Alarm analysis method and device and alarm analysis agent

Abstract

The invention provides an alarm analysis method and device and an alarm analysis agent, and relates to the technical field of computers, in particular to the fields of artificial intelligence, cloud computing and the like. According to the specific implementation scheme, alarm description information used for describing an alarm analysis task in a natural language is obtained; planning to obtain first alarm analysis steps needing to be executed for executing the alarm analysis task and an alarm analysis sequence of the first alarm analysis steps based on the alarm description information by utilizing an alarm analysis agent; calling a target alarm analysis tool corresponding to each first alarm analysis step by using the alarm analysis agent, and executing each first alarm analysis step according to the alarm analysis sequence to obtain an alarm analysis result of each first alarm analysis step; and summarizing the alarm analysis result of each first alarm analysis step by using the alarm analysis agent to obtain an execution result of the alarm analysis task.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, in particular to the fields of artificial intelligence, cloud computing, and more particularly to an alarm analysis method, device, and alarm analysis intelligent agent. Background Art

[0002] In the CDN scenario, each device will generate a large amount of alarm information during operation. Operation and maintenance personnel are required to promptly identify abnormal devices from the large amount of alarm information and handle them. This process is called alarm analysis. Summary of the invention

[0003] The present invention provides an alarm analysis method, an apparatus and an alarm analysis intelligent agent for improving the accuracy of alarm analysis.

[0004] According to a first aspect of the present disclosure, there is provided an alarm analysis method, comprising:

[0005] Acquire alarm description information for describing alarm analysis tasks in natural language;

[0006] Using an alarm analysis agent, based on the alarm description information, a first alarm analysis step required to execute the alarm analysis task and an alarm analysis sequence of each of the first alarm analysis steps are planned;

[0007] Utilizing the alarm analysis agent, calling the target alarm analysis tool corresponding to each of the first alarm analysis steps to respectively execute each of the first alarm analysis steps in accordance with the alarm analysis sequence, and obtaining the alarm analysis results of each of the first alarm analysis steps, wherein the target alarm analysis tool is a tool among a plurality of preset alarm analysis tools that can execute the corresponding alarm analysis step;

[0008] The alarm analysis agent is used to obtain the execution result of the alarm analysis task based on the alarm analysis result summary of each of the first alarm analysis steps.

[0009] According to a second aspect of the present disclosure, there is provided an agent training method, comprising:

[0010] Obtaining sample description information for describing a sample alarm analysis question in natural language, a second alarm analysis step required to be performed to answer the sample alarm analysis question, an alarm analysis result of each of the second alarm analysis steps, an answer to the sample alarm analysis question, a first sample prompt word, and a second sample prompt word;

[0011] Based on the sample description information, the first sample prompt word and the second alarm analysis step, training a first large language model, wherein the first large language model is used to plan the alarm analysis steps required to answer the sample alarm analysis question under the guidance of the first sample prompt word;

[0012] Based on the alarm analysis results of each of the second alarm analysis steps, the second sample prompt words, and the answers to the sample alarm analysis questions, training a second large language model, wherein the second large language model is used to summarize the alarm analysis results of each of the second alarm analysis steps under the guidance of the second sample prompt words to obtain answers to the sample alarm analysis questions;

[0013] The trained intelligent agent includes the first largest language model and the second largest language model.

[0014] According to a third aspect of the present disclosure, there is provided an alarm analysis device, comprising:

[0015] An information acquisition module, used to acquire alarm description information used to describe the alarm analysis task in natural language;

[0016] A planning module, used to use an alarm analysis agent to plan, based on the alarm description information, the first alarm analysis steps required to execute the alarm analysis task and the alarm analysis sequence of each of the first alarm analysis steps;

[0017] An execution module, used to utilize the alarm analysis agent to call the target alarm analysis tool corresponding to each of the first alarm analysis steps to respectively execute each of the first alarm analysis steps in accordance with the alarm analysis sequence, and obtain the alarm analysis results of each of the first alarm analysis steps, wherein the target alarm analysis tool is a tool among a plurality of preset alarm analysis tools that can execute the corresponding alarm analysis step;

[0018] The result module is used to utilize the alarm analysis agent to obtain the execution result of the alarm analysis task based on the alarm analysis result summary of each of the first alarm analysis steps.

[0019] According to a fourth aspect of the present disclosure, there is provided an intelligent agent training device, comprising:

[0020] A sample acquisition module, used to acquire sample description information for describing a sample alarm analysis question in natural language, a second alarm analysis step required to be performed to answer the sample alarm analysis question, an alarm analysis result of each of the second alarm analysis steps, an answer to the sample alarm analysis question, a first sample prompt word, and a second sample prompt word;

[0021] A first training module is used to train a first large language model based on the sample description information, the first sample prompt word and the second alarm analysis step, wherein the first large language model is used to plan the alarm analysis steps required to answer the sample alarm analysis question under the guidance of the first sample prompt word;

[0022] A second training module is used to train a second large language model based on the alarm analysis results of each of the second alarm analysis steps, the second sample prompt words, and the answers to the sample alarm analysis questions, wherein the second large language model is used to summarize the alarm analysis results of each of the second alarm analysis steps under the guidance of the second sample prompt words to obtain the answers to the sample alarm analysis questions;

[0023] The trained intelligent agent includes the first largest language model and the second largest language model.

[0024] According to a fifth aspect of the present disclosure, there is provided an alarm analysis agent, comprising:

[0025] An input module, used for receiving input information;

[0026] a processing module, configured to determine a target task based on the input information received by the input module, determine a large language model based on the target task, and obtain output information by calling the large language model to execute any one of the methods described in the first aspect above;

[0027] An output module is used to output the output information obtained by the processing module.

[0028] According to a sixth aspect of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable the computer to execute any one of the methods described in the first aspect.

[0029] According to a seventh aspect of the present disclosure, a computer program product is provided, comprising a computer program, wherein when the computer program is executed by a processor, the computer program implements the method according to any one of the above first aspects.

[0030] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] The accompanying drawings are used to better understand the present solution and do not constitute a limitation of the present disclosure.

[0032] Figure 1 It is a flow chart of the alarm analysis method provided by the present disclosure;

[0033] Figure 2a It is a diagram of a user entering descriptive information through a conversational front end;

[0034] Figure 2b It is a schematic diagram of a user inputting description information through a service number;

[0035] Figure 2c It is a schematic diagram of a user inputting description information through an intelligent assistant;

[0036] Figure 2d It is a schematic diagram of the user inputting description information through the alarm interface;

[0037] Figure 3 It is a flow chart of a training method of an alarm analysis agent provided by the present disclosure;

[0038] Figure 4 It is a schematic diagram of an architecture for implementing an alarm analysis method provided by the present disclosure;

[0039] Figure 5 It is a flow chart of the intelligent agent training method provided by the present disclosure;

[0040] Figure 6 It is a structural schematic diagram of the alarm analysis device provided by the present disclosure;

[0041] Figure 7 is a structural schematic diagram of an intelligent agent training device provided by the present disclosure;

[0042] Figure 8 It is a block diagram of an electronic device used to implement the alarm analysis method of the embodiment of the present disclosure. DETAILED DESCRIPTION

[0043] The following is a description of exemplary embodiments of the present disclosure in conjunction with the accompanying drawings, including various details of the embodiments of the present disclosure to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present disclosure. Similarly, for the sake of clarity and conciseness, descriptions of well-known functions and structures are omitted in the following description.

[0044] First, the relevant terms or concepts in the embodiments of the present disclosure are explained:

[0045] AI Agent: It is an intelligent agent system with a large language model as the core controller. Its essence is an agent system that controls the large language model to solve user problems. It relies on the large language model as its core decision-making and processing unit, and can use the logical reasoning ability of the large language model to solve user problems. In practical applications, the agent can be a software or hardware entity that can act autonomously.

[0046] LLM (Large Language Model) refers to a deep learning model trained on massive text data, which has strong expressive and generalization capabilities. It can not only generate natural language text, but also deeply understand the meaning of the text and handle various natural language tasks such as text summarization, question answering, translation, etc.

[0047] It is understandable that in some application scenarios, users want to analyze alarms, such as analyzing the causes of alarms and filtering alarms, and related technologies often require combining their own experience to analyze alarms. Manual alarm analysis requires operation and maintenance personnel to have certain relevant knowledge, which is difficult for new operation and maintenance personnel. They may even have limited relevant knowledge reserves, resulting in inaccurate alarm analysis, such as ignoring some alarms that should not be ignored.

[0048] Based on this, the present application provides an alarm analysis agent, so that the alarm analysis agent can be used to execute alarm analysis tasks and obtain the execution results of the alarm analysis tasks.

[0049] The alarm analysis agent can perform alarm analysis tasks in the following ways: Figure 1 As shown, including:

[0050] Step S101: Acquire alarm description information for describing an alarm analysis task in natural language.

[0051] Step S102, using the alarm analysis agent, based on the alarm description information, plans to obtain the first alarm analysis steps required to execute the alarm analysis task and the alarm analysis sequence of each first alarm analysis step.

[0052] Step S103, using the alarm analysis agent, calling the target alarm analysis tool corresponding to each first alarm analysis step to execute each first alarm analysis step in the alarm analysis order, and obtaining the alarm analysis results of each first alarm analysis step.

[0053] Among them, the target alarm analysis tool is a tool among multiple preset alarm analysis tools that can execute corresponding alarm analysis steps.

[0054] Step S104, using the alarm analysis agent, the execution result of the alarm analysis task is obtained based on the alarm analysis result summary of each first alarm analysis step.

[0055] This embodiment is selected to directly use the pre-trained alarm analysis agent to plan the alarm description information, and then call each alarm analysis tool to execute each first alarm analysis step obtained by the plan, and summarize the alarm analysis results of each first alarm analysis step to obtain the execution result of the alarm analysis task. In the whole process, the operation and maintenance personnel can realize the alarm analysis without manually performing the alarm analysis based on their own experience, which effectively improves the accuracy of the alarm analysis.

[0056] The above steps S101 to S104 will be described below respectively:

[0057] Among them, in step S101, the alarm description information can be input by the operation and maintenance personnel in text form or in voice form. For example, the operation and maintenance personnel can input the text "Is alarm A a false alarm?" or input the voice "Is alarm A a false alarm?"

[0058] When the operation and maintenance personnel input text, the text can be directly used as the problem description information. When the operation and maintenance personnel input voice, the voice can be recognized and the recognized text can be used as the problem description information.

[0059] The execution subjects of the cross-platform operation method provided in this application include but are not limited to mobile phones, desktop computers, tablet computers, smart watches, smart speakers, etc. For mobile phones, desktop computers, platform computers and devices that support text input, the operation and maintenance personnel can input text or voice, while for devices such as smart speakers that do not support text input, the operation and maintenance personnel can only input voice.

[0060] The operation and maintenance personnel may input text or voice by opening a specific page and inputting text or voice on the page. For example, Figure 2a It is also possible to open a specific service number through a specific application and input text or voice in the dialog window with the service number, for example, Figure 2b It is also possible to input text or voice by interacting with a specific group chat robot in the group chat window of the social software, for example, Figure 2c shown.

[0061] It is understandable that although Figure 2a , Figure 2b as well as Figure 2cThe inputs of the operation and maintenance personnel are shown to be text, but this is only for the convenience of showing the problem description information input by the operation and maintenance personnel. The principle is the same for the case of voice input, which will not be repeated here.

[0062] Furthermore, the alarm description information may also be automatically generated based on the alarm selected by the operation and maintenance personnel. For example, Figure 2d The alarm interface shown shows multiple different alarms, each of which has an alarm analysis control (i.e. Figure 2d In response to the operation and maintenance personnel clicking the alarm analysis control, the alarm description information of the corresponding alarm will be automatically generated.

[0063] In step S102, the alarm analysis agent may perform planning based on the pre-learned knowledge on how to perform planning. During planning, the alarm analysis agent may be implemented based on any algorithm model with planning capabilities.

[0064] Exemplarily, in a possible embodiment, step S102 includes:

[0065] Step S1021, using the alarm analysis agent, calling the first large language model, and inputting the alarm description information and the first prompt word into the first large language model, obtaining the first alarm analysis steps output and executed by the first large language model under the guidance of the first prompt word, and the alarm analysis order of each first alarm analysis step.

[0066] The first prompt word is used to guide the first language model to perform step planning. The first prompt word may be pre-set or obtained during training of the first language model.

[0067] This embodiment is selected to utilize a pre-trained alarm analysis agent, and planning is performed based on the alarm description information by combining the trained first language model with the first prompt word. Due to the guidance of the first prompt word, the ability of the first language model to plan steps can be fully utilized, thereby improving the accuracy of the alarm analysis steps obtained by the plan, and further making the subsequent execution results based on the alarm analysis steps more accurate.

[0068] The first prompt word can be set according to the needs of the user. In order to enable the first prompt word to better guide the first language model, the first prompt word can be used to describe the process of planning the alarm analysis steps required to perform the example alarm analysis task and the alarm analysis order of each alarm analysis step based on the example alarm description information, and the example alarm analysis task is the alarm analysis task described by the example alarm description information.

[0069] And / or, the first prompt word is used to guide the first large language model to use the second knowledge base, and the second knowledge base is used to record the impact of the alarm on the business and the historical change information of the device that generates the alarm.

[0070] In step S103, the number and type of preset alarm analysis tools may vary according to different application scenarios. In addition, in a possible embodiment, the target alarm analysis tools corresponding to each first alarm analysis step may be obtained in the following manner:

[0071] The alarm description information, the first prompt word, and the description information of each of the multiple preset alarm analysis tools are input into the first large language model to obtain the first alarm analysis steps required to execute the alarm analysis task and the alarm analysis order of each first alarm analysis step, which are output by the first large language model under the guidance of the first prompt word, as well as the target alarm analysis tools corresponding to each first alarm analysis step, which are output by the first large language model under the guidance of the first prompt word.

[0072] By selecting this embodiment, the alarm analysis intelligent agent can grasp the capabilities of each alarm analysis tool based on the description information of each alarm analysis tool, thereby more accurately calling the alarm analysis tool with corresponding capabilities to execute the first alarm analysis step, thereby improving the accuracy of the alarm analysis results, and further improving the accuracy of subsequent execution results summarized based on the alarm analysis results.

[0073] Correspondingly, in this embodiment, in order to enable the first prompt word to better guide the first large language model to accurately output the target alarm analysis tool corresponding to each first alarm analysis step, the first prompt word can be used to describe the precautions when calling each alarm analysis tool.

[0074] In step S104, the alarm analysis agent may summarize based on the pre-learned knowledge on how to summarize the alarm analysis results of each alarm analysis step. When summarizing, the alarm analysis agent may be implemented based on any algorithm model with summarizing capabilities.

[0075] Exemplarily, in a possible embodiment, step S104 includes:

[0076] Step S1041, using the alarm analysis agent, calls the second largest language model, and inputs the alarm analysis results of each first alarm analysis step and the second prompt word into the second largest language model, to obtain the execution result of the alarm analysis task output by the second largest language model under the guidance of the second prompt word.

[0077] The second prompt word is used to guide the second language model to summarize. The second prompt word can be pre-set or obtained when training the second language model. The summary in this article refers to the process of refining the results of the task to obtain the answer to the question.

[0078] This embodiment is selected to utilize a pre-trained alarm analysis agent and perform summary through the trained second language model combined with the second prompt word. Due to the guidance of the second prompt word, the summarizing ability of the second language model can be fully utilized, thereby improving the accuracy of the execution result obtained by the summary.

[0079] The execution result obtained in step S104 can be used to indicate the cause of the alarm indicated by the alarm analysis task, or the threshold adjustment suggestion of the alarm, or the processing method of the alarm. It is understandable that in some application scenarios, the operation and maintenance personnel are concerned about the cause of the alarm, and in other application scenarios, the operation and maintenance personnel are concerned about how to reasonably set the threshold of the alarm so as not to miss necessary alarms while reducing unnecessary alarms. In some application scenarios, the operation and maintenance personnel manage how to handle the alarms generated, such as whether they should be ignored, what measures should be taken to eliminate the alarms, etc. Therefore, by indicating the cause, threshold adjustment suggestion or processing method through the execution result, the needs of different operation and maintenance personnel can be met in different situations.

[0080] The following will explain how to train the alarm analysis agent. Figure 3 , Figure 3 The figure is a flow chart of the training method of the alarm analysis agent provided by the present application, including:

[0081] Step S301, obtain sample description information used to describe the sample alarm analysis question in natural language, the second alarm analysis steps required to answer the sample alarm analysis question, the alarm analysis results of each second alarm analysis step, the answer to the sample alarm analysis question, the first sample prompt word and the second sample prompt word.

[0082] Step S302: training a first language model based on the sample description information, the first sample prompt word and the second alarm analysis step.

[0083] The first language model is used to plan the alarm analysis steps required to answer the sample alarm analysis question under the guidance of the first sample prompt word.

[0084] Step S303: training a second language model based on the alarm analysis results of each second alarm analysis step, the second sample prompt words, and the answers to the sample alarm analysis questions.

[0085] The second largest language model is used to summarize the alarm analysis results of each second alarm analysis step under the guidance of the second sample prompt word to obtain the answer to the sample alarm analysis question.

[0086] The trained alarm analysis agent includes a first language model and a second language model.

[0087] Among them, in step S302, the sample description information and the first sample prompt word can be used as the input of the first large language model to obtain the output of the first large language model, and the second alarm analysis step can be used as the true value to calculate the loss between the output of the first large language model and the true value, and then the first large language model is adjusted according to the loss.

[0088] In step S303, the alarm analysis results of each second alarm analysis step and the second sample prompt word can be used as the input of the second largest language model to obtain the output of the second largest language model, and the answer to the sample alarm analysis question is used as the true value to calculate the loss between the output of the second largest language model and the true value, and then the second largest language model is adjusted according to the loss.

[0089] By selecting this embodiment, the alarm analysis process of the operation and maintenance personnel can be integrated into the function of the alarm analysis intelligent agent by training the first largest language model and the second largest language model, so that alarm analysis can be performed through the alarm analysis intelligent agent to improve the accuracy of the alarm analysis.

[0090] In the above example, the process of implementing alarm analysis based on the alarm analysis agent is described. In order to more clearly describe the alarm analysis agent provided by the present application, the software architecture for implementing alarm analysis will be described below. For example, see Figure 4 , Figure 4 Shown is the software architecture for implementing the alarm analysis method provided in this application.

[0091] Among them, the service number, super assistant and conversational front end of the user interface layer correspond to the aforementioned Figure 2b , Figure 2a as well as Figure 2c The interface in the example shown.

[0092] The alarm analysis in the intelligent assistant layer is the aforementioned alarm analysis agent.

[0093] The perception, planning, execution and reflection of the alarm analysis layer are the four stages of the alarm analysis agent, among which the perception stage and the planning stage correspond to the aforementioned step S102, the execution stage corresponds to the aforementioned step S103 and step S104, and the reflection stage is used for the alarm analysis agent to optimize itself based on its own output.

[0094] exist Figure 4 In the example shown, the perception phase includes alarm information, business impact (i.e., obtaining business impact from the second knowledge base), historical changes (i.e., obtaining historical changes from the second knowledge base), and model-based analysis. The planning phase includes historical alarms, intelligent filtering, and generating asynchronous tool chains. The execution phase includes parameter acquisition, task execution, and result analysis. The reflection phase includes dynamic thresholds, alarm learning optimization, and intelligent positioning. Among them, the intelligent positioning in the reflection phase can be achieved with the help of the aforementioned intelligent positioning agent.

[0095] based on Figure 4 Based on the framework shown, the alarm analysis agent can achieve the following functions:

[0096] Preliminary analysis: The intelligent agent uses the large model capability to combine the alarm information with known cross-platform data, such as event centers and business management platforms, to make preliminary alarm judgments and plan whether further analysis or positioning is needed.

[0097] Root cause location: With the help of intelligent reasoning and pattern recognition, the intelligent agent can quickly locate the root cause of the alarm, reducing the time and manpower cost of troubleshooting. It mainly uses the rich underlying data sources and tool plug-ins to learn historical data algorithms for different alarms to achieve the location effect.

[0098] Decision guidance: The intelligent agent automatically generates detailed analysis reports and processing suggestions to help operation and maintenance personnel make wise decisions and ensure rapid resolution of problems.

[0099] Intelligent filtering: By learning historical data and alarm patterns, the agent can effectively identify and filter false alarms and redundant alarms, reducing interference from operation and maintenance personnel.

[0100] Information integration and optimization: The intelligent agent integrates multi-source alarm information, removes duplicate and ambiguous data, and performs operations such as alarm merging to provide operation and maintenance personnel with a concise and clear alarm view.

[0101] Intelligent response measures: After identifying a problem, the intelligent agent can automatically execute response measures according to preset strategies, such as adjusting system configuration, restarting services, etc., reducing human intervention.

[0102] Continuous learning and optimization: The intelligent agent continuously optimizes its own analysis and response capabilities and adapts to system changes by constantly learning new alarm patterns and processing results.

[0103] Corresponding to the aforementioned alarm analysis method, the present application also provides an agent training method, such as Figure 5 As shown, including:

[0104] Step S501, obtain sample description information used to describe the sample alarm analysis question in natural language, the second alarm analysis steps required to answer the sample alarm analysis question, the alarm analysis results of each of the second alarm analysis steps, the answer to the sample alarm analysis question, the first sample prompt word and the second sample prompt word.

[0105] Step S502: training a first language model based on the sample description information, the first sample prompt word and the second alarm analysis step.

[0106] The first large language model is used to plan the alarm analysis steps required to answer the sample alarm analysis question under the guidance of the first sample prompt word.

[0107] Step S503: training a second language model based on the alarm analysis results of each of the second alarm analysis steps, the second sample prompt words, and the answers to the sample alarm analysis questions.

[0108] The second largest language model is used to summarize the alarm analysis results of each of the second alarm analysis steps under the guidance of the second sample prompt word to obtain the answer to the sample alarm analysis question.

[0109] The trained intelligent agent includes the first largest language model and the second largest language model.

[0110] Corresponding to the above-mentioned alarm analysis method, the present application also provides an alarm analysis device, such as Figure 6 As shown, including:

[0111] An information acquisition module 601 is used to acquire alarm description information used to describe the alarm analysis task in natural language;

[0112] A planning module 602 is used to use an alarm analysis agent to plan, based on the alarm description information, the first alarm analysis steps required to perform the alarm analysis task and the alarm analysis sequence of each of the first alarm analysis steps;

[0113] An execution module 603 is used to use the alarm analysis agent to call the target alarm analysis tool corresponding to each of the first alarm analysis steps to respectively execute each of the first alarm analysis steps in accordance with the alarm analysis sequence to obtain the alarm analysis results of each of the first alarm analysis steps, wherein the target alarm analysis tool is a tool among a plurality of preset alarm analysis tools that can execute the corresponding alarm analysis step;

[0114] The result module 604 is used to utilize the alarm analysis agent to obtain the execution result of the alarm analysis task based on the alarm analysis result summary of each of the first alarm analysis steps.

[0115] In a possible embodiment, the execution result is used to indicate the cause of the alarm indicated by the alarm analysis task, or a threshold adjustment suggestion for the alarm, or a processing method for the alarm.

[0116] In a possible embodiment, the planning module uses the alarm analysis agent to plan the first alarm analysis steps required to perform the alarm analysis task and the alarm analysis sequence of each of the first alarm analysis steps based on the alarm description information, including:

[0117] Utilizing the alarm analysis agent, the first large language model is called, and the alarm description information and the first prompt word are input into the first large language model to obtain the first alarm analysis steps output and executed by the first large language model under the guidance of the first prompt word, as well as the alarm analysis sequence of each of the first alarm analysis steps.

[0118] In a possible embodiment, the first prompt word is used to describe the process of planning the alarm analysis steps required to execute an example alarm analysis task and the alarm analysis order of each alarm analysis step based on example alarm description information, and the example alarm analysis task is the alarm analysis task described by the example alarm description information; and / or, the fifth prompt word is used to guide the fifth language model to use a second knowledge base, and the second knowledge base is used to record the impact of alarms on business and historical change information of the equipment that generates alarms.

[0119] In a possible embodiment, the planning module inputs the alarm description information and the first prompt word into the first large language model, and obtains the first alarm analysis steps output and executed by the first large language model under the guidance of the first prompt word, and the alarm analysis order of each of the first alarm analysis steps, including:

[0120] The alarm description information, the first prompt word, and the description information of each of the multiple preset alarm analysis tools are input into the first large language model to obtain the first alarm analysis steps required to execute the alarm analysis task and the alarm analysis order of each of the first alarm analysis steps, which are output by the first large language model under the guidance of the first prompt word, as well as the target alarm analysis tools corresponding to each of the first alarm analysis steps, which are output by the first large language model under the guidance of the first prompt word.

[0121] In a possible embodiment, the using the alarm analysis agent to obtain the execution result of the alarm analysis task based on the alarm analysis result summary of each of the first alarm analysis steps includes:

[0122] Utilizing the alarm analysis agent, the second largest language model is called, and the alarm analysis results and the second prompt word of each of the first alarm analysis steps are input into the second largest language model to obtain the execution result of the alarm analysis task output by the second largest language model under the guidance of the second prompt word.

[0123] In a possible embodiment, the training process of the alarm analysis agent includes:

[0124] Obtaining sample description information for describing a sample alarm analysis question in natural language, a second resource analysis step required to answer the sample alarm analysis question, resource analysis results of each of the second resource analysis steps, an answer to the sample alarm analysis question, a first sample prompt word, and a second sample prompt word;

[0125] The training process of the alarm analysis agent based on the sample description information includes:

[0126] Obtaining sample description information for describing a sample alarm analysis question in natural language, a second alarm analysis step required to be performed to answer the sample alarm analysis question, an alarm analysis result of each of the second alarm analysis steps, an answer to the sample alarm analysis question, a first sample prompt word, and a second sample prompt word;

[0127] Based on the sample description information, the first sample prompt word and the second alarm analysis step, training a first large language model, wherein the first large language model is used to plan the alarm analysis steps required to answer the sample alarm analysis question under the guidance of the first sample prompt word;

[0128] Based on the alarm analysis results of each of the second alarm analysis steps, the second sample prompt words, and the answers to the sample alarm analysis questions, training a second large language model, wherein the second large language model is used to summarize the alarm analysis results of each of the second alarm analysis steps under the guidance of the second sample prompt words to obtain answers to the sample alarm analysis questions;

[0129] The trained alarm analysis agent includes the first largest language model and the second largest language model.

[0130] Corresponding to the aforementioned intelligent agent training method, the present application also provides an intelligent agent training device, such as Figure 7 As shown, including:

[0131] The sample acquisition module 701 is used to acquire sample description information for describing a sample alarm analysis question in natural language, a second alarm analysis step required to answer the sample alarm analysis question, an alarm analysis result of each of the second alarm analysis steps, an answer to the sample alarm analysis question, a first sample prompt word, and a second sample prompt word;

[0132] A first training module 702 is used to train a first large language model based on the sample description information, the first sample prompt word and the second alarm analysis step, wherein the first large language model is used to plan the alarm analysis steps required to answer the sample alarm analysis question under the guidance of the first sample prompt word;

[0133] A second training module 703 is used to train a second large language model based on the alarm analysis results of each of the second alarm analysis steps, the second sample prompt words, and the answers to the sample alarm analysis questions, wherein the second large language model is used to summarize the alarm analysis results of each of the second alarm analysis steps under the guidance of the second sample prompt words to obtain the answers to the sample alarm analysis questions;

[0134] The trained intelligent agent includes the first largest language model and the second largest language model.

[0135] The present application also provides an alarm analysis agent, including:

[0136] An input module, used for receiving input information;

[0137] A processing module, configured to determine a target task based on the input information received by the input module, determine a large language model based on the target task, and obtain output information by executing any of the above-mentioned alarm analysis methods by calling the large language model;

[0138] An output module is used to output the output information obtained by the processing module.

[0139] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device, a readable storage medium and a computer program product.

[0140] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device, a readable storage medium and a computer program product.

[0141] Figure 8A schematic block diagram of an example electronic device 800 that can be used to implement an embodiment of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or required herein.

[0142] like Figure 8 As shown, the device 800 includes a computing unit 801, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 802 or a computer program loaded from a storage unit 808 to a random access memory (RAM) 803. In the RAM 803, various programs and data required for the operation of the device 800 can also be stored. The computing unit 801, the ROM 802, and the RAM 803 are connected to each other via a bus 804. An input / output (I / O) interface 805 is also connected to the bus 804.

[0143] A number of components in the device 800 are connected to the I / O interface 805, including: an input unit 806, such as a keyboard, a mouse, etc.; an output unit 807, such as various types of displays, speakers, etc.; a storage unit 808, such as a disk, an optical disk, etc.; and a communication unit 809, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 809 allows the device 800 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0144] The computing unit 801 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 801 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 801 performs the various methods and processes described above, such as an alarm analysis method or an agent training method. For example, in some embodiments, the alarm analysis method or the agent training method may be implemented as a computer software program, which is tangibly included in a machine-readable medium, such as a storage unit 808. In some embodiments, part or all of the computer program may be loaded and / or installed on the device 800 via the ROM 802 and / or the communication unit 809. When the computer program is loaded into the RAM 803 and executed by the computing unit 801, one or more steps of the alarm analysis method or the agent training method described above may be performed. Alternatively, in other embodiments, the computing unit 801 may be configured to execute the alarm analysis method or the agent training method in any other appropriate manner (eg, by means of firmware).

[0145] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0146] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0147] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0148] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0149] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0150] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship with each other. The server may be a cloud server, a server of a distributed system, or a server combined with a blockchain.

[0151] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.

[0152] The above specific implementations do not constitute a limitation on the protection scope of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. An alarm analysis method, comprising: Acquire alarm description information for describing alarm analysis tasks in natural language; Using an alarm analysis agent, based on the alarm description information, a first alarm analysis step required to execute the alarm analysis task and an alarm analysis sequence of each of the first alarm analysis steps are planned; Utilizing the alarm analysis agent, calling the target alarm analysis tool corresponding to each of the first alarm analysis steps to respectively execute each of the first alarm analysis steps in accordance with the alarm analysis sequence, and obtaining the alarm analysis results of each of the first alarm analysis steps, wherein the target alarm analysis tool is a tool among a plurality of preset alarm analysis tools that can execute the corresponding alarm analysis step; The alarm analysis agent is used to obtain the execution result of the alarm analysis task based on the alarm analysis result summary of each of the first alarm analysis steps.

2. The method according to claim 1, wherein: The execution result is used to indicate the cause of the alarm indicated by the alarm analysis task, or the threshold adjustment suggestion for the alarm, or the processing method of the alarm.

3. The method according to claim 1, wherein: The method of using the alarm analysis agent to plan the first alarm analysis steps required to perform the alarm analysis task and the alarm analysis sequence of each of the first alarm analysis steps based on the alarm description information includes: Utilizing the alarm analysis agent, the first large language model is called, and the alarm description information and the first prompt word are input into the first large language model to obtain the first alarm analysis steps output and executed by the first large language model under the guidance of the first prompt word, as well as the alarm analysis sequence of each of the first alarm analysis steps.

4. The method according to claim 3, wherein: The first prompt word is used to describe the process of planning the alarm analysis steps required to execute an example alarm analysis task and the alarm analysis order of each alarm analysis step based on the example alarm description information, and the example alarm analysis task is the alarm analysis task described by the example alarm description information; and / or, the fifth prompt word is used to guide the fifth language model to use a second knowledge base, and the second knowledge base is used to record the impact of alarms on the business and the historical change information of the equipment that generates the alarm.

5. The method according to claim 3, wherein: The step of inputting the alarm description information and the first prompt word into the first large language model to obtain the first alarm analysis steps outputted and executed by the first large language model under the guidance of the first prompt word and the alarm analysis sequence of each of the first alarm analysis steps includes: The alarm description information, the first prompt word, and the description information of each of the multiple preset alarm analysis tools are input into the first large language model to obtain the first alarm analysis steps required to execute the alarm analysis task and the alarm analysis order of each of the first alarm analysis steps, which are output by the first large language model under the guidance of the first prompt word, as well as the target alarm analysis tools corresponding to each of the first alarm analysis steps, which are output by the first large language model under the guidance of the first prompt word.

6. The method according to claim 1, wherein: The using the alarm analysis agent to obtain the execution result of the alarm analysis task based on the alarm analysis result summary of each of the first alarm analysis steps includes: Utilizing the alarm analysis agent, the second largest language model is called, and the alarm analysis results and the second prompt word of each of the first alarm analysis steps are input into the second largest language model to obtain the execution result of the alarm analysis task output by the second largest language model under the guidance of the second prompt word.

7. The method according to any one of claims 1 to 6, wherein: The training process of the alarm analysis agent includes: Obtaining sample description information for describing a sample alarm analysis question in natural language, a second alarm analysis step required to be performed to answer the sample alarm analysis question, an alarm analysis result of each of the second alarm analysis steps, an answer to the sample alarm analysis question, a first sample prompt word, and a second sample prompt word; Based on the sample description information, the first sample prompt word and the second alarm analysis step, training a first large language model, wherein the first large language model is used to plan the alarm analysis steps required to answer the sample alarm analysis question under the guidance of the first sample prompt word; Based on the alarm analysis results of each of the second alarm analysis steps, the second sample prompt words, and the answers to the sample alarm analysis questions, training a second large language model, wherein the second large language model is used to summarize the alarm analysis results of each of the second alarm analysis steps under the guidance of the second sample prompt words to obtain answers to the sample alarm analysis questions; The trained alarm analysis agent includes the first largest language model and the second largest language model.

8. A method for training an intelligent agent, comprising: Obtaining sample description information for describing a sample alarm analysis question in natural language, a second alarm analysis step required to be performed to answer the sample alarm analysis question, an alarm analysis result of each of the second alarm analysis steps, an answer to the sample alarm analysis question, a first sample prompt word, and a second sample prompt word; Based on the sample description information, the first sample prompt word and the second alarm analysis step, training a first large language model, wherein the first large language model is used to plan the alarm analysis steps required to answer the sample alarm analysis question under the guidance of the first sample prompt word; Based on the alarm analysis results of each of the second alarm analysis steps, the second sample prompt words, and the answers to the sample alarm analysis questions, training a second large language model, wherein the second large language model is used to summarize the alarm analysis results of each of the second alarm analysis steps under the guidance of the second sample prompt words to obtain answers to the sample alarm analysis questions; The trained intelligent agent includes the first largest language model and the second largest language model.

9. An alarm analysis device, comprising: An information acquisition module, used to acquire alarm description information used to describe the alarm analysis task in natural language; A planning module, used to use an alarm analysis agent to plan, based on the alarm description information, the first alarm analysis steps required to execute the alarm analysis task and the alarm analysis sequence of each of the first alarm analysis steps; An execution module, used to utilize the alarm analysis agent to call the target alarm analysis tool corresponding to each of the first alarm analysis steps to respectively execute each of the first alarm analysis steps in accordance with the alarm analysis sequence, and obtain the alarm analysis results of each of the first alarm analysis steps, wherein the target alarm analysis tool is a tool among a plurality of preset alarm analysis tools that can execute the corresponding alarm analysis step; The result module is used to utilize the alarm analysis agent to obtain the execution result of the alarm analysis task based on the alarm analysis result summary of each of the first alarm analysis steps.

10. An intelligent agent training device, comprising: A sample acquisition module, used to acquire sample description information for describing a sample alarm analysis question in natural language, a second alarm analysis step required to be performed to answer the sample alarm analysis question, an alarm analysis result of each of the second alarm analysis steps, an answer to the sample alarm analysis question, a first sample prompt word, and a second sample prompt word; A first training module is used to train a first large language model based on the sample description information, the first sample prompt word and the second alarm analysis step, wherein the first large language model is used to plan the alarm analysis steps required to answer the sample alarm analysis question under the guidance of the first sample prompt word; A second training module is used to train a second large language model based on the alarm analysis results of each of the second alarm analysis steps, the second sample prompt words, and the answers to the sample alarm analysis questions, wherein the second large language model is used to summarize the alarm analysis results of each of the second alarm analysis steps under the guidance of the second sample prompt words to obtain the answers to the sample alarm analysis questions; The trained intelligent agent includes the first largest language model and the second largest language model.

11. An alarm analysis agent, comprising: An input module, used for receiving input information; a processing module, configured to determine a target task based on the input information received by the input module, determine a large language model based on the target task, and obtain output information by executing any one of the methods of claims 1 to 7 by calling the large language model; An output module is used to output the output information obtained by the processing module.

12. A non-transitory computer-readable storage medium storing computer instructions, wherein: The computer instructions are used to cause the computer to execute the method according to any one of claims 1-7.

13. A computer program product, comprising a computer program, which, when executed by a processor, implements the method according to any one of claims 1 to 7.

Images