Diagnostic information determination method and device, storage medium and electronic equipment

Abstract

The invention discloses a diagnosis information determination method and device, a storage medium and electronic equipment, and relates to the technical field of information processing. The method comprises the following steps: acquiring fault information of an information system; classifying the fault information to obtain a fault category to which the fault information belongs; a query template corresponding to the fault category is called, a query statement matched with the fault information is determined, the query template is used for representing a rule for querying the fault information, and the query statement is used for representing a query instruction generated based on the query template; and utilizing the query statement to query in a knowledge graph of the information system to obtain diagnosis information of the information system, the diagnosis information being used for representing a fault reason of the information system, and the knowledge graph comprising an association relationship between historical diagnosis information of the information system and knowledge data of the information system. The technical problem that the efficiency of determining the diagnosis information is low is solved.

Description

Technical Field

[0001] The present application relates to the field of information processing technology, and in particular to a method, device, storage medium and electronic device for determining diagnostic information. Background Art

[0002] At present, when an information system fails, it is of great significance to locate the failure and restore the normal operation of the information system in time.

[0003] In related technologies, information system fault location methods usually rely on expert experience and analysis and judgment by consulting relevant data. When dealing with multi-system interaction failures, there is a lack of effective methods to integrate and analyze complex data relationships. Troubleshooting usually takes a long time and is prone to omissions and errors. It is difficult to cope with the growing amount of data and service needs, resulting in the technical problem of low efficiency in determining diagnostic information.

[0004] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0005] The embodiments of the present application provide a method, device, storage medium and electronic device for determining diagnostic information, so as to at least solve the technical problem of low efficiency in determining diagnostic information.

[0006] According to one aspect of an embodiment of the present application, a method for determining diagnostic information is provided. The method may include: obtaining fault information of an information system, wherein the fault information is used to indicate the fault condition of the information system during operation; classifying the fault information to obtain the fault category to which the fault information belongs; calling a query template corresponding to the fault category to determine a query statement matching the fault information, wherein the query template is used to indicate the rule for querying the fault information, and the query statement is used to indicate the query instruction generated based on the query template; using the query statement, querying in the knowledge graph of the information system to obtain diagnostic information of the information system, wherein the diagnostic information is used to indicate the cause of the fault of the information system, and the knowledge graph includes the association relationship between the historical diagnostic information of the information system and the knowledge data of the information system.

[0007] Optionally, the method also includes: acquiring knowledge data, wherein the knowledge data includes text knowledge data and image knowledge data; calling a text processing model to extract text features of the text knowledge data, and calling an image processing model to extract visual features of the image knowledge data, wherein the text processing model is trained based on text knowledge data samples, and the image processing model is trained based on image knowledge data samples; converting text features into text encoding vectors, and converting visual features into visual encoding vectors; and constructing a knowledge graph based on the text encoding vectors and the visual encoding vectors.

[0008] Optionally, a knowledge graph is constructed based on the text encoding vector and the visual encoding vector, including: fusing the text encoding vector and the visual encoding vector to obtain a multimodal encoding vector, wherein the multimodal encoding vector at least includes an interaction encoding vector between the text encoding vector and the visual encoding vector; based on the multimodal encoding vector, calling a sequence labeling model to perform sequence labeling on the text encoding vector to obtain multiple entities to be constructed and entity relationships between the multiple entities; based on the multiple entities and entity relationships, a knowledge graph is constructed, wherein the multiple entities are used to represent multiple nodes of the knowledge graph, and the entity relationships are used to represent the edges of the knowledge graph.

[0009] Optionally, classifying the fault information to obtain the fault category to which the fault information belongs includes: performing semantic analysis on the fault information to obtain a semantic analysis result; and classifying the fault information using the semantic analysis result to obtain the fault category.

[0010] Optionally, the semantic analysis result includes at least entities in the fault information, and the query template corresponding to the fault category is called to determine the query statement that matches the fault information, including: performing entity linking on the entities in the fault information to obtain entity linking results, wherein the entity linking results are used to indicate that the entities in the fault information are linked to entities in the knowledge graph; and constructing a query statement based on the query template and the entity linking results.

[0011] Optionally, the fault information is classified to obtain the fault category to which the fault information belongs, including: performing a sliding window operation on the fault information to obtain a word fragment sequence; converting the word fragment sequence into a word vector, and classifying the word vector using a classification model to obtain the fault category.

[0012] Optionally, after using a query statement to query the knowledge graph of the information system and obtaining diagnostic information of the information system, the method also includes: in response to the diagnostic information being historical diagnostic information stored in the knowledge graph, determining the historical diagnostic information as the diagnostic information; in response to the diagnostic information being historical diagnostic information not stored in the knowledge graph, determining initial diagnostic information from the knowledge graph based on the fault category, and analyzing the initial diagnostic information in combination with an auxiliary detection method to obtain diagnostic information, wherein different auxiliary detection methods correspond to different fault categories.

[0013] Optionally, the method also includes: in response to the fault category being a new performance error code fault category, determining the auxiliary detection method is to determine the diagnostic information based on the error description information in the initial diagnostic information; in response to the fault category being a new performance site description fault category, determining the auxiliary detection method is to perform an aggregate analysis on the initial diagnostic information in combination with multiple detection indicators to obtain the diagnostic information; in response to the fault category being a new business error code fault category, determining the auxiliary detection method is to detect the initial diagnostic information based on the correlation sorting result of the error interface to obtain the diagnostic information; in response to the fault category being a new business phenomenon description fault, determining the auxiliary detection method is to perform log anomaly detection on the initial diagnostic information to obtain the diagnostic information.

[0014] Optionally, the method also includes: obtaining feedback information of the diagnostic information; and updating the knowledge graph based on the feedback information.

[0015] According to another aspect of the embodiment of the present application, a device for determining diagnostic information is also provided. The device may include: an acquisition unit, used to acquire fault information of an information system, wherein the fault information is used to indicate the fault condition of the information system during operation; a classification unit, used to classify the fault information and obtain the fault category to which the fault information belongs; a determination unit, used to call a query template corresponding to the fault category and determine a query statement matching the fault information, wherein the query template is used to indicate the rule for querying the fault information, and the query statement is used to indicate the query instruction generated based on the query template; a query unit, used to query the knowledge graph of the information system using the query statement and obtain the diagnostic information of the information system, wherein the diagnostic information is used to indicate the cause of the fault of the information system, and the knowledge graph includes the association relationship between the historical diagnostic information of the information system and the knowledge data of the information system.

[0016] According to another aspect of an embodiment of the present application, a non-volatile storage medium is also provided, including: the storage medium includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute any method for determining diagnostic information.

[0017] According to another aspect of an embodiment of the present invention, a processor is further provided. The processor is used to run a program, wherein the method for determining diagnostic information in an embodiment of the present invention is executed when the program is run.

[0018] According to another aspect of an embodiment of the present application, there is also provided an electronic device, comprising: a processor; and a memory for storing instructions executable by the processor; wherein the processor is configured to execute instructions to implement any method for determining diagnostic information.

[0019] According to another aspect of the embodiment of the present application, a computer program product is further provided. The computer program product may include a computer program, wherein the computer program is configured to execute any of the above-mentioned methods for determining diagnostic information when running.

[0020] According to another aspect of the embodiment of the present application, a computer program product is also provided. The computer program product may include a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores a computer program, and the computer program is configured to execute any of the above-mentioned diagnostic information determination methods when running.

[0021] According to another aspect of the embodiment of the present application, a computer program is further provided, wherein the computer program is configured to execute any one of the above-mentioned methods for determining diagnostic information when running.

[0022] In an embodiment of the present application, fault information of an information system is obtained, wherein the fault information is used to indicate a fault condition of the information system during operation; the fault information is classified to obtain a fault category to which the fault information belongs; a query template corresponding to the fault category is called to determine a query statement that matches the fault information, wherein the query template is used to indicate a rule for querying the fault information, and the query statement is used to indicate a query instruction generated based on the query template; the query statement is used to query the knowledge graph of the information system to obtain diagnostic information of the information system, wherein the diagnostic information is used to indicate a cause of the fault of the information system, and the knowledge graph includes an association between historical diagnostic information of the information system and knowledge data of the information system, thereby achieving a technical effect of improving the efficiency of determining diagnostic information, and further solving the technical problem of low efficiency in determining diagnostic information. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0024] Figure 1 is a flow chart of a method for determining diagnostic information according to an embodiment of the present application;

[0025] Figure 2 is a schematic diagram of a rapid fault location system based on a knowledge graph of a civil aviation passenger service system according to an embodiment of the present application;

[0026] Figure 3 is a schematic diagram of another rapid fault location system based on a knowledge graph of a civil aviation passenger service system according to an embodiment of the present application;

[0027] Figure 4It is a schematic diagram of constructing a knowledge graph database according to an embodiment of the present application;

[0028] Figure 5 is a schematic diagram of a classifier constructed according to an embodiment of the present application;

[0029] Figure 6 is a schematic diagram of a fastText model architecture according to an embodiment of the present application;

[0030] Figure 7 is a structural schematic diagram of a device for determining diagnostic information according to an embodiment of the present application;

[0031] Figure 8 is a schematic block diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0032] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0033] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0034] According to an embodiment of the present application, a method embodiment of a method for determining diagnostic information is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0035] Figure 1 is a flow chart of a method for determining diagnostic information according to an embodiment of the present application. Figure 1As shown, the method may include the following steps:

[0036] Step S102, obtaining fault information of the information system, wherein the fault information is used to indicate a fault condition of the information system during operation.

[0037] In the technical solution provided in the above step S102, the fault information of the information system can be obtained. The information system can be a civil aviation passenger service system (PSS), which can also be called a civil aviation information system. The fault information can be used to indicate the fault condition of the information system during operation, and the fault information can also be called fault reporting information, fault SMS, etc.

[0038] Optionally, the failure of the civil aviation passenger service system refers to an event in which a part or all of the functions in the civil aviation passenger service system fail and thus affects user use, and failure information displayed by the civil aviation passenger service system due to the failure may be received.

[0039] Step S104: classify the fault information to obtain the fault category to which the fault information belongs.

[0040] In the technical solution provided in the above step S104, after acquiring the fault information of the information system, the fault information can be classified to obtain the fault category to which the fault information belongs. Among them, the fault category may include historical faults and new faults, the new faults may include new performance faults and new service faults, the new performance faults may include new performance error code faults and new performance phenomenon description faults. New service faults may include new service error code faults and new service phenomenon description faults.

[0041] Optionally, after obtaining the fault information of the information system, a text classification algorithm, such as a shallow network (fastText), can be used to classify the fault information to obtain the fault category to which the fault information belongs. Among them, fastText is an efficient text classification and feature learning method, similar to the three-layer structure of the continuous bag of words (CBOW) model, fastText can include an input layer, a hidden layer, and an output layer.

[0042] Step S106, calling the query template corresponding to the fault category to determine the query statement matching the fault information, wherein the query template is used to represent the rule for querying the fault information, and the query statement is used to represent the query instruction generated based on the query template.

[0043] In the technical solution provided in the above step S106, after the fault information is classified and the fault category to which the fault information belongs is obtained, the query template corresponding to the fault category can be called to determine the query statement matching the fault information. The query template can be used to represent the rule for querying the fault information. The query statement can be used to represent the query instruction generated based on the query template, and can be represented by a cypher statement.

[0044] Optionally, a specific query template is set for each type of fault, and the query template corresponding to the fault type is called to construct a cypher statement. The cypher statement may be a structured query language (SQL) based on a graph database, which can be used to query data in the graph database.

[0045] Step S108, using a query statement, querying the knowledge graph of the information system to obtain diagnostic information of the information system, wherein the diagnostic information is used to indicate the cause of the failure of the information system, and the knowledge graph includes the association relationship between the historical diagnostic information of the information system and the knowledge data of the information system.

[0046] In the technical solution provided in the above step S108, after calling the query template corresponding to the fault category and determining the query statement matching the fault information, the query statement can be used to query the knowledge graph of the information system to obtain the diagnostic information of the information system. Among them, the diagnostic information can be used to indicate the cause of the fault of the information system. The knowledge graph includes the association relationship between the historical diagnostic information of the information system and the knowledge data of the information system.

[0047] It should be noted that the knowledge data may be knowledge materials related to the civil aviation information system, including but not limited to error codes, business manuals, software design documents, interface documents, and configuration tables. Knowledge data exists in a variety of formats, such as documents (e.g., Word), Hypertext Markup Language Document (HTML) files, and tables. The knowledge graph may be a graph-based data structure consisting of nodes and edges, where each node represents an entity and each edge is a relationship between entities.

[0048] Optionally, after constructing the cypher statement, the cypher statement can be used to search the knowledge graph to determine the diagnostic information (i.e., the preliminary positioning result). Depending on the customized route, the diagnostic information can be a preliminary suspicious interface, an error description, or a cause of the fault or a solution, etc. This is only an example and does not impose specific restrictions on the type of diagnostic information.

[0049] In an embodiment of the present application, fault information of an information system is obtained, wherein the fault information is used to indicate a fault condition of the information system during operation; the fault information is classified to obtain a fault category to which the fault information belongs; a query template corresponding to the fault category is called to determine a query statement that matches the fault information, wherein the query template is used to indicate a rule for querying the fault information, and the query statement is used to indicate a query instruction generated based on the query template; the query statement is used to query the knowledge graph of the information system to obtain diagnostic information of the information system, wherein the diagnostic information is used to indicate a cause of the fault of the information system, and the knowledge graph includes an association between historical diagnostic information of the information system and knowledge data of the information system, thereby achieving a technical effect of improving the efficiency of determining diagnostic information, and further solving the technical problem of low efficiency in determining diagnostic information.

[0050] The above embodiments of the present application are further described below.

[0051] In this embodiment, the method also includes: acquiring knowledge data, wherein the knowledge data includes text knowledge data and image knowledge data; calling a text processing model to extract text features of the text knowledge data, and calling an image processing model to extract visual features of the image knowledge data, wherein the text processing model is trained based on text knowledge data samples, and the image processing model is trained based on image knowledge data samples; converting text features into text encoding vectors, and converting visual features into visual encoding vectors; and constructing a knowledge graph based on the text encoding vectors and the visual encoding vectors.

[0052] In this embodiment, the knowledge data may include text knowledge data and image knowledge data, the text knowledge data may be referred to as text data, and the image knowledge data may be referred to as image data. The text processing model may be a Bidirectional Encoder Representations from Transformers (BERT) model. The image processing model may be a deep learning model (e.g., Inception model).

[0053] Optionally, for text content (i.e., text data), the BERT model is used to extract text features and convert the text features into text encoding vectors. For image content (i.e., image data), the Inception model is used to extract visual features of the image region and convert the visual features into visual encoding vectors. The text encoding vectors and visual encoding vectors can be further used to construct a knowledge graph.

[0054] It should be noted that the process of determining diagnostic information in this embodiment is based on the knowledge graph. Therefore, it is necessary to first build a knowledge graph database based on the civil aviation information system, the core of which is the data modeling process. After collecting various knowledge data related to the civil aviation information system, not only the textual descriptions in the knowledge data should be considered, but also special attention should be paid to the image information contained in the knowledge data, because the image information is closely related to the described object. In addition, it is necessary to ensure that the target visual object referred to by the text can be accurately identified, so as to correctly establish the correspondence between the object and the entity, and extract new relationship facts therefrom.

[0055] In some embodiments of the present application, a knowledge graph is constructed based on a text encoding vector and a visual encoding vector, including: fusing the text encoding vector and the visual encoding vector to obtain a multimodal encoding vector, wherein the multimodal encoding vector at least includes an interaction encoding vector between the text encoding vector and the visual encoding vector; based on the multimodal encoding vector, calling a sequence labeling model to perform sequence labeling on the text encoding vector to obtain multiple entities to be constructed in the knowledge graph and entity relationships between the multiple entities; based on the multiple entities and entity relationships, a knowledge graph is constructed, wherein the multiple entities are used to represent multiple nodes of the knowledge graph, and the entity relationships are used to represent the edges of the knowledge graph.

[0056] In this embodiment, the multimodal encoding vector may at least include an interactive encoding vector between a text encoding vector and a visual encoding vector. The sequence labeling model may be a deep learning model combining a bidirectional long short-term memory network (Bidirectional LongShort-Term Memory, referred to as BiLSTM) and a conditional random field (Conditional Random Field, referred to as CRF). The BiLSTM+CRF model is suitable for sequence labeling tasks, such as named entity recognition (NamedEntity Recognition, referred to as NER).

[0057] Optionally, in order to process the information in the text and image slices, a multimodal feature extraction fusion method is used. In order to better fuse the text encoding vector and the visual encoding vector, a bilinear pooling method is used to effectively capture the interactive information between different modal features, and through the gating mechanism, determine which information should be retained and which should be discarded, thereby helping the model to better handle long-term dependency issues. Subsequently, the BiLSTM+CRF framework is used to perform sequence annotation of the text, and finally the multimodal knowledge form is converted into entities and relationships in the knowledge graph and stored in a graph database (e.g., Neo4j).

[0058] This embodiment collects civil aviation business manuals, error code manuals, interface documents, design documents and other materials to perform entity recognition, and extracts the relationships between entities from the data, such as the relationship between software products and error codes, the relationship between software interfaces and businesses, interface call relationships, etc., and uses a graph database to store these entities and the relationships between entities to form a knowledge graph.

[0059] In some embodiments of the present application, step S104, classifying the fault information to obtain the fault category to which the fault information belongs, includes: performing semantic analysis on the fault information to obtain a semantic analysis result; and using the semantic analysis result to classify the fault information to obtain a fault category.

[0060] Optionally, after obtaining the fault information, semantic analysis is performed on the fault information, including word segmentation, named entity recognition, semantic parsing, etc., so as to understand key information in the fault information, such as fault phenomenon, error code, timestamp, etc. The text classification algorithm fastText is further used to classify the fault information to obtain the fault category.

[0061] In some embodiments of the present application, the semantic analysis result includes at least entities in the fault information. Step S106 calls the query template corresponding to the fault category to determine a query statement that matches the fault information, including: performing entity linking on the entities in the fault information to obtain entity linking results, wherein the entity linking results are used to indicate that the entities in the fault information are linked to entities in the knowledge graph; and constructing a query statement based on the query template and the entity linking results.

[0062] In this embodiment, the semantic analysis result may at least include entities in the fault information. After classifying the fault information and obtaining the fault category to which the fault information belongs, entity linking may be performed on the entities in the fault information to obtain entity linking results. Further based on the query template and the entity linking results, a query statement may be constructed. Among them, entity linking may be a natural language processing (NLP) technology, the purpose of which is to identify entity mentions in the text and link the entity to the corresponding entity in the knowledge base (e.g., a knowledge graph or an encyclopedia).

[0063] Optionally, after performing semantic analysis on the fault information, including word segmentation, named entity recognition, semantic parsing, etc., in order to understand the key information in the fault information, such as the fault phenomenon, error code, timestamp, etc., a specific query template is set for each type of fault, and the entities identified in the above preprocessing link are entity linked to construct a cypher statement.

[0064] In some embodiments of the present application, step S104, classifying the fault information to obtain the fault category to which the fault information belongs, includes: performing a sliding window operation on the fault information to obtain a word fragment sequence; converting the word fragment sequence into a word vector, and using a classification model to classify the word vector to obtain the fault category.

[0065] It should be noted that after building the data base, when new fault information is triggered, the fault information is first classified, and the fastText algorithm can be used for text classification. Among them, the fastText algorithm uses a shallow neural network structure for text classification. By adding or averaging all word vectors (including n-gram vectors) in a sentence, a sentence vector is obtained, and then this vector is used for classification. This method is simple and effective, avoiding complex hierarchical structures and reducing the risk of overfitting. FastText has high accuracy and is many orders of magnitude faster than deep networks in training time. Since fault information is usually well-formatted and simple in content, this lightweight algorithm can achieve the effect of pursuing speed.

[0066] Optionally, fastText is a supervised classification algorithm. First, a labeled classifier is built. According to the fault characteristics, the faults are classified into historical faults and new faults. On this basis, new faults can be divided into new performance faults or new business faults. For example, problems such as no response and timeout are performance faults, while phenomena such as no passenger information are business faults. Subclasses are set under each type of fault, including error code faults and on-site description faults. For example, 008-04-0321 is an error code fault, and failure to check in is a phenomenon description fault. The classifier is built in this way.

[0067] Furthermore, the fastText model is used to perform n-gram preprocessing on the input, and the fault information is slid in a window of size n according to the word order, finally forming a sequence of word fragments with a window of n. The n-gram vector is obtained by superimposing the word embedding (embedding), and then the fault information word and n-gram vector are superimposed and averaged to obtain the fault information vector. The distance of the vector can be used to measure the semantic similarity between words, and then the fault information vector is used for multi-classification (softmax). Finally, fastText outputs the fault information to different labels of the classifier by predicting the label, thus completing the text classification process.

[0068] In some embodiments of the present application, in step S108, after querying the knowledge graph of the information system using a query statement to obtain diagnostic information of the information system, the method further includes: in response to the diagnostic information being historical diagnostic information stored in the knowledge graph, determining the historical diagnostic information as the diagnostic information; in response to the diagnostic information being historical diagnostic information not stored in the knowledge graph, determining initial diagnostic information from the knowledge graph based on the fault category, and analyzing the initial diagnostic information in combination with an auxiliary detection method to obtain diagnostic information, wherein different auxiliary detection methods correspond to different fault categories.

[0069] Optionally, a corresponding query template and location scheme are set for each type of fault. If the fastText classification result indicates that the diagnostic information is a historical fault, the historical library information is retrieved in the knowledge graph according to the pre-defined query template, and the cause and solution are directly given.

[0070] Optionally, if the diagnostic information is a newly-emerged performance error code fault, the software or interface and error description are located according to the error code relationship in the knowledge graph. If the error description contains information related to the second software or interface, the second software or interface error is continuously drilled down until the final error source is determined. If the diagnostic information is a newly-emerged performance field description fault, the location route for this category is to find the associated interface of the business in the knowledge graph, and perform performance anomaly detection on each interface, such as the number of transactions per second (TPS), average transaction response time (ATR), and other indicators. Multi-indicator aggregation analysis is performed to determine the abnormal node. If there is no problem, the link layer is scanned for abnormal detection again, and the link layer is checked again to see if there are any abnormal interfaces.

[0071] Optionally, if the diagnostic information is a new business error code fault, entity linking is performed according to the query template to obtain the query cypher, and the suspicious software or interface is queried in the knowledge graph and sorted according to the relevance. If the diagnostic information is a new business phenomenon description fault, the knowledge graph is queried to obtain the business-related interface, and log anomaly detection is performed according to the business route. Log detection is to compare the error code within the fault time period with the error code in the specified same period to see if there is any anomaly. Based on the characteristics of civil aviation business, there may be some inherent errors, such as lack of authority due to user reasons. Errors due to user-side reasons are normal phenomena, but it is unreasonable to simply count the number of error codes exceeding a fixed threshold. Therefore, a trend prediction is used to perform anomaly detection to see if there is a surge in errors in a short period of time or new errors. Through the above two anomaly detection auxiliary analyses, the scope of the fault can be further narrowed, thereby optimizing decisions and improving positioning accuracy.

[0072] This embodiment follows the located preliminary suspicious interface and a specific troubleshooting plan, and combines indicator anomaly detection, multi-indicator aggregation analysis, log anomaly detection, log aggregation analysis and other means to assist in positioning, continue drilling down, further narrow the interface range, and determine the abnormal interface.

[0073] In some embodiments of the present application, the method further includes: obtaining feedback information of the diagnostic information; and updating the knowledge graph based on the feedback information.

[0074] In this embodiment, after the analysis of the diagnostic information positioning layer is completed, the diagnostic information can be passed to the user interface and interaction layer, and the system will output the fault interface, cause and solution, and sort them by recommendation. The specific analysis mentioned in each answer, such as TPS, response time, etc., are presented to the user in a visual manner. Users can score and correct according to the positioning results, and this feedback information can be used to update the knowledge graph. By continuously enriching the knowledge base with new data, the accuracy of fault identification and positioning can be continuously optimized, thereby improving the performance of the overall system.

[0075] This embodiment uses charts and generated dialogues to show the system health, the abnormal interface finally located, possible causes, and recommended troubleshooting ideas to the user, and the user can click on the corresponding module to view detailed information. Finally, through the user rating model, the new fault is included in the historical fault to supplement the knowledge base, and the knowledge relationship involved in the fault is added to the knowledge graph to continuously enrich the expert experience.

[0076] In an embodiment of the present application, fault information of an information system is obtained, wherein the fault information is used to indicate a fault condition of the information system during operation; the fault information is classified to obtain a fault category to which the fault information belongs; a query template corresponding to the fault category is called to determine a query statement that matches the fault information, wherein the query template is used to indicate a rule for querying the fault information, and the query statement is used to indicate a query instruction generated based on the query template; the query statement is used to query the knowledge graph of the information system to obtain diagnostic information of the information system, wherein the diagnostic information is used to indicate a cause of the fault of the information system, and the knowledge graph includes an association between historical diagnostic information of the information system and knowledge data of the information system, thereby achieving a technical effect of improving the efficiency of determining diagnostic information, and further solving the technical problem of low efficiency in determining diagnostic information.

[0077] In order to facilitate those skilled in the art to better understand the technical solution of the present application, a specific embodiment is now described.

[0078] At present, the Civil Aviation Passenger Service System (PSS) is the core information system in the field of civil aviation in the transportation industry. It serves the national economy and people's livelihood. It is an uninterrupted all-weather operating system that is interconnected with many civil aviation information systems, ensuring the safe travel of more than 600 million passengers each year, with high availability throughout the year. Fluctuations or interruptions in the passenger service system can easily cause mass incidents, causing negative impacts on airlines, airports and even the civil aviation industry. The security level is extremely high, so being able to quickly locate a fault when it occurs is of great significance for timely restoration of system services.

[0079] With the development of independent innovation in civil aviation, the civil aviation passenger service system has developed into a large-scale, diversified, and multi-location distributed complex system that includes mainframes, traditional service-oriented architecture (SOA) and platform as a service (PAAS) cloud platforms.

[0080] In the relevant technologies, the location of system faults in the civil aviation field mainly relies on expert experience and the analysis and judgment of various related data. Especially when dealing with multi-system interaction faults, there is a lack of effective methods to integrate and analyze complex data relationships. Troubleshooting is usually time-consuming and prone to omissions and errors, making it difficult to cope with the growing amount of data and service needs. In this high-speed, massive, complex and heterogeneous large-scale transaction information system, proposing a systematic and intelligent method for rapid fault location has become an inevitable requirement for ensuring system security and is also the key to improving operational efficiency.

[0081] In recent years, with the development of big data technology and the advancement of artificial intelligence, more and more industries have begun to use these advanced technologies to improve service quality and operational efficiency. Among them, knowledge graphs, as an effective way to organize and express information, have also been widely used in the civil aviation field. Knowledge graphs can not only integrate data from various sources, but also provide deeper information analysis capabilities through semantic associations.

[0082] This embodiment constructs a knowledge graph that comprehensively reflects the civil aviation passenger service system architecture, component relationships, operation and maintenance information, and business relationships. Combined with text classification and anomaly detection algorithms, it can quickly find a positioning route when a system failure occurs, locate the problem node from the knowledge graph, determine the cause of the failure and recommend a solution, thereby providing technical support for operation and maintenance personnel to troubleshoot and shorten fault handling time. This method can greatly improve the accuracy and efficiency of fault location, and provide strong support for improving the safety and reliability of the civil aviation passenger service system.

[0083] Figure 2 is a schematic diagram of a rapid fault location system based on a knowledge graph of a civil aviation passenger service system according to an embodiment of the present application, such as Figure 2 As shown, the rapid fault location system based on the knowledge graph of the civil aviation passenger service system may include a knowledge graph construction layer 201, a fault reporting information location layer 202, a decision optimization support layer 203, a user interface and interaction layer 204, and a learning feedback layer 205. Among them, the knowledge graph construction layer 201 includes multimodal entity recognition and multimodal relationship extraction. By collecting various types of knowledge in the civil aviation field, including business manuals, maintenance manuals, etc., the connections between knowledge are sorted out, and the knowledge is constructed in the form of a graph to provide a solid data foundation for the upper layer. The fault reporting information location layer 202 includes text classification and knowledge graph search, which is used to perform text analysis on the received fault reporting information, extract key information, use text classification algorithms to first classify the fault reporting information, and then specifically match the query template to retrieve the association relationship in the knowledge graph to locate suspicious nodes.

[0084] The decision optimization support layer 203 includes performance anomaly detection and log anomaly detection, which are used to refine the suspicious nodes output by the fault information positioning layer, and use the anomaly detection algorithm to detect the interface performance and logs respectively, further narrow the suspicious range, and finally give the fault node and cause after screening and confirmation. The user interface and interaction layer 204 includes fault SMS triggering and conclusion analysis display, which is used to return fault location information, organize and arrange the obtained information, and display the operation status, diagnosis causes, and recommended solutions of related nodes in a visual form to help back-end personnel quickly restore the fault. The learning feedback layer 205 includes knowledge combing and knowledge storage. Users rate and correct the satisfaction of the positioning results given by the system. The system automatically updates the sorted result data to the knowledge graph and classification model, continuously enriches the knowledge base, and provides a solid foundation for subsequent diagnosis and positioning.

[0085] Figure 3 is a schematic diagram of another rapid fault location system based on a knowledge graph of a civil aviation passenger service system according to an embodiment of the present application, such as Figure 3 As shown, first, a knowledge graph is constructed, and entity recognition and relationship extraction are performed on the collected knowledge data at the knowledge graph construction layer. Entity recognition is performed by collecting civil aviation business manuals, error code manuals, interface documents, design documents and other materials, and the relationship between entities is extracted from the data, such as the relationship between software products and error codes, the relationship between software interfaces and businesses, interface call relationships, etc. The relationship between these entities and entities is stored in a graph database to form a knowledge graph.

[0086] Secondly, the fault information is analyzed. At the fault information location layer, semantic analysis and text classification are performed on the received fault information, and multiple fault categories such as historical faults, new performance error code faults, new performance phenomenon description faults, new business error code faults, and new business phenomenon description faults can be obtained. That is, by receiving the fault information, semantic analysis is performed on the fault information, including word segmentation, named entity recognition, semantic parsing, etc., in order to understand the key information in the fault information, such as fault phenomenon, error code, timestamp, etc., and the text classification algorithm fastText is used to divide the faults into two major categories: historical faults and new faults. Then, the new faults are further divided into two major categories: performance faults and business faults. Each category can then be further subdivided into error code faults and phenomenon description faults.

[0087] Further analyze and locate the faults, determine the query templates corresponding to each type of fault, and construct cypher statements in combination with entity links, and search in the knowledge graph database. For historical faults, determine the causes and solutions; for new performance error code faults, preliminarily locate the first error reporting software, interface, and error description; for new performance phenomenon description faults, locate software-related interfaces; for new business error code faults, preliminarily locate suspicious software, interfaces, descriptions, and other information; for new business phenomenon description faults, locate business-related interfaces. That is, set a specific query template for each type of fault, perform entity links on the entities identified in the preprocessing stage, construct cypher statements, search in the knowledge graph, and determine the preliminary positioning results. Depending on the customized route, it can be a preliminary suspicious interface, error description, or a fault cause or solution.

[0088] Further decision support optimization is performed. At the decision optimization support layer, for newly-emerged performance error code failures, determine whether the error description has a second software error report; for newly-emerged performance phenomenon description failures, perform abnormality detection on the interface performance. If the interface performance is abnormal, perform index aggregation analysis, otherwise perform abnormality detection on the link layer; for newly-emerged business error code failures, sort them according to relevance; for newly-emerged business error code failures, perform abnormality detection and log abnormality aggregation analysis on the logs. That is, according to the preliminary suspicious interface located in the previous step, according to a specific troubleshooting plan, combined with index abnormality detection, multi-index aggregation analysis, log abnormality detection, log aggregation analysis and other means to assist in positioning, continue to drill down, further narrow the interface range, and determine the abnormal interface.

[0089] Finally, the system interacts with the user. In the user interface and interaction layer, the system health, the abnormal interface finally located, the possible causes, and the recommended troubleshooting ideas are displayed to the user through charts and generated words. The user can click on the corresponding module to view detailed information (i.e., result arrangement and user visual interaction). In the learning feedback layer, the new faults are included in the historical faults through the user rating model to supplement the knowledge base (i.e., knowledge update), and the knowledge relationships involved in the faults are added to the knowledge graph to continuously enrich the expert experience.

[0090] Figure 4 is a schematic diagram of constructing a knowledge graph database according to an embodiment of the present application, such as Figure 4 As shown in the figure, in order to process the information in text and image slices, a multimodal feature extraction and fusion method is adopted. For text data, the BERT model is used to extract text features and convert text features into text encoding vectors; for image data, the Inception model is used to extract visual features of the image area and convert visual features into visual encoding vectors. In order to better fuse the text encoding vector and the visual encoding vector, a bilinear pooling fusion method is adopted to effectively capture the interactive information between different modal features, and to determine which information should be retained and which should be discarded through a gating mechanism, thereby helping the model to better handle long-term dependency issues. Subsequently, the BiLSTM+CRF framework is used to perform sequence annotation of the text, and finally the multimodal knowledge form is converted into entities and relationships in the knowledge graph and stored in the Neo4j graph database.

[0091] Figure 5 is a schematic diagram of a classifier constructed according to an embodiment of the present application, such as Figure 5As shown, fault information includes historical faults and new faults. New faults include new performance faults and new business faults. New performance faults include new performance error code faults and new performance phenomenon description faults. New business faults include new business error code faults and new business phenomenon description faults. After building the data base, when new fault information is triggered, the fault information is first classified, and the fastText algorithm can be used for text classification. Among them, the fastText algorithm uses a shallow neural network structure for text classification. By adding or averaging all word vectors (including n-gram vectors) in a sentence, a sentence vector is obtained, and then this vector is used for classification. This method is simple and effective, avoiding complex hierarchical structures and reducing the risk of overfitting. FastText has high accuracy and is many orders of magnitude faster than deep networks in training time. Since fault information is usually well-formatted and simple in content, this lightweight algorithm can achieve the effect of pursuing speed. FastText is a supervised classification algorithm. First, a labeled classifier is built. According to the fault characteristics, the faults are classified into historical faults and new faults. On this basis, new faults can be divided into new performance faults or new business faults. For example, problems such as no response and timeout are performance faults, while phenomena such as no passenger information are business faults. Subclasses are set under each type of fault, including error code faults and on-site description faults. For example, 008-04-0321 and other faults are error code faults, and failure to check in and other faults are phenomenon description faults. Classifiers are built in this way.

[0092] Figure 6 is a schematic diagram of a fastText model architecture according to an embodiment of the present application, such as Figure 6 As shown in the figure, the fastText model is used to perform n-gram preprocessing on the input, and the fault information is slid into a window of size n according to the word order, and finally a sequence of word fragments with a window of size n is formed. The n-gram vector (x1, x2, x3, ..., x n ). In the hidden layer (HIDDEN) of the fastText model, the fault information words and n-gram vectors are superimposed and averaged to obtain the fault information vector. The distance between the vectors can be used to measure the semantic similarity between words, and then the fault information vector is used for multi-classification (softmax). Finally, in the output layer (LABEL) of fastText, the fault information is output to different labels of the classifier by predicting labels, thus completing the text classification process.

[0093] For each type of fault, a corresponding query template and positioning scheme are set. If the fastText classification result indicates that the diagnostic information is a historical fault, the historical library information is retrieved in the knowledge graph according to the pre-defined query template, and the cause and solution are directly given.

[0094] If the diagnostic information is a new performance error code fault, the software or interface and error description are located according to the error code relationship in the knowledge graph. If the error description contains information related to the second software or interface, the second software or interface error is continuously drilled down until the final error source is determined. If the diagnostic information is a new performance field description fault, the location route for this category is to find the associated interface of the business in the knowledge graph, and perform performance anomaly detection on each interface, such as the number of transactions per second (TPS), average transaction response time (ATR), and other indicators. Multi-indicator aggregation analysis is performed to determine the abnormal node. If there is no problem, the link layer is scanned for abnormal detection again, and the link layer is checked again to see if there is an abnormal interface.

[0095] If the diagnostic information is a new business error code fault, entity linking is performed according to the query template to obtain the query cypher, and suspicious software or interfaces are queried in the knowledge graph and sorted according to relevance. If the diagnostic information is a new business phenomenon description fault, the knowledge graph is queried to obtain the business-related interface, and log anomaly detection is performed according to the business route. Log detection is to compare the error code in the fault time period with the error code in the specified time period to see if there is any anomaly. Based on the characteristics of civil aviation business, there may be some inherent errors, such as lack of authority due to user reasons. Errors due to user-side reasons are normal phenomena, but it is unreasonable to simply count the number of error codes exceeding a fixed threshold. Therefore, a trend prediction is used to detect anomalies to see if there is a surge in errors in a short period of time or new errors. Through the above two anomaly detection auxiliary analyses, the scope of the fault can be further narrowed, thereby optimizing decisions and improving positioning accuracy.

[0096] After the analysis of the diagnostic information positioning layer is completed, the diagnostic information can be passed to the user interface and interaction layer. The system will output the fault interface, cause and solution, and sort them by recommendation. The specific analysis mentioned in each answer, such as TPS, response time, etc., are presented to the user in a visual way. Users can score and correct according to the positioning results, and this feedback information can be used to update the knowledge graph. By continuously enriching the knowledge base with new data, the accuracy of fault identification and positioning can be continuously optimized, thereby improving the performance of the overall system.

[0097] This embodiment applies knowledge graphs to civil aviation fault location diagnosis for the first time, and uses multimodal data processing technology to construct knowledge graphs, thereby improving the efficiency of knowledge graph construction and knowledge coverage; a text classification algorithm is used to classify fault information according to fault characteristics, and then different query templates are set for each type of fault for matching, and a specific positioning plan is formulated, which can speed up the positioning speed on the one hand, and improve the positioning accuracy by refining the granularity on the other hand; through anomaly detection and graph matching of indicators and logs, the graph positioning results can be optimized to assist decision-making, narrow the positioning range, and enhance the positioning accuracy; a user feedback mechanism is established, and the knowledge base can be updated according to user scores and correction results. This method with manually annotated information can improve the accuracy of information, thereby continuously expanding the relationship network of the knowledge base and optimizing the positioning strategy.

[0098] In an embodiment of the present application, fault information of an information system is obtained, wherein the fault information is used to indicate a fault condition of the information system during operation; the fault information is classified to obtain a fault category to which the fault information belongs; a query template corresponding to the fault category is called to determine a query statement that matches the fault information, wherein the query template is used to indicate a rule for querying the fault information, and the query statement is used to indicate a query instruction generated based on the query template; the query statement is used to query the knowledge graph of the information system to obtain diagnostic information of the information system, wherein the diagnostic information is used to indicate a cause of the fault of the information system, and the knowledge graph includes an association between historical diagnostic information of the information system and knowledge data of the information system, thereby achieving a technical effect of improving the efficiency of determining diagnostic information, and further solving the technical problem of low efficiency in determining diagnostic information.

[0099] The embodiment of the present application also provides a device for determining diagnostic information. It should be noted that the device for determining diagnostic information of this embodiment can be used to execute the method for determining diagnostic information of the embodiment of the present invention.

[0100] Figure 7 is a schematic diagram of a structure of a device for determining diagnostic information according to an embodiment of the present application, such as Figure 7 As shown, the apparatus 700 for determining diagnostic information may include: an acquiring unit 702 , a classifying unit 704 , a determining unit 706 and a querying unit 708 .

[0101] The acquisition unit 702 is used to acquire fault information of the information system, wherein the fault information is used to indicate a fault condition of the information system during operation.

[0102] The classification unit 704 is used to classify the fault information to obtain the fault category to which the fault information belongs.

[0103] The determination unit 706 is used to call the query template corresponding to the fault category and determine the query statement matching the fault information, wherein the query template is used to represent the rule for querying the fault information and the query statement is used to represent the query instruction generated based on the query template.

[0104] The query unit 708 is used to use a query statement to query the knowledge graph of the information system to obtain diagnostic information of the information system, wherein the diagnostic information is used to indicate the cause of the failure of the information system, and the knowledge graph includes the historical diagnostic information of the information system and the association relationship between the knowledge data of the information system.

[0105] Optionally, the device also includes: a first acquisition unit, used to acquire knowledge data, wherein the knowledge data includes text knowledge data and image knowledge data; an extraction unit, used to call a text processing model to extract text features of the text knowledge data, and to call an image processing model to extract visual features of the image knowledge data, wherein the text processing model is trained based on text knowledge data samples, and the image processing model is trained based on image knowledge data samples; a conversion unit, used to convert text features into text encoding vectors, and to convert visual features into visual encoding vectors; and a construction unit, used to construct a knowledge graph based on the text encoding vectors and the visual encoding vectors.

[0106] Optionally, the construction unit includes: a fusion module, used to fuse the text encoding vector and the visual encoding vector to obtain a multimodal encoding vector, wherein the multimodal encoding vector at least includes an interaction encoding vector between the text encoding vector and the visual encoding vector; a labeling module, used to call a sequence labeling model based on the multimodal encoding vector, perform sequence labeling on the text encoding vector, and obtain multiple entities to be constructed of the knowledge graph and entity relationships between the multiple entities; a construction module, used to construct a knowledge graph based on multiple entities and entity relationships, wherein multiple entities are used to represent multiple nodes of the knowledge graph, and entity relationships are used to represent edges of the knowledge graph.

[0107] Optionally, the classification unit 704 includes: an analysis module, which is used to perform semantic analysis on the fault information to obtain a semantic analysis result; and a first classification module, which is used to classify the fault information using the semantic analysis result to obtain a fault category.

[0108] Optionally, the semantic analysis result includes at least entities in the fault information, and the determination unit 706 includes: a linking module, used to perform entity linking on entities in the fault information to obtain entity linking results, wherein the entity linking results are used to indicate that the entities in the fault information are linked to entities in the knowledge graph; and a construction module, used to construct a query statement based on the query template and the entity linking results.

[0109] Optionally, the classification unit 704 includes: a processing module, used to perform a sliding window operation on the fault information to obtain a word fragment sequence; a second classification module, used to convert the word fragment sequence into a word vector, and classify the word vector using a classification model to obtain a fault category.

[0110] Optionally, after using a query statement to query the knowledge graph of the information system and obtaining the diagnostic information of the information system, the device also includes: a first determination unit, used to determine the historical diagnostic information as the diagnostic information in response to the diagnostic information being historical diagnostic information stored in the knowledge graph; a second determination unit, used to determine the initial diagnostic information from the knowledge graph based on the fault category in response to the diagnostic information being historical diagnostic information not stored in the knowledge graph, and analyze the initial diagnostic information in combination with an auxiliary detection method to obtain the diagnostic information, wherein different auxiliary detection methods correspond to different fault categories.

[0111] Optionally, the device also includes: a third determination unit, used to determine, in response to the fault category being a new performance error code fault category, that the auxiliary detection method is to determine the diagnostic information based on the error description information in the initial diagnostic information; a fourth determination unit, used to determine, in response to the fault category being a new performance site description fault category, that the auxiliary detection method is to perform an aggregate analysis on the initial diagnostic information in combination with multiple detection indicators to obtain the diagnostic information; a fifth determination unit, used to determine, in response to the fault category being a new business error code fault category, that the auxiliary detection method is to detect the initial diagnostic information based on the correlation sorting result of the error interface to obtain the diagnostic information; and a sixth determination unit, used to determine, in response to the fault category being a new business phenomenon description fault, that the auxiliary detection method is to perform log anomaly detection on the initial diagnostic information to obtain the diagnostic information.

[0112] Optionally, the device also includes: a second acquisition unit, used to obtain feedback information of diagnostic information; and an updating unit, used to update the knowledge graph based on the feedback information.

[0113] In the device, the fault information of the information system is acquired by the acquisition unit 702, wherein the fault information is used to indicate the fault condition of the information system during operation. The fault information is classified by the classification unit 704 to obtain the fault category to which the fault information belongs. The query template corresponding to the fault category is called by the determination unit 706 to determine the query statement matching the fault information, wherein the query template is used to indicate the rule for querying the fault information, and the query statement is used to indicate the query instruction generated based on the query template. The query unit 708 uses the query statement to query the knowledge graph of the information system to obtain the diagnostic information of the information system, wherein the diagnostic information is used to indicate the cause of the fault of the information system, and the knowledge graph includes the historical diagnostic information of the information system and the association relationship between the knowledge data of the information system, thereby achieving the technical effect of improving the efficiency of determining the diagnostic information, and then solving the technical problem of low efficiency in determining the diagnostic information.

[0114] According to another aspect of an embodiment of the present application, a non-volatile storage medium is further provided, the non-volatile storage medium including a stored program, wherein when the program is running, the device where the non-volatile storage medium is located is controlled to execute any method for determining diagnostic information.

[0115] Specifically, the above storage medium is used to store program instructions for the following functions to implement the following functions:

[0116] Obtain fault information of the information system, wherein the fault information is used to represent the fault condition of the information system during operation; classify the fault information to obtain the fault category to which the fault information belongs; call the query template corresponding to the fault category to determine the query statement that matches the fault information, wherein the query template is used to represent the rule for querying the fault information, and the query statement is used to represent the query instruction generated based on the query template; use the query statement to query in the knowledge graph of the information system to obtain the diagnostic information of the information system, wherein the diagnostic information is used to represent the cause of the fault of the information system, and the knowledge graph includes the historical diagnostic information of the information system and the association relationship between the knowledge data of the information system.

[0117] Optionally, in this embodiment, the above-mentioned storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the above-mentioned contents. More specific examples of the above-mentioned storage medium may include electrical connections based on one or more lines, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), optical fibers, portable compact disk read-only memories (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the above-mentioned contents.

[0118] According to another aspect of an embodiment of the present invention, a processor is further provided. The processor is used to run a program, wherein the method for determining diagnostic information in an embodiment of the present invention is executed when the program is run.

[0119] In an exemplary embodiment of the present application, a computer program product is further provided, including a computer program, and when the computer program is executed by a processor, any of the above-mentioned methods for determining diagnostic information is implemented.

[0120] Optionally, the computer program may implement the following steps when executed by a processor:

[0121] Obtain fault information of the information system, wherein the fault information is used to represent the fault condition of the information system during operation; classify the fault information to obtain the fault category to which the fault information belongs; call the query template corresponding to the fault category to determine the query statement that matches the fault information, wherein the query template is used to represent the rule for querying the fault information, and the query statement is used to represent the query instruction generated based on the query template; use the query statement to query in the knowledge graph of the information system to obtain the diagnostic information of the information system, wherein the diagnostic information is used to represent the cause of the fault of the information system, and the knowledge graph includes the historical diagnostic information of the information system and the association relationship between the knowledge data of the information system.

[0122] In an exemplary embodiment of the present application, a computer program product is also provided, including a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores a computer program, and the computer program is configured to execute any of the above-mentioned diagnostic information determination methods when running.

[0123] Optionally, the computer program may implement the following steps when executed by a processor:

[0124] Obtain fault information of the information system, wherein the fault information is used to represent the fault condition of the information system during operation; classify the fault information to obtain the fault category to which the fault information belongs; call the query template corresponding to the fault category to determine the query statement that matches the fault information, wherein the query template is used to represent the rule for querying the fault information, and the query statement is used to represent the query instruction generated based on the query template; use the query statement to query in the knowledge graph of the information system to obtain the diagnostic information of the information system, wherein the diagnostic information is used to represent the cause of the fault of the information system, and the knowledge graph includes the historical diagnostic information of the information system and the association relationship between the knowledge data of the information system.

[0125] In an exemplary embodiment of the present application, a computer program is further provided. The computer program is configured to execute the steps in any of the above method embodiments when running.

[0126] Optionally, the computer program may implement the following steps when executed by a processor:

[0127] Obtain fault information of the information system, wherein the fault information is used to represent the fault condition of the information system during operation; classify the fault information to obtain the fault category to which the fault information belongs; call the query template corresponding to the fault category to determine the query statement that matches the fault information, wherein the query template is used to represent the rule for querying the fault information, and the query statement is used to represent the query instruction generated based on the query template; use the query statement to query in the knowledge graph of the information system to obtain the diagnostic information of the information system, wherein the diagnostic information is used to represent the cause of the fault of the information system, and the knowledge graph includes the historical diagnostic information of the information system and the association relationship between the knowledge data of the information system.

[0128] According to an embodiment of the present application, an electronic device is provided, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute any one of the above-mentioned methods for determining diagnostic information.

[0129] Optionally, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0130] Figure 8 is a schematic block diagram of an electronic device according to an embodiment of the present application. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present application described and / or required herein.

[0131] like Figure 8 As shown, the device 800 includes a computing unit 801, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 802 or a computer program loaded from a storage unit 808 into a random access memory (RAM) 803. In the RAM 803, various programs and data required for the operation of the device 800 can also be stored. The computing unit 801, the ROM 802, and the RAM 803 are connected to each other via a bus 804. An input / output (I / O) interface 805 is also connected to the bus 804.

[0132] A number of components in the device 800 are connected to the I / O interface 805, including: an input unit 806, such as a keyboard, a mouse, etc.; an output unit 807, such as various types of displays, speakers, etc.; a storage unit 808, such as a disk, an optical disk, etc.; and a communication unit 809, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 809 allows the device 800 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0133] The computing unit 801 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 801 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 801 performs the various methods and processes described above, such as a method for determining diagnostic information. For example, in some embodiments, the method for determining diagnostic information may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit 808. In some embodiments, part or all of the computer program may be loaded and / or installed on the device 800 via ROM 802 and / or communication unit 809. When the computer program is loaded into RAM 803 and executed by the computing unit 801, one or more steps of the method for determining diagnostic information described above may be performed. Alternatively, in other embodiments, the computing unit 801 may be configured to perform a method for determining diagnostic information in any other appropriate manner (e.g., by means of firmware).

[0134] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0135] The program code for implementing the method of the present application can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, implements the functions / operations specified in the flow chart and / or block diagram. The program code can be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0136] In the context of the present application, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0137] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0138] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0139] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship with each other. The server may be a cloud server, a server of a distributed system, or a server combined with a blockchain.

[0140] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0141] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0142] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0143] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0144] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0145] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, in essence, or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk and other media that can store program codes.

[0146] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for determining diagnostic information, characterized in that: include: Acquiring fault information of the information system, wherein the fault information is used to indicate a fault condition of the information system during operation; Classifying the fault information to obtain the fault category to which the fault information belongs; Calling a query template corresponding to the fault category to determine a query statement matching the fault information, wherein the query template is used to represent a rule for querying the fault information, and the query statement is used to represent a query instruction generated based on the query template; The query statement is used to query the knowledge graph of the information system to obtain diagnostic information of the information system, wherein the diagnostic information is used to indicate the cause of the failure of the information system, and the knowledge graph includes the association relationship between the historical diagnostic information of the information system and the knowledge data of the information system.

2. The method according to claim 1, characterized in that The method further comprises: Acquiring the knowledge data, wherein the knowledge data includes text knowledge data and image knowledge data; Calling a text processing model to extract text features of the text knowledge data, and calling an image processing model to extract visual features of the image knowledge data, wherein the text processing model is trained based on text knowledge data samples, and the image processing model is trained based on image knowledge data samples; Converting the text features into text encoding vectors, and converting the visual features into visual encoding vectors; The knowledge graph is constructed based on the text encoding vector and the visual encoding vector.

3. The method according to claim 2, characterized in that Based on the text encoding vector and the visual encoding vector, constructing the knowledge graph includes: The text encoding vector and the visual encoding vector are merged to obtain a multimodal encoding vector, wherein the multimodal encoding vector at least includes an interactive encoding vector between the text encoding vector and the visual encoding vector; Based on the multimodal encoding vector, calling a sequence labeling model, performing sequence labeling on the text encoding vector, and obtaining multiple entities to be constructed in the knowledge graph and entity relationships between the multiple entities; The knowledge graph is constructed based on the multiple entities and the entity relationships, wherein the multiple entities are used to represent multiple nodes of the knowledge graph, and the entity relationships are used to represent edges of the knowledge graph.

4. The method according to claim 1, characterized in that Classifying the fault information to obtain the fault category to which the fault information belongs includes: Performing semantic analysis on the fault information to obtain a semantic analysis result; The fault information is classified using the semantic analysis result to obtain the fault category.

5. The method according to claim 4, characterized in that The semantic analysis result at least includes entities in the fault information, calling a query template corresponding to the fault category, and determining a query statement matching the fault information, including: Performing entity linking on entities in the fault information to obtain entity linking results, wherein the entity linking results are used to indicate that the entities in the fault information are linked to entities in the knowledge graph; The query statement is constructed based on the query template and the entity linking result.

6. The method according to claim 1, characterized in that Classifying the fault information to obtain the fault category to which the fault information belongs includes: Performing a sliding window operation on the fault information to obtain a word fragment sequence; The word fragment sequence is converted into a word vector, and the word vector is classified using a classification model to obtain the fault category.

7. The method according to claim 1, characterized in that After querying the knowledge graph of the information system using the query statement to obtain the diagnostic information of the information system, the method further includes: In response to the diagnostic information being historical diagnostic information stored in the knowledge graph, determining the historical diagnostic information as the diagnostic information; In response to the diagnostic information being historical diagnostic information not stored in the knowledge graph, initial diagnostic information is determined from the knowledge graph based on the fault category, and the initial diagnostic information is analyzed in combination with an auxiliary detection method to obtain the diagnostic information, wherein the auxiliary detection methods corresponding to different fault categories are different.

8. The method according to claim 7, characterized in that The method further comprises: In response to the fault category being a newly generated performance error code fault category, determining the auxiliary detection method to be determining the diagnostic information based on the error description information in the initial diagnostic information; In response to the fault category being a new performance on-site description fault category, determining that the auxiliary detection method is to perform aggregate analysis on the initial diagnostic information in combination with a plurality of detection indicators to obtain the diagnostic information; In response to the fault category being a newly issued service error code fault category, determining that the auxiliary detection method is to detect the initial diagnostic information based on the correlation ranking result of the error interface to obtain the diagnostic information; In response to the fault category being a new business phenomenon description fault, the auxiliary detection method is determined to be performing log anomaly detection on the initial diagnostic information to obtain the diagnostic information.

9. The method according to claim 1, characterized in that: The method further comprises: Obtaining feedback information of the diagnostic information; Based on the feedback information, the knowledge graph is updated.

10. A device for determining diagnostic information, characterized in that: include: An acquisition unit, used for acquiring fault information of the information system, wherein the fault information is used for indicating a fault condition of the information system during operation; A classification unit, used to classify the fault information to obtain the fault category to which the fault information belongs; A determination unit, configured to call a query template corresponding to the fault category and determine a query statement matching the fault information, wherein the query template is used to represent a rule for querying the fault information, and the query statement is used to represent a query instruction generated based on the query template; A query unit is used to use the query statement to query in the knowledge graph of the information system to obtain diagnostic information of the information system, wherein the diagnostic information is used to indicate the cause of the failure of the information system, and the knowledge graph includes the association relationship between the historical diagnostic information of the information system and the knowledge data of the information system.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program is configured to execute the method described in any one of claims 1 to 9 when executed by a processor.

12. An electronic device, characterized in that: The method comprises one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors execute the method according to any one of claims 1 to 9.

13. A computer program product, characterized in that The invention comprises a computer program which, when executed by a processor, implements the method according to any one of claims 1 to 9.

Images