification provides a basis for subsequent anomaly record identification. By first screening out the inspection record text that may have anomalies, the amount of data for subsequent processing can be reduced, and the processing efficiency can be improved. At the same time, this preliminary screening also helps to focus on the areas that may have problems, so that the subsequent anomaly record identification based on the inspection record text processing neural network is more targeted.

[0018] Step S120: Obtain an inspection record text processing neural network.

[0019] The inspection record text processing neural network is obtained by self-knowledge refining of the pre-debugged guide neural network according to the representation information transfer learning generation value, the correlation transfer learning generation value and the output transfer learning generation value. The representation information transfer learning generation value is obtained based on the error between the representation information of the guide neural network and the representation information of the inspection record text processing neural network. The correlation transfer learning generation value is obtained based on the correlation between different text segments in the same inspection record text. The output transfer learning generation value is obtained based on the error between the output of the guide neural network and the output of the inspection record text processing neural network. The guide neural network is a neural network that is pre-constructed and debugged, and has certain performance in the inspection record text processing related task. For example, in the process of processing the machine room inspection record text, the network has been trained with a large amount of labeled data (for example, it is known which inspection record text corresponds to the normal or abnormal state of the device), and can perform preliminary anomaly identification on the inspection record text. Assuming that in a simple machine room inspection scenario, for the server inspection record text, the guide neural network can judge the new inspection record text according to the various parameters learned in the past (such as CPU usage, memory occupation, etc.) in the normal state of the server, and give a preliminary conclusion of whether there is an anomaly. The representation information transfer learning generation value is obtained based on the error between the representation information of the guide neural network and the representation information of the inspection record text processing neural network. The representation information of the neural network refers to the internal representation of the data formed by the network in the process of processing the data. In the process of processing the inspection record text, assuming that the inspection record text contains various parameters of the device, such as the CPU usage of the server is 50%, the memory occupation is 30% and the like, the guide neural network may represent it as a specific vector form, such as [0.3, 0.5, …] (here is only a simple example, the actual dimension may be high). The inspection record text processing neural network will also form its own representation information for the same inspection record text, assuming [0.32, 0.48, …]. Then the representation information transfer learning generation value can be obtained by calculating the distance measure between the two vectors, for example, the Euclidean distance formula: d = sqrt{\sum_{i=1}^{n}(x_i-y_i)^2}, wherein x_i and y_i are elements in the representation information vector of the guide neural network and the inspection record text processing neural network respectively, and n is the dimension of the vector. This distance measure reflects the difference between the representation information of the two networks, that is, the representation information transfer learning generation value.

[0020] The relevance transfer learning generation value is obtained based on the relevance between different text segments in the same inspection record text. In the inspection record text, there can be various connections between different text segments. For example, for a computer room inspection record text, one part records that the CPU usage of the server is too high, and another part records that the server cooling fan speed is abnormal at the same period. There is a relevance between the two text segments because the CPU usage is too high, which can cause the cooling demand to increase, thereby being related to the cooling fan speed. The computer system can quantify this relevance through some technical means. One possible method is to construct a co-occurrence matrix. Assuming that the inspection record text is divided into several text segments, for each pair of text segments, if they appear together in a large number of inspection record texts, it is considered that they have a high relevance. For example, assuming that text segment A (CPU usage is too high) and text segment B (cooling fan speed is abnormal) appear together 30 times in 100 inspection record texts, and the total number of times A appears is 50, and the total number of times B appears is 40, then the relevance between them can be calculated by relevance = frac{number of times appearing together}{min(number of times A appears, number of times B appears)} = frac{30}{30} = 1 (here is only an example of a simple calculation method). Through the calculation of the relevance of a large number of text segments, the relevance transfer learning generation value can be determined.

[0021] Finally, the output transfer learning generation value is obtained based on the error between the output of the guide neural network and the output of the inspection record text processing neural network. Both the guide neural network and the inspection record text processing neural network generate outputs when processing inspection record texts. For example, for an inspection record text about an air conditioning device in a computer room, the guide neural network may output a probability of 0.6 that the air conditioning device has an anomaly (indicating a 60% possibility of an anomaly), and the inspection record text processing neural network may output a probability of 0.55 of an anomaly. The output transfer learning generation value can be obtained by calculating the absolute value of the difference between the two outputs, such as |0.6-0.55|=0.05. This value reflects the degree of difference between the outputs of the two networks. The inspection record text processing neural network obtained by the computer system is obtained by comprehensively considering the above-mentioned representation information transfer learning generation value, relevance transfer learning generation value, and output transfer learning generation value, and self-knowledge refining (self-distillation learning). Self-distillation learning is a knowledge transfer and model optimization technique. In this process, the inspection record text processing neural network obtains knowledge from the guide neural network and adjusts its own parameters to reduce the above-mentioned three generation values, thereby continuously optimizing its own performance. For example, the computer system can construct a total loss function according to the three generation values, such as L=α*representation information transfer learning generation value+β*relevance transfer learning generation value+γ*output transfer learning generation value (wherein α, β, γ are weight coefficients for adjusting the importance of different generation values in the total loss function). Then, the parameters of the inspection record text processing neural network are updated according to the loss function through the back propagation algorithm, so that the network can more accurately identify abnormal records when processing inspection record texts. The inspection record text processing neural network constructed by multiple generation values can utilize the existing knowledge of the guide neural network, while combining the relevance between different segments of the inspection record text and the representation information and output information of the network itself, to more accurately process the inspection record text for anomaly identification, thereby improving the performance and accuracy of the entire computer room inspection data automatic analysis system.

[0022] Step S130: performing abnormal record identification on the inspection record text for anomaly identification based on the inspection record text processing neural network to obtain an abnormal record identification result.

[0023] In step S130, the computer system performs abnormal record identification on the inspection record text for anomaly identification based on the inspection record text processing neural network, thereby obtaining an abnormal record identification result.

[0024] The inspection record text processing neural network is a specially constructed network that integrates multiple types of information to effectively process inspection record texts. The inspection record texts for anomaly identification are obtained in the previous step (S110). These texts are records that the computer system initially determines may have anomalies, containing various device-related information during the computer room inspection process, such as server operating parameters, network device connection states, etc. When the computer system uses the inspection record text processing neural network to identify abnormal records, the neural network will perform a series of complex calculations and analyses on the input inspection record texts. For example, for a record text about server inspection containing CPU usage, memory occupancy, disk I / O, etc., the neural network will extract features from these data according to its internal neuron structure and weight parameters. Assuming that the input layer of the neural network receives these inspection record text data, after processing by the hidden layer, the neurons in the hidden layer will perform nonlinear transformation on the input data. For example, a certain hidden layer neuron may perform weighted summation on the CPU usage and process it through an activation function (such as the ReLU function: f(x) = max(0, x)) to extract more meaningful features. In the process of identifying abnormal records, the neural network will match the extracted features with pre-learned patterns. For example, for the case of high CPU usage of a server, the neural network may have learned the normal CPU usage range during training. When the CPU usage in the input inspection record text exceeds this range, the neural network will identify it as a possible abnormal situation. This identification process involves the neural network's weight parameters, which are determined during network training and determine the importance of different features in anomaly identification.

[0025] In the embodiments of the present application, the calculation process of the neural network can be represented by matrix multiplication and vector operation. Assuming that the input inspection record text is represented as a vector x, the weight matrix of the neural network is W, and the bias vector is b, the output h of the hidden layer can be calculated by the formula h = f(Wx + b), where f is an activation function. In a multi-layer neural network, this process is performed in multiple hidden layers in turn, and finally the result of the output layer is obtained. The abnormal record identification result is the determination of the computer system based on the output of the inspection record text processing neural network whether the inspection record text is abnormal. This result can be a probability value representing the size of the possibility of the abnormality of the inspection record text; or it can be a clear classification result such as "normal" or "abnormal". For example, for an inspection record text of a network device, the neural network can output a probability value of 0.8, indicating that the network device has an abnormality possibility of 80%; or directly output the classification result of "abnormal". This abnormal record identification method based on the inspection record text processing neural network has great advantages over traditional methods. The traditional method may need to manually develop complex rules to determine whether the inspection record is abnormal, while the neural network can automatically learn various patterns from a large amount of training data and can handle complex nonlinear relationships. For example, when judging whether the mutual relationship between the multiple running parameters of a server is abnormal, the neural network can accurately identify some complex abnormal situations by learning a large amount of normal and abnormal data, which may be difficult to judge by simple manual rules. In addition, the accuracy of the inspection record text processing neural network depends on its construction and training process. In the construction process, as described in the previous step (S120), by considering the factors such as the representation information transfer learning generation value, the relevance transfer learning generation value, and the output transfer learning generation value, the network can better adapt to the processing task of the inspection record text. In the training process, a large amount of labeled inspection record text data is used to adjust the weight parameters of the network, so that the network can accurately identify abnormal records. For example, by using a data set containing a large number of known normal and abnormal server, network device, etc. inspection record text for training, the network can continuously optimize its own parameters and improve the accuracy of abnormal record identification.

[0026] Step S140: When the abnormal record identification result indicates that an abnormal record is identified, the identified abnormal record is displayed and marked in the inspection terminal.

[0027] In step S140, the computer system performs the operation of displaying and marking the identified abnormal record in the inspection terminal when the abnormal record identification result indicates that an abnormal record is identified.

[0028] The abnormal record identification result is obtained by analyzing the suspected abnormal record according to the inspection record text processing neural network in the previous step S130. This result shows whether there is an abnormal situation in the inspection record text. For example, for the server inspection record text in the computer room, if the CPU usage is too high, the memory occupancy is abnormal, or the network connection is unstable, etc. are identified by the inspection record text processing neural network, the abnormal record identification result will show that there is an abnormality. When the abnormal record identification result shows that there is an abnormality, the computer system needs to display and mark the abnormal record on the inspection terminal. The inspection terminal is a device used by the computer room inspection personnel to record and view the inspection data, which can be a special handheld inspection device or an interface terminal installed in the computer room management system. For example, on a handheld inspection device, the screen displays various inspection records, and normal records are presented in the form of ordinary text, and once the computer system determines that a certain inspection record is an abnormal record, it will be specially marked.

[0029] In the embodiment of the application, the computer system can realize this display marking in various ways. One feasible way is to change the display color of the abnormal record. Assuming that the normal inspection record text is displayed as black font on the inspection terminal, when an abnormal record is identified, the computer system can change its font color to red. This can be realized by setting color display rules in the display program of the inspection terminal. For example, if the variable r represents the state of the record (r=0 represents normal, r=1 represents abnormal), in the display function display(), the following rules can be set: when r=0, color="black"; when r=1, color="red", and then the text is displayed according to this color setting. Another way is to add a specific icon mark to the abnormal record. For example, there is a blank icon area beside each inspection record on the inspection terminal, and this area is empty for normal records, and when an abnormal record is identified, the computer system can add a warning icon, such as a red triangle or exclamation mark, to this icon area. In program implementation, specific icon files can be loaded in the corresponding icon display area by judging the abnormal record identification result.

[0030] In addition to visual markers, audio cues can also be used to remind the inspection personnel. When the computer system identifies an abnormal record, it can trigger the inspection terminal to emit a specific sound signal, such as a short beep or a specific warning audio. This can be achieved through an audio playback function, for example, when an abnormal record (r = 1) is detected, the audio playback function play_audio("warning_sound.wav") is called to play a pre-set warning sound file. This display marking of abnormal records on the inspection terminal allows the inspection personnel to quickly locate abnormal situations when viewing the inspection records, improving inspection efficiency. In the machine room inspection, there may be a large number of inspection records, if there is no such marking, the inspection personnel needs to view each record one by one to determine whether there is an abnormality, which will consume a lot of time and effort. For example, in the machine room inspection of a large data center, thousands of inspection records may be generated every day, through this display marking, the inspection personnel can quickly focus on those records marked as abnormal, and timely further check and handle the abnormal situation. In addition, the accuracy of the display marking directly depends on the accuracy of the previous abnormal record identification result. If the abnormal record identification result is misjudged, the display marking on the inspection terminal will also be wrong. For example, if the inspection record text processing neural network incorrectly determines a normal server temperature as abnormal, the normal temperature record will be marked as abnormal on the inspection terminal, which may cause the inspection personnel to perform unnecessary checks and operations. Therefore, each link in the whole process is interrelated, from the acquisition of the inspection record text (S110), the acquisition of the inspection record text processing neural network (S120), the identification of the abnormal record (S130) to the final display marking of the abnormal record (S140), the accuracy and reliability of each link have an important influence on the final effect of the machine room inspection data automatic analysis. Moreover, this display marking can also be displayed according to the severity of the abnormality. For example, for some minor abnormal situations, such as the server CPU usage is slightly higher than the normal range but has not reached the dangerous level, it can be marked with yellow font or a smaller warning icon; while for serious abnormal situations, such as server hardware failure or complete network disconnection, it is displayed in red bold font and uses a larger warning icon, and a stronger sound prompt is given. In technical implementation, the severity of the abnormality can be determined according to the specific data or classification in the abnormal record identification result, and then the display marking rules for different severity levels are set according to the pre-set rules. For example, if the variable s represents the severity of the abnormality (s = 1 represents minor, s = 2 represents moderate, s = 3 represents serious), then different font colors, icon sizes and sound intensities can be set in the display function according to the value of s to set the display marking rules.

[0031] In an embodiment, before step S110 of obtaining the inspection record text for identifying the abnormality recorded in the inspection terminal during the machine room inspection process, the method further comprises:

[0032] Step S10: Obtain the inspection record training text;

[0033] Step S20: Based on the guiding neural network that has been debugged in advance, perform abnormal record identification on the inspection record training text to obtain a first abnormal record identification result;

[0034] Step S30: Based on the guided neural network, perform abnormal record identification on the inspection record training text to obtain a second abnormal record identification result, the guided neural network and the guiding neural network comprising consistent neural network components;

[0035] Step S40: According to the first abnormal record identification result and the second abnormal record identification result, determine a target abnormal record identification result in the inspection record training text that is beneficial for knowledge extraction;

[0036] Step S50: According to the text content of the target abnormal record identification result, determine the representation information transfer learning generation value, the relevance transfer learning generation value, and the output transfer learning generation value;

[0037] Step S60: According to the representation information transfer learning generation value, the relevance transfer learning generation value, and the output transfer learning generation value, supervise the training of the guided neural network to obtain the inspection record text processing neural network.

[0038] In step S10, the computer system obtains the inspection record training text. The inspection record training text is a large set of text data containing information related to machine room inspection. These text data come from various records during the machine room inspection process, covering information of different devices, different times, and different running states.

[0039] For example, for a machine room, it contains many hardware facilities such as servers, network devices, and storage devices. During each inspection, the inspection personnel will record various parameters and state information of the devices, such as the CPU usage rate, memory capacity, disk read / write speed of the server, port connection state, traffic data of the network device, remaining storage space of the storage device, and whether the device is running normally. These records are summarized to form the inspection record training text.

[0040] In the embodiments of the present application, the computer system can obtain these inspection record training texts from the database of the machine room management system. These texts can be stored in a specific format, such as CSV (Comma Separated Values) format or JSON (JavaScript Object Notation) format, etc. The computer system needs to parse and preprocess these text data in different formats and convert them into a format suitable for neural network processing.

[0041] In step S20, the computer system uses the pre-debugged guide neural network to identify abnormal records in the inspection record training texts. The guide neural network is a pre-constructed and debugged neural network model, which has a certain ability to process inspection record texts to identify abnormalities.

[0042] Suppose this guide neural network has been pre-trained on some general machine room inspection data. When processing the inspection record training texts, it will analyze various information in the texts according to its internal neuron structure and weight parameters. For example, for a server inspection record text, the guide neural network will identify the CPU usage rate feature, and if the usage rate is too high (assuming it exceeds the pre-set normal usage rate threshold, such as 80%), it may determine that the server's inspection record has a possible abnormal situation. In this process, the guide neural network outputs the first abnormal record identification result. This result may contain multiple aspects of information, such as for each inspection record, it may give an abnormal probability value indicating the size of the possibility of the record being abnormal; it may also give a specific classification result, such as "normal" or "abnormal". At the same time, for the records determined to be abnormal, it may also give some preliminary judgment on the type of abnormality, such as performance abnormality (such as CPU usage rate being too high) or connection abnormality (such as network device port connection interruption), etc. In the embodiments of the present application, the internal calculation process of the guide neural network involves matrix operations and the application of activation functions. For example, for the input inspection record training text vector x, the hidden layer calculation of the network is performed. Let the weight matrix of the hidden layer be W_1 and the bias vector be b_1, then the output h_1 of the hidden layer can be calculated by the formula h_1 = f_1(W_1x+b_1), where f_1 is the activation function of the hidden layer, such as ReLU function (f_1(x) = max(0,x)). After processing by multiple hidden layers, the final abnormal record identification result is obtained through the output layer.

[0043] In step S30, the guided neural network also performs abnormal record identification on the inspection record training texts. Since the guided neural network and the guided neural network have the same neural network structure, they have similar processing procedures when processing the same inspection record training texts. However, since the weight parameters of the guided neural network have not been fully optimized, there may be differences between the guided neural network and the guided neural network in the abnormal record identification results. For example, for the same inspection record of the server CPU usage being too high, the guided neural network may accurately determine that the probability of being abnormal is 0.8 (indicating that there is an 80% chance of being abnormal), while the guided neural network may determine that the probability of being abnormal is 0.6 due to the initial randomness of the weight parameters and other reasons. The guided neural network also follows a similar calculation process when processing the inspection record training texts. It converts the input inspection record training texts into vector form, and then performs matrix multiplication, vector addition and activation function operations in multiple layers inside the network, and finally obtains the second abnormal record identification result. This result may also be an abnormal probability value, a classification result, and a preliminary judgment of the abnormal type, etc.

[0044] In step S40, the computer system determines the target abnormal record identification result in the inspection record training texts according to the first abnormal record identification result obtained by the guided neural network and the second abnormal record identification result obtained by the guided neural network. The purpose of this process is to find records that have special value in knowledge extraction. In actual operation, since there are differences between the identification results of the two neural networks, these differences often contain information useful for improving the guided neural network. For example, for the inspection record of a certain device, the guided neural network determines that the probability of being abnormal is 0.9, while the guided neural network determines that the probability of being abnormal is 0.3. This large difference indicates that this inspection record may contain some complex features or circumstances, and through further analysis and processing of these records, the guided neural network can be better learned and optimized. The computer system can determine the target abnormal record identification result by comparing the difference between the two identification results. For example, the absolute value of the difference between the abnormal probability values in the two results can be calculated, or the classification results can be compared. If for a certain inspection record, the difference exceeds a certain threshold (such as 0.5), or the classification results are completely different, then this inspection record can be determined as a candidate for the target abnormal record identification result.

[0045] In step S50, once the target abnormal record identification result is determined, the computer system determines three important values of the guided neural network according to the text content of these results: the representation information transfer learning value, the relevance transfer learning value, and the output transfer learning value.

[0046] The representation information of a neural network is an internal representation of data by the network in processing the data. For a training text of an inspection record, different neural networks (the guiding neural network and the guided neural network) can form different representation information for the same text content. For example, for an inspection record text containing multiple parameters (CPU usage, memory occupancy, etc.) of a server, the guiding neural network can represent it as a specific vector form v_1 = [a_1, a_2, …], and the guided neural network can represent it as v_2 = [b_1, b_2, …]. The representation information transfer learning generation value can be determined by calculating the distance measure between the two representation information vectors. A feasible distance measure is the Euclidean distance, formula d = \sqrt{\sum_{i=1}^{n}(a_i-b_i)^2}, where n is the dimension of the vector. This distance value reflects the difference between the representation information of the two neural networks, that is, the representation information transfer learning generation value. The relevance transfer learning generation value is obtained based on the relevance between different text segments in the same inspection record text. In the inspection record text, different text segments often have inherent relevance. For example, for an inspection record text containing high CPU usage of a server and abnormal speed of a cooling fan, there is relevance between the two text segments because high CPU usage can cause increased cooling demand, thereby affecting the speed of the cooling fan. The computer system can determine the relevance between different text segments by analyzing a large number of inspection record texts and counting the frequency of simultaneous occurrence of different text segments. Assuming that text segment A (high CPU usage) and text segment B (abnormal speed of a cooling fan) appear simultaneously in m inspection record texts, and the number of times that text segment A appears alone is n_1, and the number of times that text segment B appears alone is n_2, then a relevance measure index can be defined, such as r = \frac{m}{min(n_1,n_2)}. By performing such relevance analysis on the text segments in the target abnormal record identification result, the computer system can determine the relevance transfer learning generation value. The output transfer learning generation value is obtained based on the error between the output of the guiding neural network and the output of the guided neural network. For example, for a specific inspection record, the abnormal probability output by the guiding neural network is 0.8, and the abnormal probability output by the guided neural network is 0.6. The output transfer learning generation value can be obtained by calculating the absolute value of the difference between the two outputs, that is, |0.8-0.6| = 0.2. This value reflects the difference between the outputs of the two neural networks, that is, the output transfer learning generation value.

[0047] In step S60, the computer system supervises the training of the guided neural network according to the previously determined representation information transfer learning generation value, relevance transfer learning generation value, and output transfer learning generation value, so as to obtain the inspection record text processing neural network. The computer system can construct a total loss function, which comprehensively considers the three generation values. For example, assuming that the representation information transfer learning generation value is L 1, the relevance transfer learning generation value is L 2, and the output transfer learning generation value is L 3, the constructed total loss function can be L = aL 1 + bL 2 + gL 3, where a, b, and g are weight coefficients, which are used to adjust the importance of different generation values in the total loss function. By minimizing the total loss function, the computer system adjusts the weight parameters of the guided neural network by using the back propagation algorithm. The back propagation algorithm updates the weight parameters according to the partial derivative of the loss function with respect to the weight parameters and according to a certain learning rate. With continuous iterative training, the weight parameters of the guided neural network are continuously optimized, and finally the inspection record text processing neural network is obtained. When processing the inspection record text, this network can better utilize the knowledge transferred from the guided neural network, while considering the relevance within the inspection record text and the accuracy of the output, thereby improving the ability to identify abnormal records in the inspection record text.

[0048] In an embodiment, in step S40, the target abnormal record identification result beneficial to knowledge extraction is determined in the inspection record training text according to the first abnormal record identification result and the second abnormal record identification result, which can specifically include:

[0049] Step S41: According to the error between the first abnormal record identification result and the second abnormal record identification result, a plurality of target abnormal mark windows to be screened and original error values corresponding to the target abnormal mark windows to be screened are determined in the inspection record training text.

[0050] Step S42: According to the original error value, a set number of target abnormal record identification results are screened from the plurality of target abnormal mark windows to be screened.

[0051] In step S41, the computer system processes the error between the first abnormal record identification result and the second abnormal record identification result to determine the target abnormal mark window to be screened and the original error value thereof.

[0052] The first abnormal record identification result and the second abnormal record identification result are obtained by the guided neural network and the guided neural network, respectively, by identifying abnormal records in the inspection record training text. These results contain information related to whether each inspection record is abnormal and the degree of abnormality.

[0053] Suppose that in the first abnormal record identification result, for a server's inspection record, the given abnormal probability is 0.8, and it is pointed out that the abnormal type can be CPU usage too high. And in the second abnormal record identification result, for the same inspection record, the given abnormal probability is 0.3, and the abnormal type is judged to be possible memory access delay. There is a clear difference here.

[0054] The computer system needs to quantize this difference in order to determine the target abnormal marking window to be screened. One way is to calculate the absolute value of the difference between the abnormal probabilities as a measure of error. For example, for the above-mentioned server inspection record, the error value is \vert0.8-0.3\vert=0.5.

[0055] The computer system will perform such error calculation for each inspection record in the entire inspection record training text. The area where the inspection records with larger error values are located can be regarded as the target abnormal marking window to be screened. For example, if the inspection records are divided into different windows according to device type or time sequence, for a window containing multiple server inspection records, the error values of each record are generally larger, and this window will be determined as the target abnormal marking window to be screened.

[0056] The original error value corresponding to the target abnormal marking window to be screened is a certain comprehensive measure of the error values of the inspection records in this window. A simple method is to calculate the average value. Suppose that there are n inspection records in a target abnormal marking window to be screened, and the error value of each inspection record is e_i(i=1,2,…,n), then the original error value E corresponding to this window is E=\frac{\sum_{i=1}^{n}e_i}{n}.

[0057] When the guided neural network and the guided neural network have a large difference in the judgment of the same inspection record, this inspection record or the area (window) containing this inspection record can contain some special information, which can be very valuable for subsequent knowledge refinement. For example, it can be that the inspection records in this area contain some complex device state combinations or special manifestations of abnormal conditions, and by further analyzing these areas, the guided neural network can better learn to accurately identify abnormalities.

[0058] In the embodiments of the present application, the computer system can realize this process by constructing an error calculation matrix. The rows of the matrix correspond to each of the inspection record in the training text of the inspection record, and the columns represent the abnormal probability, abnormal type and other information in the first abnormal record identification result and the corresponding information in the second abnormal record identification result. By performing error calculation on the data in the matrix row by row, the error value of each inspection record can be obtained, and then the target abnormal mark window to be screened and its original error value can be determined.

[0059] In step S4, after obtaining each target abnormal mark window to be screened and its original error value, the computer system needs to screen a set number of target abnormal record identification results from these windows according to the original error value.

[0060] The original error value reflects the degree of particularity of the target abnormal mark window to be screened or the amount of knowledge contained. Generally, the greater the original error value, the higher the potential value of the window for knowledge extraction.

[0061] Suppose that the computer system determines m target abnormal mark windows to be screened, each of which has a corresponding original error value E_j (j = 1, 2, …, m). The computer system will first sort these windows according to the size of the original error value.

[0062] For example, if it is set to screen k target abnormal record identification results (k < m), the computer system will start selecting from the window with the largest original error value. However, there may be some problems in selecting only according to the size of the original error value. For example, there may be some windows with large original error values, but the inspection records in these windows may have a lot of noise or have a large overlap with other windows. In order to avoid this situation, the computer system also needs to consider other factors. One way is to perform correlation analysis on the selected windows and the unselected windows during the selection process. For example, for two target abnormal mark windows to be screened A and B, if most of the inspection records in window A are very similar to the inspection records in window B (such as inspection records about the same type of equipment at similar times), then after window A is selected, the selection priority of window B will be reduced.

[0063] In the embodiments of the present application, the correlation between the windows can be measured by calculating the intersection over union (IoU) between the windows. Let the set of inspection records contained by window A be S_A, and the set of inspection records contained by window B be S_B, then the intersection over union IoU(A, B) between them is \frac{\vert S_A\cap S_B\vert}{\vertS_A\cup S_B\vert}. If the value of IoU(A, B) is large (such as exceeding a certain threshold t, such as 0.5), it means that the two windows have a large overlap, and this overlap needs to be considered when selecting the target abnormal record identification result. In the screening process, the computer system will comprehensively consider the size of the original error value and the correlation between the windows, and gradually screen out the target abnormal record identification result of a certain number k. These target abnormal record identification results are selected from a large number of target abnormal marking windows to be screened, and they are of great significance for subsequent determination of the representation information migration learning generation value, the correlation migration learning generation value, and the output migration learning generation value. Because the windows of these target abnormal record identification results often contain some special inspection record conditions, these conditions can reflect the differences between the guided neural network and the guided neural network, and through in-depth analysis of these differences, the guided neural network can be better learned and improved, thereby improving its ability to identify abnormal records in the inspection record text.

[0064] In an implementation manner, the first abnormal record identification result includes a plurality of first reasoning marking windows and a plurality of abnormal inspection classification corresponding first reasoning support coefficients, and the second abnormal record identification result includes a plurality of second reasoning marking windows and a plurality of abnormal inspection classification corresponding second reasoning support coefficients. Based on this, in step S41, a plurality of target abnormal marking windows to be screened and the original error value corresponding to the target abnormal marking window to be screened are determined in the inspection record training text according to the error between the first abnormal record identification result and the second abnormal record identification result. Specifically, it can include:

[0065] Step S411: determining a plurality of target abnormal marking windows to be screened in the first reasoning marking window and the second reasoning marking window according to the relative size of the support coefficient between the first reasoning support coefficient and the second reasoning support coefficient;

[0066] Step S412: determining the original error value corresponding to the target abnormal marking window to be screened according to the support coefficient error between the first reasoning support coefficient and the second reasoning support coefficient.

[0067] In step S41, the computer system is to determine a plurality of target abnormality marking windows and corresponding original error values in the inspection record training text according to the error between the first abnormality record identification result and the second abnormality record identification result. Steps S411-S412 are specific embodiments.

[0068] In step S411, the first abnormality record identification result includes a plurality of first inference marking windows and a plurality of first inference support coefficients corresponding to the abnormality inspection categories, and the second abnormality record identification result includes a plurality of second inference marking windows and a plurality of second inference support coefficients corresponding to the abnormality inspection categories.

[0069] The inference marking window is the result of dividing the inspection record training text, which can be divided according to different rules, such as device type, time interval, or specific inspection tasks. For example, for a computer room inspection record, the computer system can divide the inspection record about the server into one inference marking window and divide the inspection record about the network device into another inference marking window. The inference support coefficient is a numerical value associated with each inference marking window, which represents the support degree of the neural network for determining the inspection record in the window as a certain abnormality inspection category. For example, for the inference marking window of the server, the first inference support coefficient in the first abnormality record identification result may represent the support degree of the neural network for determining that the server in the window has performance abnormalities (such as high CPU usage). Assuming that this first inference support coefficient is 0.7, it means that the neural network has 70% confidence that the server inspection record in this window has performance abnormalities.

[0070] The computer system determines the target abnormality marking window to be screened by comparing the relative size of the first inference support coefficient and the second inference support coefficient. When the relative size difference between the two inference support coefficients is large, it means that there is a large difference between the judgments of the two neural networks on the inspection record in this inference marking window, and this inference marking window is more likely to be determined as the target abnormality marking window to be screened.

[0071] For example, for an inference marking window about a network device, the first inference support coefficient is 0.8, indicating that the guiding neural network believes that the network device in this window has an 80% probability of having a connection abnormality; and the second inference support coefficient is 0.2, indicating that the guided neural network believes that the network device in this window has only a 20% probability of having a connection abnormality. This large difference in the relative size of the support coefficients indicates that this inference marking window about the network device may contain some complex situations or special inspection records, causing a large difference between the two neural networks. Therefore, this inference marking window will be determined by the computer system as the target abnormality marking window to be screened.

[0072] In the embodiments of the present application, a threshold can be set to determine whether the difference in relative size of the support coefficients is large enough. For example, a relative size difference threshold Delta is set to 0.5. For any inference label window, if vert the first inference support coefficient - the second inference support coefficient vert > Delta, then this inference label window is determined as a target abnormal label window to be screened. In this way, the computer system can screen out those windows with large differences from among the first inference label windows and the second inference label windows as target abnormal label windows to be screened.

[0073] In step S412, after determining the target abnormal label window to be screened, the computer system needs to determine the original error value corresponding to each target abnormal label window to be screened. This original error value is determined based on the support coefficient error between the first inference support coefficient and the second inference support coefficient. The support coefficient error reflects the difference in judgment of the inspection records in the same inference label window by the two neural networks. For example, for the inference label window about the network device mentioned above, the first inference support coefficient is 0.8 and the second inference support coefficient is 0.2, so the support coefficient error is \vert0.8-0.2\vert=0.6.

[0074] One method of determining the original error value is to directly take the support coefficient error as the original error value. However, in actual situations, more factors may need to be considered to more accurately measure the original error value. For example, the support coefficient error can be weighted according to the number of inspection records in the inference label window. Assuming that there are n inspection records in a target abnormal label window to be screened and the support coefficient error is e, then the original error value E can be defined as E=e×w(n), where w(n) is a weight function related to the number of inspection records n. For example, w(n)=\sqrt{n}, when n=10, if the support coefficient error e=0.6, then the original error value E=0.6×\sqrt{10}\approx1.90.

[0075] This way of determining the original error value based on the support coefficient error is based on the consideration that the larger the support coefficient error, the greater the difference in judgment of the inspection records in the inference label window by the two neural networks, and the more likely this window contains special information and is more valuable for subsequent knowledge extraction. By weighting the support coefficient error, the particularity of the window can be more reasonably reflected according to the number of inspection records in the inference label window. If the number of inspection records in an inference label window is large, even if the support coefficient error is relatively small, this window may have high value because it contains more samples, and the weighting function can reflect this situation.

[0076] The computer system performs such original error value calculation for each target abnormality marked window to be screened. These original error values will be used in subsequent steps (such as step S42) to screen a certain number of target abnormality record identification results. They provide an index for the computer system to measure the importance or particularity of each target abnormality marked window to be screened, which helps to further screen the target abnormality record identification results that are most beneficial to knowledge extraction, thereby improving the performance of the guided neural network and making it more accurate and effective in identifying abnormal records in the inspection record text.

[0077] In an embodiment, step S42, according to the original error value, a certain number of target abnormality record identification results are screened from the plurality of target abnormality marked windows to be screened, which can specifically include:

[0078] Step S421: According to the original error value, a reference abnormality marked window is screened from the plurality of target abnormality marked windows to be screened.

[0079] Step S422: According to the intersection-union ratio result between the reference abnormality marked window and the remaining target abnormality marked windows to be screened, the remaining target abnormality marked windows to be screened are selected to obtain a certain number of target abnormality record identification results.

[0080] In step S421, the original error value is determined in step S41, which reflects the particularity or importance of each target abnormality marked window to be screened. The computer system screens the reference abnormality marked window based on these original error values.

[0081] Suppose there are multiple target abnormality marked windows to be screened, such as window A, window B, window C, etc., which correspond to different original error values, E_A, E_B, E_C, etc. The larger the original error value, the more significant the difference between the identification results of the guided neural network and the guided neural network for the inspection records in the window, which means that this window may contain more valuable information for knowledge extraction.

[0082] The computer system can use various ways to screen according to the original error value. A simple method is to set a threshold T, when the original error value is greater than the threshold, the corresponding target abnormality marked window to be screened is selected as the reference abnormality marked window. For example, set the threshold T = 0.5, if the original error value of window A E_A = 0.6, then window A will be selected as the reference abnormality marked window.

[0083] Another way is to sort the original error values in descending order and select the top-ranked windows as the reference anomaly marked windows. For example, sort all the target anomaly marked windows to be screened in descending order of the original error values, and select the top n windows as the reference anomaly marked windows. Assuming there are a total of 10 target anomaly marked windows to be screened, after sorting by the original error values, the top 3 windows are selected as the reference anomaly marked windows.

[0084] This process of screening the reference anomaly marked windows is based on the principle that the inspection records in the windows with larger original error values are more likely to contain complex features or patterns that are not well learned by the neural network. By screening out these windows, the computer system can focus on these areas that are more valuable for knowledge extraction, thereby laying the foundation for more accurate identification of target anomaly records in the future.

[0085] In the embodiments of the present application, the computer system can construct an index list to store the target anomaly marked windows to be screened and their original error values. When sorting by the original error values, a feasible sorting algorithm such as the quicksort algorithm can be used. The basic idea of the quicksort algorithm is to select a reference element, divide the array into two parts, the elements on the left are all smaller than the reference element, and the elements on the right are all larger than the reference element, and then recursively sort the two parts. For the array storing the original error values, after applying the quicksort algorithm, the top-ranked windows can be easily selected as the reference anomaly marked windows.

[0086] In step S422, after determining the reference anomaly marked windows, the computer system further selects the final target anomaly record identification results according to the intersection-over-union (IoU) results between the reference anomaly marked windows and the remaining target anomaly marked windows to be screened. IoU is an index to measure the degree of overlap between two sets. In this scenario, each target anomaly marked window to be screened can be regarded as a set of inspection records. Let the reference anomaly marked window be R and the remaining target anomaly marked windows to be screened be O_i (i = 1, 2, …).

[0087] IoU(R, O_i) = \frac{\vert R\cap O_i\vert}{\vert R\cup O_i\vert}, where \vert R\cap O_i\vert represents the number of inspection records in the intersection of the reference anomaly marked window R and the remaining target anomaly marked window O_i, and \vert R\cup O_i\vert represents the number of inspection records in the union of the reference anomaly marked window R and the remaining target anomaly marked window O_i.

[0088] For example, the reference abnormality marking window R contains 10 inspection records, the remaining target abnormality marking window O_1 contains 15 inspection records, and the intersection part contains 5 inspection records. Then, IoU(R, O_1) = 5 / (10+15-5) = 5 / 20 = 0.25.

[0089] The reason why the computer system selects the remaining target abnormality marking window through the IoU result is that if the IoU is too high, it means that the overlapping part between the two windows is large, and may contain similar information; if the IoU is too low, it means that the difference between the two windows is too large, and the information relevance is weak.

[0090] The computer system can set a threshold range [T_1, T_2] of IoU, and when the IoU(R, O_i) is within this threshold range, O_i is likely to be selected as part of the target abnormality record identification result. For example, set T_1 = 0.1 and T_2 = 0.5. If the IoU(R, O_j) = 0.3 for a certain remaining target abnormality marking window O_j, then O_j satisfies the IoU condition.

[0091] Among the remaining target abnormality marking windows that satisfy the IoU condition, the computer system needs to further screen to obtain a certain number of target abnormality record identification results. These windows can be sorted again according to their original error values, and the windows with larger original error values can be selected until a certain number is reached.

[0092] For example, set the number of target abnormality record identification results to be obtained to 5. Among the remaining target abnormality marking windows that satisfy the IoU condition, sort them according to the original error values from large to small, and select the first 5 windows as the final target abnormality record identification results.

[0093] This selection method based on the IoU result helps to avoid selecting windows with redundant information or weak relevance, ensuring that the final target abnormality record identification results contain information that is related to the reference abnormality marking window and has sufficient uniqueness, thereby providing a reliable basis for subsequent accurate determination of the representation information transfer learning generation value, the relevance transfer learning generation value, and the output transfer learning generation value, and helping to improve the performance of the guided neural network in processing inspection record texts, so that it can more accurately identify abnormal records.

[0094] In an embodiment, step S50, according to the text content of the target abnormality record identification result, determines the representation information transfer learning generation value, the relevance transfer learning generation value, and the output transfer learning generation value, which can specifically include:

[0095] Step S51: generating a representation-based cost metric function, a relevance-based cost metric function, and an output-based cost metric function based on the characterization information;

[0096] Step S52: determining the representation transfer learning cost value, the relevance transfer learning cost value, and the output transfer learning cost value according to the text content of the target abnormal record identification result, the representation-based cost metric function, the relevance-based cost metric function, and the output-based cost metric function.

[0097] In step S51, the neural network generates the characterization information of the data when processing the data. For the inspection record text processing neural network, the characterization information is a representation of the internal features of the inspection record text by the network. For example, for a record text about server inspection, which contains CPU usage, memory occupancy and other information, the neural network can convert these information into a vector form of characterization information.

[0098] The representation-based cost metric function aims to measure the difference between the characterization information of the guided neural network and the guided neural network. The purpose of the computer system to generate this function is to quantify the difference in order to determine the representation transfer learning cost value subsequently.

[0099] A feasible representation-based cost metric function can be a function based on Euclidean distance. Assuming that the characterization information of a certain inspection record text by the guided neural network is a vector vec{x}=[x_1,x_2,…,x_n], and the characterization information of the same inspection record text by the guided neural network is a vector vec{y}=[y_1,y_2,…,y_n], then the representation-based cost metric function C_{rep}(\vec{x},\vec{y}) can be defined as: C_{rep}(\vec{x},\vec{y})=\sqrt{\sum_{i=1}^{n}(x_i-y_i)^2}. This formula calculates the Euclidean distance between two vectors, and the greater the distance, the greater the difference between the characterization information of the two neural networks.

[0100] In the inspection record text, there is relevance between different text segments. For example, in a machine room inspection record text, the abnormal port traffic of a network device may be associated with the abnormal network connection of a server. Such relevance is very important for the neural network to learn the abnormal patterns in the inspection record. The relevance-based cost metric function is used to measure the difference between the relevance of the guided neural network and the guided neural network. The computer system needs to consider how to quantify the difference in relevance. Suppose that for a text containing inspection information of multiple devices, the computer system divides it into m text segments. A relevance matrix A can be constructed, where A_{ij} represents the relevance between the i-th text segment and the j-th text segment (for example, it can be the probability of their simultaneous abnormality). For the guided neural network and the guided neural network, there are corresponding relevance matrices A^g and A^s. The relevance-based cost metric function C_{assoc}(A^g,A^s) can be defined as the norm of the difference between the corresponding elements of the two matrices, such as the Frobenius norm: C_{assoc}(A^g,A^s)=\sqrt{\sum_{i=1}^{m}\sum_{j=1}^{m}(A_{ij}^g-A_{ij}^s)^2}. The larger the value of this function, the greater the difference between the two neural networks in handling text segment relevance.

[0101] The guided neural network and the guided neural network will generate outputs when processing the inspection record text. These outputs may be a judgment on whether the inspection record is abnormal (such as an abnormal probability value or a classification result). For example, for an inspection record of a server, the guided neural network may output an abnormal probability of 0.8, and the guided neural network may output an abnormal probability of 0.6.

[0102] The output-based cost metric function is used to measure the difference between the outputs of the two neural networks. If the output is an abnormal probability value, a simple output-based cost metric function C_{out}(p^g,p^s) can be the absolute value of the difference between the two probability values, i.e. C_{out}(p^g,p^s)=\vert p^g-p^s\vert, where p^g is the output probability of the guided neural network and p^s is the output probability of the guided neural network. If the output is a classification result (such as normal or abnormal), a function can be defined, which is 1 when the classification results are different, and 0 when the classification results are the same.

[0103] In step S52, the computer system determines the value of the feature information transfer learning cost using the text content of the target abnormal record identification result and the feature information-based cost metric function. The text content of the target abnormal record identification result contains those inspection record information that is considered to have special value for knowledge extraction.

[0104] For each inspection record text in the target abnormal record identification result, the computer system obtains the representation information of the two networks by inputting it into the guided neural network and the student neural network. Then, the difference between them is calculated using the representation information-based cost measurement function. For example, assuming there are k inspection record texts of the target abnormal record identification result, for the i-th inspection record text, the representation information of the guided neural network is vec{x}_i, the representation information of the student neural network is vec{y}_i, and the representation information difference of each text is calculated according to the representation information-based cost measurement function C_{rep}(\vec{x}_i,\vec{y}_i).

[0105] The representation information transfer learning cost value can be a certain comprehensive measure of these single text representation information differences. One possible way is to calculate the average value. Let the representation information transfer learning cost value be L_{rep}, then L_{rep}=\frac{1}{k}\sum_{i=1}^{k}C_{rep}(\vec{x}_i,\vec{y}_i). This value reflects the average difference degree of the representation information of the guided neural network and the student neural network on the target abnormal record identification result, which can be used for subsequent adjustment of the training process of the student neural network.

[0106] Similarly, the computer system determines the relevance transfer learning cost value according to the text content of the target abnormal record identification result and the relevance-based cost measurement function. There is a specific relevance pattern between different text segments in the text content of the target abnormal record identification result.

[0107] The computer system constructs the relevance matrix of the text segments of each inspection record text of the target abnormal record identification result, and obtains the corresponding relevance matrix of the guided neural network and the student neural network respectively. Then, the difference between them is calculated using the relevance-based cost measurement function. For example, for the j-th inspection record text of the target abnormal record identification result, the relevance matrix of the guided neural network is A_j^g, and the relevance matrix of the student neural network is A_j^s. The relevance difference of each text is obtained by the relevance-based cost measurement function C_{assoc}(A_j^g,A_j^s).

[0108] The association transfer learning loss value can be a comprehensive measure of these individual text association differences. For example, let the association transfer learning loss value be L_{assoc}, if there are l inspection record texts of target abnormal record identification results, L_{assoc} = \frac{1}{l} \sum_{j=1}^{l} C_{assoc}(A_j^g, A_j^s). This value represents the average difference in the degree of association between the guided neural network and the guided neural network in processing the text segment on the target abnormal record identification result, which helps to better learn the association structure within the text when training the guided neural network.

[0109] The computer system determines the output transfer learning loss value according to the text content of the target abnormal record identification result and the output-based loss measure function. The text content of the target abnormal record identification result will produce different output results after being processed by the two neural networks.

[0110] For each inspection record text of the target abnormal record identification result, the computer system obtains the outputs of the guided neural network and the guided neural network. If the output is an abnormal probability value, the difference between them is calculated according to the output-based loss measure function. For example, for the mth inspection record text of the target abnormal record identification result, the output probability of the guided neural network is p_m^g, and the output probability of the guided neural network is p_m^s. The output difference of each text is obtained by the output-based loss measure function C_{out}(p_m^g, p_m^s).

[0111] The output transfer learning loss value can be a comprehensive measure of these individual text output differences. Let the output transfer learning loss value be L_{out}, if there are n inspection record texts of target abnormal record identification results, L_{out} = \frac{1}{n} \sum_{m=1}^{n} C_{out}(p_m^g, p_m^s). This value reflects the average difference in the output of the guided neural network and the guided neural network on the target abnormal record identification result, which helps to adjust the network parameters to reduce this output difference and improve the accuracy of the network during the training process of the guided neural network.

[0112] Through steps S51-S52, the computer system can accurately determine the representation information transfer learning loss value, the association transfer learning loss value, and the output transfer learning loss value according to the text content of the target abnormal record identification result. These loss values will be used to supervise the training of the guided neural network in subsequent steps (such as step S60), so as to construct a more effective inspection record text processing neural network and improve the accuracy and efficiency of abnormal record identification in the automatic analysis of machine room inspection data.

[0113] In an implementation, in step S52, determining the representation information transfer learning cost value and the correlation transfer learning cost value according to the text content of the target abnormal record identification result, the cost measurement function based on the representation information, and the cost measurement function based on the correlation can include:

[0114] Step S521: mining to obtain guided text representation information in the guided neural network according to the text content of the target abnormal record identification result, and mining to obtain guided text representation information in the guided neural network;

[0115] Step S522: determining the representation information transfer learning cost value and the correlation transfer learning cost value according to the cost measurement function based on the representation information, the cost measurement function based on the correlation, the guided text representation information, and the guided text representation information.

[0116] In step S521, the text content of the target abnormal record identification result contains the inspection record information selected from the inspection record training text and having special value for knowledge extraction. The computer system inputs the text content into the guided neural network to mine the guided text representation information.

[0117] When the text content of the target abnormal record identification result is input into the guided neural network, the neurons inside the neural network will perform a series of processing operations on the text. For example, assuming that the text content of the target abnormal record identification result is an inspection record about a server, which contains CPU usage, memory occupancy, disk I / O, etc. After the input layer of the guided neural network receives these data, it will convert them into a vector form that the neural network can process.

[0118] Then, the vector will be calculated in the hidden layer of the neural network. The neurons in the hidden layer will perform weighted summation on the input vector and perform nonlinear transformation through an activation function (such as a ReLU function: f(x) = max(0, x)). This process will continuously extract feature information in the text content, and after processing through multiple hidden layers, the guided text representation information is finally obtained in the output layer or a certain intermediate layer of the network. This representation information is an abstract representation of the features of the input text content, for example, it can be a vector of a certain dimension, and each element in it represents a measure of the text content in different feature dimensions.

[0119] Assuming that for a piece of target abnormal record identification result text content of a server inspection record, the guided text representation information obtained after processing by the guided neural network is a vector vec{z}_g = [z_{g1}, z_{g2}, …, z_{gn}], where n represents the dimension of the representation information vector, and z_{gi} (i = 1, 2, …, n) represents the measure value in the i-th feature dimension.

[0120] Similar to the operation in the guided neural network, the computer system inputs the text content of the same target abnormal record identification result into the student neural network.

[0121] The student neural network will also process the input text content. For example, for the text content containing the server patrol record, the input layer of the student neural network will also convert it into a vector form, and then perform operations such as weighted summation and activation function processing in the hidden layer.

[0122] After similar calculation process as the guided neural network, the student neural network will generate student text representation information. Assuming that for the same server patrol record target abnormal record identification result text content, the student text representation information generated by the student neural network is a vector vec{z}_s=[z_{s1},z_{s2},…,z_{sn}].

[0123] This process of mining text representation information in the guided neural network and the student neural network respectively is based on the feature extraction ability of the neural network to the input text content. Different neural networks will generate different representation information for the same text content due to the difference in their weight parameters, and the difference between these representation information will be an important basis for determining the transfer learning generation value of the representation information.

[0124] In step S522, the computer system first measures the difference between the guided text representation information and the student text representation information by using the representation information-based cost measurement function. As mentioned earlier, the representation information-based cost measurement function can be a function based on Euclidean distance.

[0125] For the guided text representation information vector vec{z}_g=[z_{g1},z_{g2},…,z_{gn}] and the student text representation information vector vec{z}_s=[z_{s1},z_{s2},…,z_{sn}] obtained before, the distance between them is calculated according to the representation information-based cost measurement function C_{rep}(\vec{z}_g,\vec{z}_s)(C_{rep}(\vec{z}_g,\vec{z}_s)=\sqrt{\sum_{i=1}^{n}(z_{gi}-z_{si})^2}).

[0126] This distance value reflects the difference between the two neural networks in representing the target abnormal record identification result text content. Assuming that there are m target abnormal record identification result text contents, the distance value d_j(j=1,2,…,m) is calculated for each text content.

[0127] The representation transfer learning generation value Lrepmay be some kind of comprehensive measure of these distance values. One possible way is to calculate the average value, i.e. Lrep= 1 m åj=1mdj. This value represents the average difference degree of the representation information of the guide neural network and the guided neural network on the text content of all target abnormal record identification results, which will play an important role in the subsequent training process of the guided neural network, for example, it can be used as a basis for adjusting network weights to reduce the difference of the representation information, so that the guided neural network can better learn the similar representation method of the guide neural network, thereby improving its ability to identify abnormal records in the text of the inspection record.

[0128] When determining the relevance transfer learning generation value, the computer system considers the relevance-based cost measure function and the guide text representation information and the guided text representation information.

[0129] Although the relevance-based cost measure function is used to measure the difference between the relevance of the text segments, the guide text representation information and the guided text representation information also indirectly reflect the understanding of the neural network to the internal structure of the text (including relevance). Assuming that the relevance-based cost measure function Cassocis obtained by constructing the relevance matrix of the text segments and calculating the difference between the matrices (such as the calculation method based on the Frobenius norm mentioned above). For the text content of the target abnormal record identification result, the computer system can extract some relevance-related features from the guide text representation information and the guided text representation information. For example, if some elements in the representation information vector are related to the relevance of a specific text segment (such as the representation of the association between a specific device parameter in the vector), the difference between these elements in the guide text representation information and the guided text representation information can be analyzed to assist in determining the relevance transfer learning generation value. One possible way is to adjust the calculation result of the relevance-based cost measure function according to the difference of the relevance-related elements in the guide text representation information and the guided text representation information. Let the initial relevance difference value calculated by the relevance-based cost measure function be Cassoc0, and the adjustment factor obtained by analyzing the representation information be a (0 < a < 1), then the relevance transfer learning generation value Lassoc= Cassoc0x a. This adjustment factor a can be determined according to the difference degree of the relevance-related elements in the representation information, for example, if the difference is large, a can take a larger value, and vice versa.

[0130] In this way, the correlation transfer learning generation value is determined by comprehensively considering the direct measurement of the internal correlation of the text (the cost measurement function based on the correlation) and the understanding of the neural network to the internal structure of the text (reflected by the representation information), so that the correlation transfer learning generation value more comprehensively reflects the difference between the guided neural network and the guided neural network in processing the target abnormal record recognition result text content, which helps to better learn the correlation structure in the text when training the guided neural network in the subsequent, and improves the ability to identify abnormal conditions in the inspection record text.

[0131] In an embodiment, step S521, according to the text content of the target abnormal record recognition result, the guided text representation information is mined in the guided neural network, and the guided text representation information is mined in the guided neural network, which can specifically include:

[0132] Step S5211: Mining the quasi-optimized guided text representation information in the guided neural network, and mining the quasi-optimized guided text representation information in the guided neural network;

[0133] Step S5212: Adjusting the dimension of the quasi-optimized guided text representation information according to the text content of the target abnormal record recognition result, and obtaining the guided text representation information;

[0134] Step S5213: Adjusting the dimension of the quasi-optimized guided text representation information according to the text content of the target abnormal record recognition result, and obtaining the guided text representation information.

[0135] In step S5211, when the computer system inputs the text content of the target abnormal record recognition result into the guided neural network, the neural network starts to process it. The guided neural network is a neural network that is pre-constructed and debugged, and has a specific structure, usually composed of an input layer, multiple hidden layers and an output layer.

[0136] Taking a simple machine room inspection record text as an example, suppose the text content of the target abnormal record recognition result contains information about the server, such as CPU usage of 80%, memory occupancy of 70%, and network connection status of "unstable". These text contents are first received in the input layer of the guided neural network. The number of neurons in the input layer corresponds to the number of features of the input data, for example, there may be neurons corresponding to CPU usage, memory occupancy, network connection status, etc.

[0137] After the input layer receives the data, it passes it to the first hidden layer. In the hidden layer, the neurons perform a weighted sum operation on the input data. Let the input vector be vec{x} = [x_1, x_2, …, x_n] (where x_1 might represent the value of CPU usage, x_2 the value of memory occupancy, and so on, and n the number of input features), the weight matrix of the hidden layer be W_1, and the bias vector be b_1, then the input to the hidden layer is calculated as vec{z}_1 = W_1\vec{x} + b_1.

[0138] Then, the vec{z}_1 is processed by an activation function to obtain the output of the hidden layer. A feasible activation function is the ReLU function f(x) = max(0, x), i.e., the output of the hidden layer vec{h}_1 = f(\vec{z}_1). This process is repeated in each hidden layer, and as the data is passed between the hidden layers, the neural network continuously extracts and transforms features from the input data.

[0139] After processing by multiple hidden layers, the optimization-guided text representation information is obtained at a certain intermediate layer or output layer of the guided neural network. This optimization-guided text representation information is an intermediate result or a preliminary feature representation of the input text content. For example, suppose the optimization-guided text representation information obtained at a certain intermediate layer is a vector vec{y}_g^0 = [y_{g1}^0, y_{g2}^0, …, y_{gm}^0], where m represents the dimension of the intermediate representation information vector, and y_{gi}^0 (i = 1, 2, …, m) is a preliminary measurement value in the i-th feature dimension. This optimization-guided text representation information may need to be further processed to obtain the final guidance text representation information used to determine the representation information transfer learning value.

[0140] Similarly, the computer system inputs the text content of the same target anomaly record identification result into the guided neural network. The guided neural network has the same neural network composition as the guided neural network, i.e., it also has an input layer, multiple hidden layers, and an output layer.

[0141] For the same target anomaly record identification result text content containing server information (such as CPU usage of 80%, memory occupancy of 70%, and network connection status of "unstable"), after the input layer of the guided neural network receives the data, it also processes it according to a similar calculation process as the guided neural network.

[0142] Let the weight matrix of the first hidden layer of the guided neural network be W_1^s, the bias vector be b_1^s, and the input vector also be \vec{x}. The input of the first hidden layer is calculated as \vec{z}_1^s = W_1^s\vec{x} + b_1^s. After the activation function processing (such as the ReLU function), the output of the hidden layer is obtained as \vec{h}_1^s = f(\vec{z}_1^s).

[0143] As data passes between multiple hidden layers of the guided neural network, after similar weighted summation and activation function processing, the pseudo-optimized guided text representation information is obtained at some intermediate layer or output layer of the guided neural network. Assuming that the obtained pseudo-optimized guided text representation information is a vector \vec{y}_s^0 = [y_{s1}^0, y_{s2}^0, …, y_{sm}^0], where m is the same as the dimension of the pseudo-optimized guided text representation information vector obtained in the guided neural network, to facilitate subsequent comparison and processing.

[0144] This process of mining pseudo-optimized text representation information in the guided neural network and the guided neural network is based on the step-by-step processing and feature extraction capability of neural networks on input data. Due to the differences in initial weight parameters and other factors, the two neural networks will generate different pseudo-optimized text representation information for the same input text content. These differences will be further adjusted and analyzed in subsequent steps to obtain the final text representation information used to calculate the representation information transfer learning generation value, etc.

[0145] In step S5212, the text content of the target abnormal record recognition result contains specific inspection record information, and the representation of these information in the neural network should match the actual knowledge extraction requirements. The pseudo-optimized guided text representation information, although already a feature representation of the input text content in the guided neural network, may not be completely suitable for subsequent operations such as calculating the representation information transfer learning generation value.

[0146] For example, in the previously obtained pseudo-optimized guided text representation information vector \vec{y}_g^0 = [y_{g1}^0, y_{g2}^0, …, y_{gm}^0], some dimensions may contain redundant information, or some information related to the key features in the text content of the target abnormal record recognition result may be scattered in multiple dimensions, which is not conducive to direct comparison and analysis of the representation information.

[0147] The computer system adjusts the dimension of the guidance text representation information according to the key features in the text content of the target abnormal record recognition result. A feasible technical means is principal component analysis (PCA). Specifically, for the guidance text representation information vector vec{y}^0_g, first calculate its covariance matrix C, where C_{ij}=\frac{1}{N-1}\sum_{k=1}^{N}(y_{gi,k}^0-\overline{y}_{gi}^0)(y_{gj,k}^0-\overline{y}_{gj}^0) (where N is the number of samples, y_{gi,k}^0 represents the value of the kth sample in the ith dimension, and \overline{y}_{gi}^0 represents the mean value in the ith dimension).

[0148] Then, the covariance matrix C is subjected to eigenvalue decomposition to obtain eigenvalues \lambda_1, \lambda_2, …, \lambda_m and corresponding eigenvectors \vec{v}_1, \vec{v}_2, …, \vec{v}_m. The eigenvectors are sorted according to the size of the eigenvalues, and the first p eigenvectors (p < m) are selected. The feature space corresponding to these eigenvectors is the dimension-reduced space.

[0149] Finally, the guidance text representation information vector vec{y}^0_g is projected into this dimension-reduced feature space to obtain the adjusted guidance text representation information vector vec{y}_g=\sum_{i=1}^{p}(y_{g}^0\cdot\vec{v}_i)\vec{v}_i. This adjusted vector vec{y}_g is the guidance text representation information obtained after adjusting the dimension according to the text content of the target abnormal record recognition result. It retains key feature information while reducing dimension, which is more conducive to subsequent comparison with the guided text representation information and calculation of representation information transfer learning generation value.

[0150] For example, if the text content of the target abnormal record recognition result focuses on server performance-related features (such as CPU usage and memory occupancy), after PCA dimension reduction, the guidance text representation information vector obtained may mainly concentrate on the dimensions related to these performance features, thereby more accurately reflecting the feature representation of the guidance neural network related to the text content of the target abnormal record recognition result.

[0151] In step S5213, similar to adjusting the dimension of the to-be-optimized guided text representation information, the computer system also adjusts the dimension of the to-be-optimized guided text representation information to obtain the guided text representation information. This is because the to-be-optimized guided text representation information obtained in the guided neural network may also have a problem of unsuitable dimension for subsequent operations.

[0152] Moreover, since the guided text representation information needs to be compared and analyzed with the adjusted guided text representation information, the dimension adjustment of the guided text representation information also needs to be based on the text content of the target abnormal record identification result, so as to ensure that the comparison is performed on the same key feature dimension.

[0153] For the to-be-optimized guided text representation information vector \vec{y}_s^0=[y_{s1}^0,y_{s2}^0,…,y_{sm}^0], the principal component analysis (PCA) method is also used for dimension adjustment.

[0154] First, the covariance matrix C^s is calculated, C_{ij}^s=\frac{1}{N-1}\sum_{k=1}^{N}(y_{si,k}^0-\overline{y}_{si}^0)(y_{sj,k}^0-\overline{y}_{sj}^0)(where N is the number of samples, y_{si,k}^0 represents the value of the kth sample in the ith dimension, and \overline{y}_{si}^0 represents the mean value of the ith dimension).

[0155] Then, the eigenvalue decomposition of the covariance matrix C^s is performed to obtain the eigenvalues \lambda_1^s,\lambda_2^s,…,\lambda_m^s and the corresponding eigenvectors \vec{v}_1^s,\vec{v}_2^s,…,\vec{v}_m^s. The eigenvectors are sorted according to the size of the eigenvalues, and the first p eigenvectors (the same number of eigenvectors selected when adjusting the guided text representation information, to ensure comparison on the same dimension) are selected.

[0156] Finally, the to-be-optimized guided text representation information vector \vec{y}_s^0 is projected into this reduced dimension feature space to obtain the guided text representation information vector \vec{y}_s=\sum_{i=1}^{p}(y_{s}^0\cdot\vec{v}_i^s)\vec{v}_i^s.

[0157] For example, if the text content of the target abnormal record identification result emphasizes the connection state related features of the network equipment, after PCA dimension reduction, the guided text representation information vector will focus on the key dimensions related to the connection state of the network equipment, so that when compared with the adjusted guided text representation information, the feature representation difference between the two neural networks in processing the text content of the target abnormal record identification result can be more accurately reflected, providing a more reasonable basis for subsequent operations such as determining the representation information transfer learning generation value.

[0158] In an implementation, in step S522, based on the correlation-based cost measurement function, the guided text representation information, and the guided text representation information, the correlation transfer learning generation value is determined, which can specifically include:

[0159] Step S5221: determining a first correlation transfer learning generation value according to the vector distance measurement between the correlation-based cost measurement function and the guided text representation information;

[0160] Step S5222: determining a second correlation transfer learning generation value according to the vector distance measurement between the correlation-based cost measurement function and the guided text representation information;

[0161] Step S5223: determining the correlation transfer learning generation value according to the first correlation transfer learning generation value and the second correlation transfer learning generation value.

[0162] In step S5221, there is a correlation between different text segments in the inspection record text. This correlation is very important for accurately identifying abnormal records. For example, in the machine room inspection record, the CPU usage of the server may be associated with the abnormality of the heat dissipation system, and the port flow anomaly of the network equipment may be associated with the network connection failure of the server. The correlation-based cost measurement function aims to quantify the difference in this correlation between different neural networks (guiding neural network and guided neural network).

[0163] Assume that the cost metric function based on association C_{assoc} has been defined, which can be based on some matrix operation or complex statistical method to measure the difference between two neural networks in processing the association of text segments. For example, for a text containing multiple device inspection information, it is divided into m text segments, and an association matrix A is constructed, where A_{ij} represents the association between the i-th text segment and the j-th text segment (such as the probability of their simultaneous abnormality). For the guided neural network and the guided neural network, there are corresponding association matrices A^g and A^s, and the cost metric function based on association C_{assoc}(A^g,A^s) can be some norm of the difference between the corresponding elements of the two matrices, such as the Frobenius norm: C_{assoc}(A^g,A^s) = \sqrt{\sum_{i=1}^{m}\sum_{j=1}^{m}(A_{ij}^g-A_{ij}^s)^2}.

[0164] The guided text representation information is the feature representation of the text content of the target abnormal record identification result mined by the computer system in the guided neural network. Assume that the guided text representation information is a vector \vec{y}_g = [y_{g1}, y_{g2}, …, y_{gn}], where n is the dimension of the vector.

[0165] Vector distance metric is a method to measure the difference between two vectors. A feasible vector distance metric is the Euclidean distance. For the guided text representation information vector \vec{y}_g, the Euclidean distance between different parts of itself can be calculated to reflect its internal structure features. For example, divide the vector \vec{y}_g into several sub-vectors, let \vec{y}_{g1} = [y_{g1}, y_{g2}, …, y_{gk}] and \vec{y}_{g2} = [y_{g(k+1)}, y_{g(k+2)}, …, y_{gn}], then the Euclidean distance between them d(\vec{y}_{g1}, \vec{y}_{g2}) = \sqrt{\sum_{i=1}^{k}(y_{gi}-y_{g(i+k)})^2}. This internal vector distance metric can reflect the degree of association between different features in the guided text representation information.

[0166] The computer system determines the first association transfer learning cost value by combining the cost measure function based on association with the vector distance measure between the guidance text representation information. For example, let the first association transfer learning cost value be L_{assoc1}, it can be defined as L_{assoc1} = C_{assoc} * d(\vec{y}_{g1},\vec{y}_{g2}). The multiplication here represents a comprehensive consideration manner, that is, the difference of association (measured by C_{assoc}) and the internal structural features of the guidance text representation information (measured by d(\vec{y}_{g1},\vec{y}_{g2})) interact to determine the first association transfer learning cost value. The rationality of this manner lies in that if the difference of association is large (C_{assoc} is large), and at the same time the internal structural features of the guidance text representation information show that its association is also relatively complex (d(\vec{y}_{g1},\vec{y}_{g2}) is large), then the first association transfer learning cost value should be large, to reflect the uniqueness of the guidance neural network in association processing and the possible large difference with the guided neural network in this case.

[0167] In step S5222, similar to the guidance text representation information, the guided text representation information is the feature representation of the target abnormal record identification result text content mined by the computer system in the guided neural network, which is denoted as a vector vec{y}_s = [y_{s1}, y_{s2}, …, y_{sn}].

[0168] Similarly, the guided text representation information vector is divided to calculate the internal vector distance measure. For example, let vec{y}_{s1} = [y_{s1}, y_{s2}, …, y_{sk}] and vec{y}_{s2} = [y_{s(k+1)}, y_{s(k+2)}, …, y_{sn}], then the Euclidean distance between them d(\vec{y}_{s1},\vec{y}_{s2}) = \sqrt{\sum_{i=1}^{k}(y_{si}-y_{s(i+k)})^2}. This distance measure reflects the degree of association between different features in the guided text representation information.

[0169] The computer system determines a second association transfer learning cost value according to a vector distance measure between the cost measure function based on association and the guided text representation information. Let the second association transfer learning cost value be L_{assoc2}, it can be defined as L_{assoc2} = C_{assoc} x d(\vec{y}_{s1}, \vec{y}_{s2}). Here again, the difference in association (measured by C_{assoc}) is combined with the internal structural features of the guided text representation information (measured by d(\vec{y}_{s1}, \vec{y}_{s2})). The significance of this approach is that when the difference in association is large (C_{assoc} is large) and the internal structure of the guided text representation information shows certain association features (d(\vec{y}_{s1}, \vec{y}_{s2}) has a certain value), the second association transfer learning cost value will be correspondingly large, which helps to comprehensively consider the situation of the guided neural network in association processing when determining the overall association transfer learning cost value.

[0170] In step S5223, the first association transfer learning cost value L_{assoc1} reflects the situation of the guided neural network in association processing related to the cost measure function based on association and the internal structural features of its own representation information, and the second association transfer learning cost value L_{assoc2} reflects the situation of the guided neural network in the same respect. In order to determine the association transfer learning cost value comprehensively and accurately, both of these two cost values need to be considered.

[0171] Because in the process of knowledge extraction, the difference in association processing between the guided neural network and the guided neural network is interrelated, considering only one aspect cannot fully reflect the relationship between the two and the influence on the entire knowledge transfer learning process.

[0172] A feasible method to determine the association transfer learning cost value L_{assoc} is to take the weighted average of the first association transfer learning cost value and the second association transfer learning cost value. Let the weights be α and 1-α (0<α<1), then L_{assoc} = αL_{assoc1} + (1-α)L_{assoc2}.

[0173] For example, assuming L_{assoc1} = 0.6, L_{assoc2} = 0.4, and a = 0.5, then L_{assoc} = 0.5 x 0.6 + 0.5 x 0.4 = 0.5. This association transfer learning cost value will be used in subsequent steps (such as step S60) to guide the training of the guided neural network to adjust the network parameters so that it can better learn the association between text segments when processing inspection record texts and improve the accuracy of abnormal record identification.

[0174] The selection of the weight a can be adjusted according to the specific application scenario and data characteristics. If the association processing capability of the guided neural network is considered more reliable or more representative in actual situations, a larger value of a can be taken; on the contrary, if the association processing capability of the guided neural network is also important in some cases, a smaller value of a can be taken. For example, at the beginning of training, when the weight parameters of the guided neural network have not been well optimized, a larger value of a can be taken to rely more on the information of the guided neural network in association processing; as the training progresses, when the guided neural network is gradually optimized, a can be appropriately reduced to balance the roles of the two in association transfer learning.

[0175] In an embodiment, in step S52, determining the output transfer learning cost value according to the text content of the target abnormal record identification result and the cost metric function based on the output can include:

[0176] Step S52A: determining the execution standard of the text screening based on the network composition architecture of the guided neural network;

[0177] Step S52B: determining the label prediction of the guided neural network, the numerical prediction of the guided neural network, the label prediction of the guided neural network, and the numerical prediction of the guided neural network;

[0178] Step S52C: determining the output transfer learning cost value according to the execution standard of the text screening, the label prediction of the guided neural network, the numerical prediction of the guided neural network, the label prediction of the guided neural network, and the numerical prediction of the guided neural network.

[0179] In step S52A, the guiding neural network has a specific network composition architecture, which usually includes an input layer, multiple hidden layers, and an output layer. The input layer is responsible for receiving the inspection record text data, which is represented in the form of vectors in the network. For example, for a machine room inspection record text, the input layer can receive a vector containing information such as server CPU usage, memory occupancy, network device port connection status, etc. The role of the hidden layer is to extract features and perform nonlinear transformation on the input data. Each hidden layer contains multiple neurons, and the neurons are connected through weights. For example, the neurons of the first hidden layer will perform a weighted sum operation on the input vector, then pass it through an activation function (such as the ReLU function: f(x) = max(0, x)) for nonlinear transformation to obtain a new feature representation, which is then passed to the next hidden layer. The output layer produces the corresponding output according to the specific task, and in the processing of inspection record text, it may output a judgment on whether the inspection record is abnormal (such as an abnormal probability value or a classification result).

[0180] The computer system determines the execution standard of the text screening based on such a network composition architecture. Text screening is a technical means for processing different types of outputs (such as label prediction and numerical prediction) when migrating learning generation values.

[0181] For the connection weights and neuron activation functions between the input layer and the hidden layer, and between the hidden layers, the computer system can analyze which parts have a greater impact on the output result. For example, if some neurons of a certain hidden layer have a strong correlation with the results of abnormal classification in the output layer (through the analysis of the absolute value of the weight or other correlation measurement methods), these neurons corresponding to the input features may be considered when determining the execution standard of the text screening.

[0182] Assume that in the guide neural network, it is found through analysis that the connection weight from the input neuron corresponding to the server CPU usage to a certain hidden layer neuron is large, and this hidden layer neuron has an important influence on the final abnormal classification result. Then when determining the text shielding execution standard, if the focus is on the output transfer learning generation value calculation of abnormal classification (label prediction), when there is uncertainty or noise in the server CPU usage feature in the input inspection record text, the computer system may shield (or adjust the weight) the calculation path related to this feature according to this execution standard. A possible text shielding execution standard can be based on threshold setting. For example, for the connection weight, if the absolute value of a certain connection weight is less than a set threshold T_w (such as T_w = 0.01), the input feature related to this connection is shielded to some extent when calculating the output transfer learning generation value. For the activation value of the neuron, if the activation value is less than another threshold T_a (such as T_a = 0.1), the corresponding shielding or adjustment strategy can also be taken. Such execution standard helps to more accurately consider the influence of different input features on the output when calculating the output transfer learning generation value, especially when there is noise or unreliable input data.

[0183] In step S52B, in the inspection record text processing, label prediction refers to the classification result of the neural network on the inspection record, for example, judging whether the inspection record is "normal" or "abnormal", which is a qualitative output. Numerical prediction is the prediction of some numerical results related to the inspection record, for example, the specific numerical prediction of server CPU usage or the numerical prediction of abnormal probability, which is a quantitative output.

[0184] After the computer system inputs the text content of the target abnormal record recognition result into the guide neural network, it obtains the label prediction and numerical prediction results. For example, for a piece of server inspection record text, the label prediction result of the guide neural network may be "abnormal", indicating that it judges that there is an abnormal situation in the inspection record of this server. The numerical prediction result may be an abnormal probability of 0.8, indicating an 80% possibility of being abnormal, or a predicted value of 85% for server CPU usage (if it is part of the numerical prediction).

[0185] These prediction results are obtained based on the weight parameters, internal structure of the guide neural network and the processing of the input text content. In the guide neural network, after the input text is processed through multiple layers of weighted summation and activation function, the label prediction and numerical prediction results are obtained in the output layer according to the output of different neurons. For example, if the output layer has two neurons, one is used to represent the classification of normal / abnormal (by setting a threshold, such as output value greater than 0.5 indicating abnormal, less than or equal to 0.5 indicating normal), and the other is used to output the abnormal probability value or other numerical results.

[0186] Likewise, the computer system inputs the text content of the same target anomaly record recognition result to the student neural network, and obtains the label prediction and numerical prediction result of the student neural network. Since the weight parameters of the student neural network are different from those of the teacher neural network (although the network component architecture is the same), the prediction results may differ. For example, for the same server inspection record text, the label prediction result of the student neural network may be “normal”, and the numerical prediction result may be an anomaly probability of 0.2 or a predicted value of 75% for the server CPU usage rate.

[0187] In step S52C, the execution standard of the text shielding plays an important role in determining the output transfer learning generation value. According to the previously determined text shielding execution standard, the computer system adjusts the input features of the teacher neural network and the student neural network (if some features need to be shielded or their weights need to be adjusted), and then recalculates their prediction results (or directly uses the previous prediction results, but considers the influence of shielding when calculating the generation value).

[0188] For example, if the input feature related to the server memory occupancy rate is shielded according to the text shielding execution standard (because its connection weight is small or there is noise), then when calculating the output transfer learning generation value, the difference between the teacher neural network and the student neural network on this feature will not be considered too much, but more attention will be paid to the influence of other important features on the output.

[0189] First consider the part based on label prediction. Let the label prediction of the teacher neural network be L_g, and the label prediction of the student neural network be L_s. If L_g and L_s are different (for example, L_g is “abnormal” and L_s is “normal”), it indicates that there is a difference between the two neural networks in the classification result. The computer system can define a cost measurement function C_{L} based on label prediction. A simple way is that when L_g≠L_s, C_{L}=1; when L_g=L_s, C_{L}=0. This function intuitively reflects the difference in label prediction.

[0190] Then consider the part based on numerical prediction. Let the numerical prediction of the teacher neural network be N_g, and the numerical prediction of the student neural network be N_s. For example, N_g is an anomaly probability of 0.8, and N_s is an anomaly probability of 0.2. The computer system can define a cost measurement function C_{N} based on numerical prediction. A feasible way is to calculate the absolute value of the difference between the two, that is, C_{N}=\vert N_g-N_s\vert. This function measures the difference in numerical prediction.

[0191] The computer system synthesizes the label-predicted generation value and the numerical-value-predicted generation value according to the execution standard of the text shield to determine an output transfer learning generation value. Let the output transfer learning generation value be L out.

[0192] One possible synthesis method is weighted summation. Let the weights be a and 1-a (0 < a < 1) for the label-predicted generation value and the numerical-value-predicted generation value, respectively. Then L out = aC L + (1-a)C N. For example, take a = 0.3, if C L = 1 (because the label predictions are different), C N = |0.8-0.2| = 0.6, then L out = 0.3x1 + (1-0.3)x0.6 = 0.3+0.42 = 0.72.

[0193] This way of determining the output transfer learning generation value comprehensively considers the differences between the label predictions and the numerical-value predictions, and to some extent, excludes the interference of less reliable input features on the calculation through the execution standard of the text shield, so that the output transfer learning generation value can more accurately reflect the differences between the guide neural network and the guided neural network in the output, thereby in the subsequent training process of the guided neural network (such as step S60), the network parameters can be adjusted according to this generation value to improve the output accuracy of the guided neural network, so that it can more accurately identify abnormal records in the inspection record text processing.

[0194] In one implementation, step S52C, determining the output transfer learning generation value according to the execution standard of the text shield, the label prediction of the guide neural network, the numerical-value prediction of the guide neural network, the label prediction of the guided neural network, and the numerical-value prediction of the guided neural network, can include:

[0195] Step S52C1: determining a first output transfer learning generation value according to the type mapping generation cost measurement function corresponding to the guide neural network, the label prediction of the guide neural network, and the label prediction of the guided neural network;

[0196] Step S52C2: determining a second output transfer learning generation value according to the numerical-value mapping generation cost measurement function corresponding to the guide neural network, the numerical-value prediction of the guide neural network, and the numerical-value prediction of the guided neural network;

[0197] Step S52C3: determining the output transfer learning generation value according to the execution standard of the text shield, the first output transfer learning generation value, and the second output transfer learning generation value.

[0198] In step S52C, the computer system determines the output transfer learning cost value according to the execution criterion of the text shield, the label prediction of the guided neural network, the numerical prediction of the guided neural network, the label prediction of the guided neural network, and the numerical prediction of the guided neural network.

[0199] In step S52C1, the type mapping cost measurement function is a function for measuring the difference between the guided neural network and the guided neural network in label prediction (classification result). It is constructed based on the understanding of the relationship between different labels and the practical significance in the processing of inspection record texts.

[0200] For example, in the processing of machine room inspection record texts, the labels are "normal" and "abnormal". For these two labels, the type mapping cost measurement function needs to consider the case when the guided neural network predicts "normal" and the guided neural network predicts "abnormal", or vice versa. A simple way to construct it is based on the cost of misclassification. Suppose that misjudging a normal inspection record as abnormal may lead to unnecessary inspection work, with a cost of C_{1}, while misjudging an abnormal inspection record as normal may lead to equipment failure not being discovered in time, with a cost of C_{2} (and C_{2} > C_{1}).

[0201] Let the label prediction of the guided neural network be L_g and the label prediction of the guided neural network be L_s. When L_g = "normal" and L_s = "abnormal", the value of the type mapping cost measurement function C_{map} is C_{1}; when L_g = "abnormal" and L_s = "normal", the value of C_{map} is C_{2}; when L_g = L_s, C_{map} = 0.

[0202] The computer system determines the first output transfer learning cost value L_{out1} according to the type mapping cost measurement function described above and the label predictions of the two neural networks.

[0203] For example, suppose that in the processing of a server inspection record, the label prediction of the guided neural network L_g = "abnormal" and the label prediction of the guided neural network L_s = "normal". According to the type mapping cost measurement function set in the previous step, since the cost corresponding to this misjudgment is C_{2}, the first output transfer learning cost value L_{out1} = C_{2}. This way of determining the first output transfer learning cost value takes into account the different impacts of different label prediction errors in practical application scenarios, making the cost value more accurately reflect the differences between the two neural networks in label prediction and their importance to the entire inspection data processing.

[0204] In the embodiments of the present application, the computer system can find the pre-set type mapping cost metric function table or write specific conditional judgment statements to realize this process.

[0205] In step S52C2, the numerical mapping cost metric function is used to measure the difference between the guided neural network and the guided neural network in numerical prediction. In the processing of the inspection record text, numerical prediction can include the prediction of device parameters (such as server CPU usage, memory occupancy, etc.) or numerical prediction of abnormal probability, etc.

[0206] For example, for numerical prediction of abnormal probability, the numerical mapping cost metric function needs to consider the influence of the difference between the predicted values on the judgment of whether the inspection record is abnormal. A feasible numerical mapping cost metric function can be based on the absolute value of the difference. Let the numerical prediction of the guided neural network be N_g, and the numerical prediction of the guided neural network be N_s. The numerical mapping cost metric function C_{num} can be defined as C_{num}=\vert N_g-N_s\vert. This function intuitively reflects the difference between the two numerical predictions.

[0207] However, in some cases, more complex numerical mapping cost metric functions can be needed. For example, when considering the prediction of server CPU usage, if the actual normal CPU usage range is 30%-70%, then for the predicted values close to the boundary of this range, the difference can have a greater impact. A range-based numerical mapping cost metric function can be defined, such as when \vert N_g-N_s\vert is small, if N_g and N_s are close to 30% or 70%, the value of C_{num} is relatively large; if N_g and N_s are in the middle of the range, the value of C_{num} is relatively small.

[0208] The computer system determines the second output transfer learning cost value L_{out2} according to the numerical mapping cost metric function and the numerical predictions of the two neural networks.

[0209] For example, assume that the guided neural network predicts the numerical value of the server's abnormal probability N_g=0.8, and the numerical prediction of the guided neural network N_s=0.2. According to the simple numerical mapping cost metric function C_{num}=\vert N_g-N_s\vert=\vert0.8-0.2\vert=0.6, so the second output transfer learning cost value L_{out2}=0.6.

[0210] If a more complex numerical mapping cost metric function is used, such as the range-based function mentioned above, assuming N_g = 72% (representing the prediction of server CPU usage), N_s = 68%, although \vert N_g - N_s \vert = 4% is relatively small, since it is close to the boundary of the normal range 70%, according to the range-based numerical mapping cost metric function, the value of C_{num} can be larger than the value calculated by simple difference, and thus L_{out2} will also increase accordingly. This reflects that in this case, small differences in numerical prediction can also have a greater impact on determining whether it is abnormal.

[0211] In step S52C3, the execution criteria of text screening plays a role in adjusting and optimizing the determination of the output transfer learning cost value. In the previous steps, the first output transfer learning cost value L_{out1} and the second output transfer learning cost value L_{out2} have been determined, but these two cost values can be affected by some unreliable input features or network parts.

[0212] For example, when calculating the difference of numerical prediction, if some input features (such as the part related to server memory occupancy rate in the inspection record text) have noise or have little effect on the overall result (determined according to the text screening execution criteria), then when determining the final output transfer learning cost value, L_{out1} and L_{out2} need to be adjusted according to this criterion.

[0213] One possible method to determine the output transfer learning cost value L_{out} is weighted summation. Let the weights α and 1-α (0 < α < 1) be associated with the first output transfer learning cost value and the second output transfer learning cost value respectively. According to the execution criteria of text screening, this weight can change.

[0214] For example, if according to the text screening execution criteria, it is found that the label prediction part (corresponding to L_{out1}) is less disturbed, while the numerical prediction part (corresponding to L_{out2}) can be affected by some unreliable input features, then the value of α can be appropriately increased. Assuming α = 0.7, L_{out1} = C_{2} (assuming C_{2} = 0.8), L_{out2} = 0.6, then L_{out} = αL_{out1} + (1-α)L_{out2} = 0.7×0.8 + (1-0.7)×0.6 = 0.56 + 0.18 = 0.74.

[0215] Another possible way is to modify L_{out1} and L_{out2} according to the text shielding execution standard and then sum them up. For example, if it is found that a certain input feature has certain interference on the label prediction, L_{out1} is modified to L_{out1}' according to the text shielding execution standard (assuming it is modified to 0.6), and then L_{out} is calculated as L_{out1}'+L_{out2} = 0.6+0.6 = 1.2.

[0216] Through steps S52C1-S52C3, the computer system can accurately determine the output transfer learning generation value by comprehensively considering various factors. This generation value reflects the difference between the guided neural network and the guided neural network in the output, and the possible interference factors are processed through the text shielding execution standard, thereby providing a more reasonable and accurate basis for the subsequent training of the guided neural network, which helps to improve the performance of the inspection record text processing neural network in the abnormal record identification.

[0217] The embodiment of the present application provides a computer system, including a memory and a processor, the memory stores a computer program capable of running on the processor, and the processor implements part or all steps of the above method when executing the program.

[0218] Figure 2 A hardware entity schematic diagram of a computer system provided by the embodiment of the present application is shown in the figure, the hardware entity of the computer system 1000 includes a processor 1001 and a memory 1002, wherein the memory 1002 stores a computer program capable of running on the processor 1001, and the processor 1001 implements the steps in the method of any of the above embodiments when executing the program. Figure 2

[0219] The above is only the embodiment of the present application, but the protection scope of the present application is not limited to this, any person skilled in the art can easily think of changes or replacements within the technical range disclosed by the present application, which should be covered in the protection scope of the present application.​

Claims

1. An automated analysis method for inspection data, characterized in that, The method includes: Obtain the training text of the inspection record; Based on a pre-tuned guided neural network, the inspection record training text is used to identify abnormal records, resulting in a first abnormal record identification result. This first abnormal record identification result includes multiple first inference label windows and multiple first inference support coefficients corresponding to different abnormal inspection categories. Anomaly identification is performed on the inspection record training text based on the guided neural network to obtain a second anomaly identification result. The guided neural network and the guiding neural network contain the same neural network composition. The second anomaly identification result includes multiple second inference label windows and multiple second inference support coefficients corresponding to anomaly inspection categories. Based on the relative magnitude of the support coefficients between the first inference support coefficient and the second inference support coefficient, multiple anomaly labeling windows for the target to be filtered are determined in the first inference labeling window and the second inference labeling window; Based on the first inference support coefficient and the support coefficient error between the second inference support coefficient, the original error value corresponding to the anomaly marking window of the target to be screened is determined; A reference anomaly marker window is obtained by filtering through multiple target anomaly marker windows to be filtered based on the original error value; Based on the intersection-union ratio (IUU) between the reference anomaly marker window and the remaining target anomaly marker windows to be screened, the remaining target anomaly marker windows to be screened are selected to obtain a set number of target anomaly record identification results; Generate cost measurement functions based on representation information, cost measurement functions based on correlation, and cost measurement functions based on output; Based on the text content of the target anomaly record identification result, the cost metric function based on representation information, the cost metric function based on correlation, and the cost metric function based on output, the transfer learning cost value of representation information, the transfer learning cost value of correlation, and the transfer learning cost value of output are determined. Based on the transfer learning value of the representation information, the transfer learning value of the correlation, and the transfer learning value of the output, the trained neural network is urged to train and obtain the inspection record text processing neural network. Obtain the inspection record text of the suspected anomaly identification recorded on the inspection terminal during the computer room inspection process; Neural network for acquiring and processing inspection record text; The inspection record text processing neural network is used to identify abnormal records in the inspection record text that is intended for anomaly identification, and the abnormal record identification result is obtained. When the abnormal record identification result indicates that an abnormal record has been identified, the identified abnormal record is displayed and marked in the inspection terminal; The inspection record text processing neural network is obtained through self-knowledge extraction based on the transfer learning cost of representation information, the transfer learning cost of correlation, and the transfer learning cost of output, using a pre-tuned guiding neural network. The transfer learning cost of representation information is obtained based on the error between the representation information of the guiding neural network and the representation information of the inspection record text processing neural network. The transfer learning cost of correlation is obtained based on the correlation between different text segments in the same inspection record text. The transfer learning cost of output is obtained based on the error between the output of the guiding neural network and the output of the inspection record text processing neural network.

2. The method according to claim 1, characterized in that, Based on the text content of the target anomaly record identification results, the cost metric function based on representation information, and the cost metric function based on correlation, the value of the transfer learning of representation information and the value of the transfer learning of correlation are determined, including: Based on the text content of the target anomaly record identification result, guiding text representation information is mined in the guiding neural network, and guided text representation information is mined in the guided neural network. The transfer learning cost of the representation information and the transfer learning cost of the correlation are determined based on the cost metric function based on the representation information, the cost metric function based on the correlation, the representation information of the guiding text, and the representation information of the guided text.

3. The method according to claim 2, characterized in that, The step of mining guiding text representation information in the guiding neural network and mining guided text representation information in the guided neural network based on the text content of the target anomaly record identification result includes: The proposed optimized guiding text representation information is mined from the guiding neural network, and the proposed optimized guided text representation information is mined from the guided neural network. Based on the text content of the target anomaly record identification result, adjust the dimension of the proposed optimized guidance text representation information to obtain guidance text representation information; Based on the text content of the target anomaly record identification result, adjust the dimension of the text representation information to be optimized to obtain the text representation information. The relevance transfer learning cost is determined based on the relevance-based cost metric function, the guiding text representation information, and the guided text representation information, including: The first relevance transfer learning cost is determined based on the relevance-based cost metric function and the vector distance metric between the guiding text representation information. The second relevance transfer learning cost is determined based on the relevance-based cost metric function and the vector distance metric between the guided text representation information. The correlation transfer learning generation value is determined based on the first correlation transfer learning generation value and the second correlation transfer learning generation value.

4. The method according to claim 1, characterized in that, Based on the text content of the target anomaly record identification result and the output-based cost metric function, the output transfer learning cost value is determined, including: Based on the network architecture of the guiding neural network, the execution criteria for text blocking are determined; The label prediction of the guiding neural network, the numerical prediction of the guiding neural network, the label prediction of the guided neural network, and the numerical prediction of the guided neural network are determined. The output transfer learning value is determined based on the text masking execution criteria, the label prediction of the guiding neural network, the numerical prediction of the guiding neural network, the label prediction of the guided neural network, and the numerical prediction of the guided neural network.

5. The method according to claim 4, characterized in that, The step of determining the output transfer learning value based on the text masking execution criteria, the label prediction of the guiding neural network, the numerical prediction of the guiding neural network, the label prediction of the guided neural network, and the numerical prediction of the guided neural network includes: The first output transfer learning cost is determined based on the type mapping cost metric function corresponding to the guiding neural network, the label prediction of the guiding neural network, and the label prediction of the guided neural network. The second output transfer learning generation value is determined based on the numerical mapping cost metric function corresponding to the guiding neural network, the numerical prediction of the guiding neural network, and the numerical prediction of the guided neural network. The output transfer learning value is determined based on the execution criteria of the text masking, the first output transfer learning value, and the second output transfer learning value.

6. A computer system comprising a memory and a processor, the memory storing a computer program executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the method according to any one of claims 1 to 5.

Images