IT work order risk management and control method based on combination of large and small models

Abstract

The invention discloses an IT work order risk management and control method based on combination of large and small models, and belongs to the technical field of IT work order systems. According to the method, the problem that IT work order risks cannot be effectively identified and managed in the prior art is solved, factors such as occurrence probabilities, influence degrees and solutions of different types of problems can be analyzed by adopting a mode of combining large and small models, targeted risk early warning and coping strategies are provided for IT teams, and the risk management efficiency is improved. According to the method and the system, multiple data mining technologies are combined, deep mining and understanding of the work order data are realized, and problems can be found in time and corresponding measures can be taken by monitoring whether the abnormal value in the abnormal value processing process causes that the data quality does not meet the data quality requirement or not in real time, so that the accuracy and reliability of the data are ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of IT work order systems, and in particular to a method for IT work order risk management and control based on a combination of large and small models. Background Art

[0002] An IT work order is a document used to record, track and complete specific work tasks. It is widely used in production, maintenance, service, IT support, project management and other fields. It is a work document, which is the basis for the superior department to issue tasks and the subordinate department to accept tasks. With the continuous acceleration of my country's informatization process, various IT problems are also increasing, which has brought great challenges to the daily work of our IT team. In order to improve work efficiency and reduce the frequency and complexity of work orders, we need to conduct in-depth risk management of work order issues. However, the existing IT team cannot effectively identify and manage IT work order risks, which reduces the efficiency of IT work order problem solving; therefore, it is very important to monitor and optimize the construction process of continuous wall joints; therefore, it does not meet the existing needs. For this, we propose a method for IT work order risk management based on the combination of large and small models. Summary of the invention

[0003] The purpose of the present invention is to provide a method for IT work order risk management based on a combination of large and small models. By adopting a combination of large and small models, it can analyze factors such as the probability of occurrence, impact degree and solution of different types of problems, and provide targeted risk warnings and response strategies for IT teams. It also combines a variety of data mining technologies to achieve in-depth mining and understanding of work order data, thereby solving the problems raised in the above-mentioned background technology.

[0004] To achieve the above-mentioned purpose, the present invention provides the following technical solutions: a method for IT work order risk management based on the combination of large and small models, the method is an IT work order risk management method using the combination of large and small models; The method comprises the following steps: Collect data from the IT work order system and perform preprocessing, including deduplication, missing value processing, and outlier processing; Perform feature extraction on the preprocessed data; The model adopts a combination of large and small models, using the trained large and small models to predict the risk level of new IT work order issues, and generates corresponding response strategies based on the prediction results; At the same time, association rule mining and cluster analysis techniques are used to understand and analyze the data; Monitor problems in the IT work order system in real time, and compare newly generated IT work order problems with existing size models. If new development trends are found, adjust the size model in a timely manner. When performing outlier processing, real-time monitoring is performed to determine whether the outliers in the outlier processing process cause the data quality to fail to meet the data quality requirements.

[0005] Furthermore, all relevant data in the IT work order system is collected from multiple channels, including the internal IT work order system or the external work order platform. At the same time, the collected data is pre-processed, specifically: Deduplication: Check whether there is duplicate data in the data. If there is duplicate data, choose to delete one or more of them; Missing value processing: directly delete the data containing missing values, or use the mean, median and mode method to replace the missing values; Outlier processing: Analyze whether outliers affect subsequent feature extraction, model training, and data analysis. If so, delete the outliers directly; if not, ignore the outliers or mark them.

[0006] Furthermore, real-time monitoring of outliers in the outlier processing process to see if the data quality does not meet the data quality requirements includes: Extracting abnormal values ​​that affect feature value extraction during abnormal value processing as first abnormal data; Extracting abnormal values ​​that have no influence on feature value extraction during abnormal value processing as second abnormal data; Extracting a weight value corresponding to each abnormal value included in the first abnormal data; Extracting a weight value corresponding to each abnormal value included in the second abnormal data; Obtaining an abnormality degree evaluation coefficient according to a weight value corresponding to each abnormal value included in the first abnormal data and a weight value corresponding to each abnormal value included in the second abnormal data; The abnormality evaluation coefficient is obtained by the following formula: ; Where E represents the abnormality evaluation coefficient; n represents the number of first abnormal data; m represents the number of second abnormal data; w 01 represents the weight value corresponding to the i-th first abnormal data; w 02 represents the weight value corresponding to the i-th second abnormal data; w z represents the middle value of the weight corresponding to all data types in the collected data; F represents the reference coefficient, and the reference coefficient is obtained by the following formula: Among them, w 01b represents the standard deviation of the weight values ​​corresponding to the n first abnormal data; w 02b represents the standard deviation of the weight values ​​corresponding to the m second abnormal data; w 01prepresents the average value of the weights corresponding to the n first abnormal data; w 01z represents the middle value of the weight values ​​corresponding to the n first abnormal data; w 02p represents the average weight value corresponding to m second abnormal data; w 02z Indicates the middle value of the weight values ​​corresponding to the m second abnormal data; The abnormality evaluation coefficient is used to determine whether the abnormal values ​​in the collected data cause the data quality to fail to meet the data quality requirements.

[0007] Further, using the abnormality evaluation coefficient to judge whether the abnormal value in the collected data causes the data quality to fail to meet the data quality requirements includes: Extracting the abnormality degree evaluation coefficient; Comparing the abnormality evaluation coefficient with a preset coefficient threshold; When the abnormality evaluation coefficient does not exceed the preset coefficient threshold, the first abnormality evaluation model is used to obtain the abnormality evaluation parameter; The structure of the first abnormality evaluation model is as follows: ; Among them, J 01 represents the first abnormality evaluation model to obtain abnormality evaluation parameters; E represents the abnormality degree evaluation coefficient; E y represents the preset coefficient threshold; w 01p represents the average value of the weights corresponding to the n first abnormal data; w 01z represents the middle value of the weight values ​​corresponding to the n first abnormal data; w 02p represents the average weight value corresponding to m second abnormal data; w 02z represents the middle value of the weight values ​​corresponding to the m second abnormal data; w 01max represents the maximum value of the weight corresponding to the n first abnormal data; w 02max Indicates the maximum value of the weight corresponding to m second abnormal data; When the abnormality evaluation coefficient exceeds a preset coefficient threshold, an abnormality evaluation parameter is obtained using a second abnormality evaluation model; The structure of the second abnormality evaluation model is as follows: ; Among them, J 02 represents the abnormal evaluation parameter obtained by the second abnormal evaluation model; E represents the abnormal degree evaluation coefficient; E y represents the preset coefficient threshold; w 01p represents the average value of the weights corresponding to the n first abnormal data; w 01zrepresents the middle value of the weight values ​​corresponding to the n first abnormal data; w 02p represents the average weight value corresponding to m second abnormal data; w 02z represents the middle value of the weight values ​​corresponding to the m second abnormal data; w 01min represents the minimum weight value corresponding to the n first abnormal data; w 02min Indicates the minimum weight value corresponding to m second abnormal data; Comparing the abnormal evaluation parameter with a preset evaluation parameter threshold; When the abnormal evaluation parameter exceeds a preset evaluation parameter threshold, it is determined that the abnormal value in the collected data causes the data quality to fail to meet the data quality requirements.

[0008] Furthermore, feature extraction is performed on the preprocessed data, including the category, probability of occurrence, impact and solution of the problem. The extracted features are used to represent the characteristics of different types of problems, specifically: Question type features: used to distinguish different types of questions; Occurrence probability feature: used to predict the possibility of occurrence of new IT work order issues; Impact characteristics: directly used to determine the impact of the problem; Solution characteristics: Each problem has a corresponding solution. The solution to each problem is obtained from the IT work order system and the solution is encoded.

[0009] Furthermore, the risk level prediction is performed by combining the large and small models, which specifically includes the following steps: Data partitioning: Determine the ratio of training set and test set, and divide the training set and test set according to the ratio. The training set is used to train large and small models, while the test set is used to evaluate the performance of the model. Large and small model training: Select machine learning algorithms, including decision tree, random forest, and SVM, and train large and small models on the training set; Hyperparameter tuning: During training, multiple rounds of iterative optimization are performed on the training set using cross-validation techniques for different hyperparameter combinations to obtain the best model performance. Large and small model evaluation: For the models in the training set, they will be evaluated on the test set. If the basic training effect is not good, the structure or parameters of the model will be adjusted and trained again. Introduction of deep learning model: If the evaluation results on the test set show that the training effect of the large and small models is not good, the deep learning model is introduced into the large and small models for enhanced training; Model fusion: The output results of the large and small models are combined with the prediction results of the deep learning model to obtain the final prediction results. Model fusion uses the following methods: Average method: average the prediction results of the large and small models and the deep learning model to obtain the final prediction result; Adversarial learning method: The large and small models and the deep learning model are trained adversarially so that the prediction results of the two constrain each other and obtain the final prediction result; Prediction of new work order issues and generation of response strategies: Use a new model that combines deep learning and large and small models to predict the risk level of new IT work order issues and generate corresponding response strategies based on the predicted results.

[0010] Furthermore, the deep learning model is introduced, and the specific process is as follows: Design deep learning models, including recurrent neural network models, based on the nature of the task and the characteristics of the data; Combine and fine-tune the large and small models with the deep learning model, and balance the performance of the large and small models with the deep learning model through cross-validation techniques; During the fine-tuning process, the weights of the deep learning model are updated through the direction propagation algorithm, so that the model gradually converges to the optimal solution.

[0011] Furthermore, association rule mining and cluster analysis techniques are used to understand and analyze the data, specifically: Association rule mining: Through association rule mining, we can understand the problems and potential patterns in the IT work order system and provide support for risk warning and response strategy generation; Cluster analysis: Through cluster analysis, common problems and behavior patterns in the IT work order system are discovered, providing reference for risk warning and response strategy generation.

[0012] Furthermore, the association rule mining and cluster analysis techniques include the following steps respectively: Association rule mining: defining the data structure and event sequence of association rules; Select association rule mining algorithms, including Apriori and FP-growth; According to the input settings of the association rule mining algorithm, all association rules are calculated; Filter out the most relevant association rules based on rule confidence and support thresholds; Evaluate and optimize the selected association rules, including support and credibility; Cluster analysis: select clustering algorithms, including K-means, hierarchical clustering, and density clustering; Perform cluster analysis on the data according to the input settings of the clustering algorithm; Analyze clustering results, including cluster distribution, internal consistency, and variable importance; Based on the analysis results, put forward corresponding coping strategies or suggestions.

[0013] Furthermore, real-time monitoring of issues in the IT ticket system, specifically: When monitoring detects a new problem, the detected new problem is compared with the existing problems; If there is not much difference between the new problem and the existing problem, directly put the new problem into the existing model for prediction; If the new problem is significantly different from the existing problem, handle the new problem separately, including rebuilding the model or changing the model.

[0014] Compared with the prior art, the present invention has the following beneficial effects: 1. The present invention adopts a combination of large and small models, introduces a deep learning model into the large and small models for intensive training, and then combines the large and small models with the deep learning model, which can improve the overall performance of the prediction model, thereby being able to predict the risk level of new IT work order problems, thereby providing the IT team with targeted risk warnings and response strategies. After the large and small models are established, association rule mining and cluster analysis techniques can be used to have a deeper understanding and analysis of the data, thereby achieving in-depth mining and understanding of the work order data.

[0015] 2. The present invention monitors in real time whether the outliers in the outlier processing process cause the data quality to fail to meet the data quality requirements, which helps to discover problems in a timely manner and take corresponding measures to ensure the accuracy and reliability of the data, thereby significantly improving the efficiency and accuracy of data processing, thereby reducing the impact of human errors and subjective judgments, and making the data processing process more objective and reliable. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 This is a flow chart of the method for IT work order risk management based on the combination of large and small models of the present invention. DETAILED DESCRIPTION

[0017] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0018] In order to solve the technical problem that the existing technology cannot effectively identify and manage IT work order risks, thereby reducing the efficiency of IT work order problem solving, please refer to Figure 1, this embodiment provides the following technical solutions: A method for IT work order risk management based on a combination of large and small models, the method is an IT work order risk management method using a combination of large and small models; The method comprises the following steps: Collect data from the IT work order system and perform preprocessing, including deduplication, missing value processing, and outlier processing; Perform feature extraction on the preprocessed data; The model adopts a combination of large and small models, using the trained large and small models to predict the risk level of new IT work order issues, and generates corresponding response strategies based on the prediction results; At the same time, association rule mining and cluster analysis techniques are used to understand and analyze the data; Monitor problems in the IT work order system in real time, and compare newly generated IT work order problems with existing size models. If new development trends are found, adjust the size model in a timely manner. When performing outlier processing, real-time monitoring is performed to determine whether the outliers in the outlier processing process cause the data quality to fail to meet the data quality requirements.

[0019] The technical effect of the above content is: by collecting all relevant data in the IT work order system and preprocessing the collected data, in the data preprocessing stage, the quality and availability of the data are ensured through deduplication, missing value processing and outlier processing, so as to facilitate subsequent feature extraction and model training, feature extraction is performed on the preprocessed data, and a series of features related to IT work order problems can be obtained through feature extraction for model learning and understanding, and the processed data and features are input into the selected large and small models by combining large and small models for model training. At the same time, the deep learning model is introduced into the large and small models for intensive training, and the large and small models and the deep learning model are combined. By combining large and small models, the It makes up for the shortcomings of a single model and improves the reliability and accuracy of the prediction results, so that the risk level of new IT work order problems can be predicted, so as to provide targeted risk warnings and response strategies for the IT team, and provide a clear action guide for IT operation and maintenance personnel to reduce the uncertainty of human decision-making. After the establishment of large and small models, the use of association rule mining and clustering analysis technology can provide a deeper understanding and analysis of the data, which can help the operation and maintenance team better understand the data, and further provide strong support for the generation of risk assessment, warning and response strategies. Finally, by real-time monitoring of problems in the IT work order system, dynamic model adjustments can be achieved, so that the model can adapt to the ever-changing business environment, greatly improving the flexibility and adaptability of risk management.

[0020] Collect all relevant data from IT work order systems from multiple channels, including internal IT work order systems or external work order platforms. At the same time, pre-process the collected data, specifically: Deduplication: Check whether there is duplicate data in the data. If there is duplicate data, choose to delete one or more of them to avoid inaccurate and inconsistent results; Missing value processing: Missing values ​​refer to the fact that the values ​​of some data in the data are not recorded. The missing values ​​can be replaced by directly deleting the data containing missing values ​​or using methods such as mean, median and mode; Outlier processing: Outliers refer to values ​​that deviate significantly from other values ​​in the data. When processing outliers, it is necessary to consider whether the outliers will affect subsequent feature extraction, model training, and data analysis. If so, measures should be taken to eliminate them, such as directly deleting the outliers. If not, the outliers can be ignored or marked so that these anomalies can be noted in subsequent analysis.

[0021] The technical effect of the above content is: by collecting data from multiple channels such as the internal IT work order system or the external work order platform, after collecting all relevant data in the IT work order system, these data need to be preprocessed to facilitate subsequent feature extraction and model training. The purpose of preprocessing is to remove invalid information and outliers so that the data meets the input requirements of the model.

[0022] By removing duplicate data, redundant information in the data can be reduced, ensuring that each data is unique, thereby improving the quality and accuracy of the data. At the same time, reducing duplicate data can reduce the complexity of the model and improve the training speed and prediction efficiency of the model.

[0023] By processing missing values, we can ensure the integrity of the data and avoid analytical bias caused by missing values. At the same time, processing missing values ​​can make data analysis results more accurate and reduce statistical bias caused by missing values.

[0024] By processing outliers, the overall quality of the data can be improved, ensuring that the analysis results are more realistic and credible. At the same time, outlier processing can also improve the stability of the model, reduce the risk of overfitting of the model, and enable the model to perform better on new IT work order issues.

[0025] Real-time monitoring of outliers in the outlier processing process to see if the data quality does not meet the data quality requirements, including: Extracting abnormal values ​​that affect feature value extraction during abnormal value processing as first abnormal data; Extracting abnormal values ​​that have no influence on feature value extraction during abnormal value processing as second abnormal data; Extracting a weight value corresponding to each abnormal value included in the first abnormal data; Extracting a weight value corresponding to each abnormal value included in the second abnormal data; Obtaining an abnormality degree evaluation coefficient according to a weight value corresponding to each abnormal value included in the first abnormal data and a weight value corresponding to each abnormal value included in the second abnormal data; The abnormality evaluation coefficient is obtained by the following formula: ; Where E represents the abnormality evaluation coefficient; n represents the number of first abnormal data; m represents the number of second abnormal data; w 01 represents the weight value corresponding to the i-th first abnormal data; w 02 represents the weight value corresponding to the i-th second abnormal data; w z represents the middle value of the weight corresponding to all data types in the collected data; F represents the reference coefficient, and the reference coefficient is obtained by the following formula: Among them, w 01b represents the standard deviation of the weight values ​​corresponding to the n first abnormal data; w 02b represents the standard deviation of the weight values ​​corresponding to the m second abnormal data; w 01p represents the average value of the weights corresponding to the n first abnormal data; w 01z represents the middle value of the weight values ​​corresponding to the n first abnormal data; w 02p represents the average weight value corresponding to m second abnormal data; w 02z Indicates the middle value of the weight values ​​corresponding to the m second abnormal data; The abnormality evaluation coefficient is used to determine whether the abnormal values ​​in the collected data cause the data quality to fail to meet the data quality requirements.

[0026] The technical effect of the above technical solution is: by subdividing the outliers into those that have an impact on the feature value extraction (first abnormal data) and those that have no impact (second abnormal data), the technical solution can more accurately identify and analyze the nature and degree of impact of the outliers. This classification is helpful for subsequent data processing decisions, such as whether it is necessary to correct or eliminate certain outliers. The weight value corresponding to each outlier is extracted, so that the evaluation of the outlier is no longer based solely on its numerical value, but takes into account its importance and impact in the entire data set. This helps to more accurately reflect the actual impact of outliers on data quality. The abnormality evaluation coefficient (E) is calculated by the above formula, which comprehensively considers the number of the first abnormal data and the second abnormal data, the weight value, and the statistical characteristics of the weight value (such as standard deviation, mean value and median value). This comprehensive evaluation method can more comprehensively reflect the overall impact of outliers on data quality. Using the abnormality evaluation coefficient as a basis for judgment, it is possible to more objectively evaluate whether the outliers in the collected data cause the data quality to fail to meet the data quality requirements. This helps to promptly discover problems and take corresponding measures to ensure the accuracy and reliability of the data. Through automated outlier processing and accurate outlier evaluation, this technical solution can significantly improve the efficiency and accuracy of data processing. This helps reduce the impact of human errors and subjective judgments, making the data processing process more objective and reliable.

[0027] Specifically, This part calculates the corresponding value of the first type of abnormal data, reflecting the overall impact of the first type of abnormal data. 01i Normalize to the overall weight for easy comparison. Through normalization, this part can effectively identify abnormal data with relatively high weight, making the judgment of the degree of abnormality more accurate and improving the sensitivity of anomaly detection. This part calculates the corresponding values ​​of the second type of abnormal data, and provides the degree of influence for comparing the first type of abnormal data. This separate processing method makes the evaluation of different types of abnormal data more detailed. At the same time, the dual abnormal monitoring mechanism is adopted, so that the formula can consider the influence of multiple types of abnormalities when evaluating the degree of abnormality, and enhances the adaptability to complex situations. At the same time, the above formula comprehensively considers the influence of two types of abnormal data as a whole, and can more comprehensively evaluate the degree of abnormality. This part ensures that the evaluation coefficient will not become negative due to the influence of abnormal data by adding 1, ensuring the interpretability of the results. At the same time, by comprehensively processing the influence of the two types of data, the formula has nonlinear feedback characteristics, which improves the system's sensitive response to abnormal events; at the same time, the reference coefficient F is used to adjust the final abnormality evaluation coefficient, so that it can adapt to different application scenarios or system requirements. The introduction of the reference coefficient enhances the flexibility and adaptability of the formula, so that the evaluation can be applied to different fields and contexts, providing users with personalized abnormality evaluation.

[0028] on the other hand, This part calculates the standard deviation w of the first type of abnormal data weights 01b Relative to its average value w 01p and the intermediate value w 01z By using the exponential function, small changes can be amplified and the sensitivity of the evaluation can be improved. The exponential function is used to quantify the relationship between the standard deviation and the average and median value, which enhances the sensitivity to the fluctuation of data distribution and enables the benchmark coefficient to reflect the fluctuation characteristics of the data. At the same time, the square root processing is used to make the final result of this part have a certain smoothness to avoid the influence of extreme values ​​on the final evaluation. The combined design of the exponential function and the square root improves the stability and rationality of the results, so that the benchmark coefficient can effectively adapt to various data environments. This section is similar to the first section, but for the second type of abnormal data, the relationship between the weighted standard deviation and the mean and median is evaluated. This section ensures that the model can fully consider the impact of different types of abnormal data. By independently evaluating the standard deviations of the two types of abnormal data, the model is more detailed and adaptable, allowing reasonable comparison and analysis under different abnormal conditions. Similarly, the square root processing makes the final result of this section smoother to avoid the influence of extreme values ​​on the final evaluation. The combined design of the exponential function and the square root improves the stability and rationality of the results, so that the benchmark coefficient can effectively adapt to various data environments.

[0029] The introduction of the above-mentioned benchmark coefficient F into the calculation of the abnormality evaluation coefficient E makes the abnormality evaluation coefficient E more accurate and reliable. By comprehensively considering the standard deviation, mean value and median value of the abnormal data, F can dynamically adjust the calculation of E to adapt to the distribution characteristics of the data and improve the accuracy of anomaly detection. Combining the design of the benchmark coefficient F and the abnormality evaluation coefficient E, a dual evaluation mechanism is formed. Such a mechanism not only considers the absolute impact of abnormal data, but also its relative volatility, so that the entire anomaly detection system can provide more stable and reliable judgment results when facing complex and changeable data.

[0030] In summary, this technical solution achieves effective processing of outliers and accurate assessment of data quality by refining outlier classification, introducing weight values, calculating outlier evaluation coefficients, and the basis for data quality judgment. This helps to improve the efficiency and accuracy of data processing and provide more reliable support for data analysis and decision-making.

[0031] Using the abnormality evaluation coefficient to judge whether the abnormal value in the collected data causes the data quality to fail to meet the data quality requirements includes: Extracting the abnormality degree evaluation coefficient; Comparing the abnormality evaluation coefficient with a preset coefficient threshold; When the abnormality evaluation coefficient does not exceed the preset coefficient threshold, the first abnormality evaluation model is used to obtain the abnormality evaluation parameter; The structure of the first abnormality evaluation model is as follows: ; Among them, J 01 represents the first abnormality evaluation model to obtain abnormality evaluation parameters; E represents the abnormality degree evaluation coefficient; E y represents the preset coefficient threshold; w 01p represents the average value of the weights corresponding to the n first abnormal data; w 01z represents the middle value of the weight values ​​corresponding to the n first abnormal data; w 02p represents the average weight value corresponding to m second abnormal data; w 02z represents the middle value of the weight values ​​corresponding to the m second abnormal data; w 01max represents the maximum value of the weight corresponding to the n first abnormal data; w 02max Indicates the maximum value of the weight corresponding to m second abnormal data; When the abnormality evaluation coefficient exceeds a preset coefficient threshold, an abnormality evaluation parameter is obtained using a second abnormality evaluation model; The structure of the second abnormality evaluation model is as follows: ; Among them, J 02 represents the abnormal evaluation parameter obtained by the second abnormal evaluation model; E represents the abnormal degree evaluation coefficient; E y represents the preset coefficient threshold; w 01p represents the average value of the weights corresponding to the n first abnormal data; w 01z represents the middle value of the weight values ​​corresponding to the n first abnormal data; w 02p represents the average weight value corresponding to m second abnormal data; w 02z represents the middle value of the weight values ​​corresponding to the m second abnormal data; w 01min represents the minimum weight value corresponding to the n first abnormal data; w 02min Indicates the minimum weight value corresponding to m second abnormal data; Comparing the abnormal evaluation parameter with a preset evaluation parameter threshold; When the abnormal evaluation parameter exceeds a preset evaluation parameter threshold, it is determined that the abnormal value in the collected data causes the data quality to fail to meet the data quality requirements.

[0032] The technical effect of the above technical solution is: by comparing the abnormality evaluation coefficient with the preset coefficient threshold, the technical solution can flexibly deal with abnormal values ​​of different degrees. When the abnormality is relatively light (that is, the abnormality evaluation coefficient does not exceed the threshold), the first abnormality evaluation model is adopted; and when the abnormality is relatively heavy (that is, the abnormality evaluation coefficient exceeds the threshold), the second abnormality evaluation model is adopted. This hierarchical processing method makes the processing of abnormal values ​​more accurate and efficient. Both the first abnormality evaluation model and the second abnormality evaluation model comprehensively consider multiple factors, including the abnormality evaluation coefficient, the weighted numerical average value, the middle value, the maximum value and the minimum value of various abnormal data. This comprehensive evaluation method can more comprehensively reflect the actual impact of abnormal values ​​on data quality, thereby avoiding the one-sidedness of single indicator evaluation. By introducing the preset coefficient threshold and the evaluation parameter threshold, the technical solution can objectively judge whether the abnormal values ​​in the collected data cause the data quality to fail to meet the data quality requirements. This judgment method reduces the influence of human intervention and subjective judgment, and improves the accuracy and reliability of data quality judgment. Different abnormality evaluation models are selected according to the size of the abnormality evaluation coefficient, and the abnormality evaluation parameters are obtained accordingly, so that the processing of abnormal values ​​is more targeted. This helps to quickly locate and process outliers that have a significant impact on data quality, thereby restoring data quality in a timely manner. Through automated outlier processing and precise outlier evaluation models, this technical solution can significantly improve the efficiency and accuracy of data processing. This helps to reduce errors and omissions in the data processing process and improve the quality and efficiency of data processing.

[0033] In summary, this technical solution achieves effective processing of outliers and accurate assessment of data quality by flexibly responding to different degrees of anomalies, comprehensively evaluating the impact of outliers, improving the objectivity of data quality judgment, enhancing the pertinence of outlier processing, and improving data processing efficiency and accuracy. This helps ensure the accuracy and reliability of data and provides more reliable support for data analysis and decision-making.

[0034] Furthermore, feature extraction is performed on the preprocessed data, including the category, probability of occurrence, impact and solution of the problem. The extracted features are used to represent the characteristics of different types of problems, specifically: Question type characteristics: can be used to distinguish different types of questions; Occurrence probability feature: reflects the possibility of a problem occurring and can be used to predict the possibility of new IT work order problems occurring; Impact characteristics: directly related to the severity and economic nature of the problem, and can be used to determine the impact of the problem; Solution characteristics: Each problem has a corresponding solution. The solution to each problem can be obtained from the IT work order system and the solution can be coded.

[0035] The technical effect of the above content is: feature extraction can be used for model training and prediction. Feature extraction can consider factors such as problem type, probability of occurrence, degree of impact and solution as features. Through the above feature extraction, a series of features related to IT work order problems can be obtained. These features help to more accurately understand and classify work order problems for model learning and understanding.

[0036] The risk level prediction is performed by combining large and small models, which includes the following steps: Data partitioning: Determine the ratio of training set and test set, generally 70% training set and 30% test set, to ensure that there are enough samples for training the large and small models, and to check whether the large and small models have good generalization ability when testing the large and small models; Divide the preprocessed data set into training set and test set according to the proportion, where the training set is used to train large and small models, and the test set is used to evaluate the performance of the model; In order to avoid bias in the division process, the data of the training set and the test set can be divided by random sampling to ensure that the model can generalize well to unseen data; To ensure the comparability of subsequent experiments, it is necessary to record and save the detailed information of each division, including the division ratio and division method, for subsequent comparison and analysis; Large and small model training: Select appropriate machine learning algorithms (such as decision trees, random forests, and support vector machines), and perform large and small model training on the training set. The goal of these algorithms is to establish a relatively accurate prediction model to preliminarily determine the risk level of IT work order issues. Hyperparameter tuning: When using machine learning algorithms to train large and small models, multiple rounds of iterative optimization are performed on the training set using cross-validation techniques for different hyperparameter combinations to obtain the best model performance. The specific process is as follows: Select an appropriate set of hyperparameters based on the type of model and problem characteristics. This set of hyperparameters may be determined empirically. Use the selected hyperparameter combination as the initial setting, train the large and small models, and record the performance of each training; Under each hyperparameter combination, record the model's performance indicators, such as accuracy, precision, recall, etc. To ensure the generalization ability of large and small models, multiple cross-validations were performed on the training set to calculate the average loss under each hyperparameter combination; Based on the cross-validation loss, the optimal hyperparameter combination that is minimized is selected and applied to large and small model training to obtain the best model performance; Large and small model evaluation: For the models in the training set, they will be evaluated on the test set. If the basic training effect is not good, it is necessary to adjust the structure or parameters of the model and then train it again. The specific process is as follows: Use the trained size model to predict the data of the test set to obtain the prediction results; Compare the prediction results with the true labels and calculate evaluation indicators such as precision, recall, F1 score, etc. Based on the results of the evaluation indicators, analyze the performance of the large and small models on the test set and find out the existing problems, such as overfitting, underfitting, and overfitting of the large and small models; Adjust the structure or parameters of the size model based on the analysis results of the evaluation indicators; The resized model is trained and then tested on the test set. The resized model is further resized based on the evaluation results. The best model results and parameters are found through multiple iterations. Introduction of deep learning model: If the evaluation results on the test set show that the training effect of the large and small models is not good, then it is necessary to introduce a deep learning model. The deep learning model has powerful nonlinear modeling and adaptive learning capabilities, and is suitable for processing complex and nonlinear relationships. The deep learning model can be introduced into the large and small models for intensive training. The specific process is as follows: Design appropriate deep learning models, such as recurrent neural network models, based on the nature of the task and the characteristics of the data; Combine the large and small models with the deep learning model, perform fine-tuning, and balance the performance of the two models using cross-validation techniques; During the fine-tuning process, the weights of the deep learning model can be updated through the directional propagation algorithm, so that the model gradually converges to the optimal solution; Model fusion: Combining large and small models with deep learning models can improve the overall performance of the prediction model. The specific approach is to fuse the output results of the large and small models with the prediction results of the deep learning model to obtain the final prediction results. Among them, model fusion adopts the following methods: Average method: average the prediction results of the large and small models and the deep learning model to obtain the final prediction result; Adversarial learning method: The large and small models and the deep learning model are trained adversarially so that the prediction results of the two constrain each other to obtain the final prediction result; Prediction of new work order issues and generation of response strategies: Using a new model that combines deep learning and large and small models, the risk level of new IT work order issues can be predicted. The prediction results will be used to generate corresponding response strategies to help IT service teams solve problems more effectively.

[0037] The technical effect of the above content is: through a series of steps such as data partitioning, random sampling, cross-validation and hyperparameter tuning, it is ensured that the model has good generalization ability on unseen data. Through the combination of large and small models and the introduction of deep learning models, the advantages of different models are fully utilized, thereby significantly improving the accuracy of IT work order risk level prediction. Small models (such as traditional machine learning models) are more efficient when dealing with simple problems, while large models (such as deep learning models) can capture more complex features and nonlinear relationships. This combination can effectively make up for the shortcomings of a single model and make the prediction results more reliable. By dynamically adjusting the model structure and introducing deep learning models, it can quickly adapt to the dynamic changes of the IT work order system. The model can predict the risk level of new IT work order problems, thereby providing the IT team with targeted risk warnings and response strategies, thereby improving the efficiency and response speed of IT operation and maintenance and avoiding the expansion of problems.

[0038] Use association rule mining and cluster analysis techniques to understand and analyze data, specifically: Association rule mining: Through association rule mining, we can understand the problems and potential patterns in the IT work order system and provide support for risk warning and response strategy generation. The specific steps include: Define the data structure and event sequence of association rules; Select appropriate association rule mining algorithms, such as Apriori, FP-growth, etc.; Calculate all possible association rules according to the input settings of the algorithm; Filter out the most relevant association rules based on rule confidence and support thresholds; Evaluate and optimize the selected association rules, such as support, credibility, etc.; Cluster analysis: Through cluster analysis, common problems and behavior patterns in the IT work order system are discovered, providing reference for risk warning and response strategy generation. The specific steps include: Choose a suitable clustering algorithm, such as K-means, hierarchical clustering, density clustering, etc. Perform cluster analysis on the data according to the input settings of the algorithm; Analyze clustering results, such as cluster distribution, internal consistency, and variable importance; Based on the analysis results, put forward corresponding coping strategies or suggestions.

[0039] The technical effects of the above content are as follows: Association rule mining is a method of mining frequent item sets, which can be used to discover frequent patterns in data sets. For example, association rule mining can be used to find common failure modes in IT work order systems. Cluster analysis is an unsupervised learning method that can divide data into multiple different clusters, each cluster representing a class of data points with similar attributes. By combining techniques such as association rule mining and cluster analysis, richer and deeper data insights can be obtained, helping IT teams better understand and solve IT work order problems.

[0040] Real-time monitoring of issues in the IT ticket system, specifically: When the monitoring system detects a new problem, it first compares it to existing problems; If the new problem is not much different from the existing problem, directly put this problem into the existing model for prediction; If the new problem is very different from the existing problem, treat the new problem separately, for example, rebuild the model or change the model to make it more applicable to this situation.

[0041] The technical effect of the above content is: by real-time monitoring of problems in the IT work order system and comparing them with existing size models, when a new IT work order problem arises, if it is found to be different from the existing problems or has new development trends, it is necessary to make corresponding adjustments to the trained size model to enable it to better adapt to these changes. This can ensure that risk warnings and response strategies always remain at the optimal level of the current state. Through dynamic adjustment of the model, it can be ensured that the model can always make accurate predictions, thereby providing effective risk warnings and response strategies.

[0042] Working principle: By combining large and small models, the shortcomings of a single model can be effectively compensated. Through model analysis of factors such as the probability of occurrence, impact, and solutions of different types of problems, targeted risk warnings and response strategies can be provided to the IT team, thereby improving the efficiency and response speed of IT operation and maintenance and avoiding the expansion of problems. At the same time, it also combines association rule mining and cluster analysis technology to obtain richer and deeper data insights, helping the IT team to better understand and solve IT work order problems.

[0043] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0044] While the embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that many changes, modifications, substitutions and variations can be made to the embodiments without departing from the principles and spirit of the invention.

Claims

1. A method for IT work order risk management based on a combination of large and small models, characterized in that: The method is an IT work order risk management method that uses a combination of large and small models; The method comprises the following steps: Collect data from the IT work order system and perform preprocessing, including deduplication, missing value processing, and outlier processing; Perform feature extraction on the preprocessed data; The model adopts a combination of large and small models, using the trained large and small models to predict the risk level of new IT work order issues, and generates corresponding response strategies based on the prediction results; At the same time, association rule mining and cluster analysis techniques are used to understand and analyze the data; Monitor problems in the IT work order system in real time, and compare newly generated IT work order problems with existing size models. If new development trends are found, adjust the size model in a timely manner. When performing outlier processing, real-time monitoring is performed to determine whether the outliers in the outlier processing process cause the data quality to fail to meet the data quality requirements.

2. The method for IT work order risk management based on the combination of large and small models according to claim 1 is characterized by: Collect all relevant data from IT work order systems from multiple channels, including internal IT work order systems or external work order platforms. At the same time, pre-process the collected data, specifically: Deduplication: Check whether there is duplicate data in the data. If there is duplicate data, choose to delete one or more of them; Missing value processing: directly delete the data containing missing values, or use the mean, median and mode method to replace the missing values; Outlier processing: Analyze whether outliers affect subsequent feature extraction, model training, and data analysis. If so, delete the outliers directly; if not, ignore the outliers or mark them.

3. The method for IT work order risk management based on the combination of large and small models according to claim 1 is characterized by: Real-time monitoring of outliers in the outlier processing process to see if the data quality does not meet the data quality requirements, including: Extracting abnormal values ​​that affect feature value extraction during abnormal value processing as first abnormal data; Extracting abnormal values ​​that have no influence on feature value extraction during abnormal value processing as second abnormal data; Extracting a weight value corresponding to each abnormal value included in the first abnormal data; Extracting a weight value corresponding to each abnormal value included in the second abnormal data; Obtaining an abnormality degree evaluation coefficient according to a weight value corresponding to each abnormal value included in the first abnormal data and a weight value corresponding to each abnormal value included in the second abnormal data; The abnormality evaluation coefficient is obtained by the following formula: ； Where E represents the abnormality evaluation coefficient; n represents the number of first abnormal data; m represents the number of second abnormal data; w 01 represents the weight value corresponding to the i-th first abnormal data; w 02 represents the weight value corresponding to the i-th second abnormal data; w z represents the middle value of the weight corresponding to all data types in the collected data; F represents the reference coefficient, and the reference coefficient is obtained by the following formula: Among them, w 01b represents the standard deviation of the weight values ​​corresponding to the n first abnormal data; w 02b represents the standard deviation of the weight values ​​corresponding to the m second abnormal data; w 01p represents the average value of the weights corresponding to the n first abnormal data; w 01z represents the middle value of the weight values ​​corresponding to the n first abnormal data; w 02p represents the average weight value corresponding to m second abnormal data; w 02z Indicates the middle value of the weight values ​​corresponding to the m second abnormal data; The abnormality evaluation coefficient is used to determine whether the abnormal values ​​in the collected data cause the data quality to fail to meet the data quality requirements.

4. The method for IT work order risk management based on the combination of large and small models according to claim 3 is characterized by: Using the abnormality evaluation coefficient to judge whether the abnormal value in the collected data causes the data quality to fail to meet the data quality requirements includes: Extracting the abnormality degree evaluation coefficient; Comparing the abnormality evaluation coefficient with a preset coefficient threshold; When the abnormality evaluation coefficient does not exceed the preset coefficient threshold, the first abnormality evaluation model is used to obtain the abnormality evaluation parameter; The structure of the first abnormality evaluation model is as follows: ； Among them, J 01 represents the first abnormality evaluation model to obtain abnormality evaluation parameters; E represents the abnormality degree evaluation coefficient; E y represents the preset coefficient threshold; w 01p represents the average value of the weights corresponding to the n first abnormal data; w 01z represents the middle value of the weight values ​​corresponding to the n first abnormal data; w 02p represents the average weight value corresponding to m second abnormal data; w 02z represents the middle value of the weight values ​​corresponding to the m second abnormal data; w 01max represents the maximum value of the weight corresponding to the n first abnormal data; w 02max Indicates the maximum value of the weight corresponding to m second abnormal data; When the abnormality evaluation coefficient exceeds a preset coefficient threshold, an abnormality evaluation parameter is obtained using a second abnormality evaluation model; The structure of the second abnormality evaluation model is as follows: ； Among them, J 02 represents the abnormal evaluation parameter obtained by the second abnormal evaluation model; E represents the abnormal degree evaluation coefficient; E y represents the preset coefficient threshold; w 01p represents the average value of the weights corresponding to the n first abnormal data; w 01z represents the middle value of the weight values ​​corresponding to the n first abnormal data; w 02p represents the average weight value corresponding to m second abnormal data; w 02z represents the middle value of the weight values ​​corresponding to the m second abnormal data; w 01min represents the minimum weight value corresponding to the n first abnormal data; w 02min Indicates the minimum weight value corresponding to m second abnormal data; Comparing the abnormal evaluation parameter with a preset evaluation parameter threshold; When the abnormal evaluation parameter exceeds a preset evaluation parameter threshold, it is determined that the abnormal value in the collected data causes the data quality to fail to meet the data quality requirements.

5. The method for IT work order risk management based on the combination of large and small models according to claim 1 is characterized by: Feature extraction is performed on the preprocessed data, including the type of problem, probability of occurrence, impact and solution. The extracted features are used to represent the characteristics of different types of problems, specifically: Question type features: used to distinguish different types of questions; Occurrence probability feature: used to predict the possibility of occurrence of new IT work order issues; Impact characteristics: directly used to determine the impact of the problem; Solution characteristics: Each problem has a corresponding solution. The solution to each problem is obtained from the IT work order system and the solution is encoded.

6. The method for IT work order risk management based on the combination of large and small models according to claim 1 is characterized by: The risk level prediction is performed by combining large and small models, which includes the following steps: Data partitioning: Determine the ratio of training set and test set, and divide the training set and test set according to the ratio. The training set is used to train large and small models, while the test set is used to evaluate the performance of the model. Large and small model training: Select machine learning algorithms, including decision tree, random forest, and SVM, and train large and small models on the training set; Hyperparameter tuning: During training, multiple rounds of iterative optimization are performed on the training set using cross-validation techniques for different hyperparameter combinations to obtain the best model performance. Large and small model evaluation: For the models in the training set, they will be evaluated on the test set. If the basic training effect is not good, the structure or parameters of the model will be adjusted and trained again. Introduction of deep learning model: If the evaluation results on the test set show that the training effect of the large and small models is not good, the deep learning model is introduced into the large and small models for enhanced training; Model fusion: The output results of the large and small models are combined with the prediction results of the deep learning model to obtain the final prediction results. Model fusion uses the following methods: Average method: average the prediction results of the large and small models and the deep learning model to obtain the final prediction result; Adversarial learning method: The large and small models and the deep learning model are trained adversarially so that the prediction results of the two constrain each other and obtain the final prediction result; Prediction of new work order issues and generation of response strategies: Use a new model that combines deep learning and large and small models to predict the risk level of new IT work order issues and generate corresponding response strategies based on the predicted results.

7. The method for IT work order risk management based on the combination of large and small models according to claim 6 is characterized by: The deep learning model is introduced, and the specific process is as follows: Design deep learning models, including recurrent neural network models, based on the nature of the task and the characteristics of the data; Combine and fine-tune the large and small models with the deep learning model, and balance the performance of the large and small models with the deep learning model through cross-validation techniques; During the fine-tuning process, the weights of the deep learning model are updated through the direction propagation algorithm, so that the model gradually converges to the optimal solution.

8. The method for IT work order risk management based on the combination of large and small models according to claim 1 is characterized by: Use association rule mining and cluster analysis techniques to understand and analyze data, specifically: Association rule mining: Through association rule mining, we can understand the problems and potential patterns in the IT work order system and provide support for risk warning and response strategy generation; Cluster analysis: Through cluster analysis, common problems and behavior patterns in the IT work order system are discovered, providing reference for risk warning and response strategy generation.

9. The method for IT work order risk management based on the combination of large and small models according to claim 8, characterized in that: Association rule mining and cluster analysis techniques include the following steps: Association rule mining: defining the data structure and event sequence of association rules; Select association rule mining algorithms, including Apriori and FP-growth; According to the input settings of the association rule mining algorithm, all association rules are calculated; Filter out the most relevant association rules based on rule confidence and support thresholds; Evaluate and optimize the selected association rules, including support and credibility; Cluster analysis: select clustering algorithms, including K-means, hierarchical clustering, and density clustering; Perform cluster analysis on the data according to the input settings of the clustering algorithm; Analyze clustering results, including cluster distribution, internal consistency, and variable importance; Based on the analysis results, put forward corresponding coping strategies or suggestions.

10. The method for IT work order risk management based on the combination of large and small models according to claim 1, characterized in that: Real-time monitoring of issues in the IT ticket system, specifically: When monitoring detects a new problem, the detected new problem is compared with the existing problems; If there is not much difference between the new problem and the existing problem, directly put the new problem into the existing model for prediction; If the new problem is very different from the existing problem, deal with the new problem separately. Including rebuilding the model or changing the model.

Images