Monitoring fault analysis method fused with multi-modal knowledge base

Abstract

The invention relates to the technical field of fault analysis, and particularly provides a monitoring fault analysis method fused with a multi-modal knowledge base, which comprises the following steps: collecting original data of a monitoring fault log, and preprocessing and storing the original data; performing data cleaning and feature extraction on the obtained original data of the monitoring fault log; constructing a searchable knowledge base based on the cleaned data; when the system triggers an alarm, mixed retrieval is executed through a dynamic routing mechanism; aggregating the plurality of retrieval results to generate an executable repair scheme; iteratively optimizing the decision process through manual feedback; and continuously optimizing the knowledge base and the diagnosis model to form a closed loop iteration mechanism. According to the scheme, the accuracy and response efficiency of fault diagnosis are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of fault analysis, and specifically provides a monitoring fault analysis method integrating multi-modal knowledge bases. Background Art

[0002] With the large-scale application of domestic software and hardware systems in key fields, their complexity and security requirements have been significantly improved. However, there are many deficiencies in traditional monitoring fault analysis methods. First, the problem of data islands is prominent. The logs, metrics generated by the monitoring system, the topological relationships and configuration information of the CMDB, and industry knowledge bases are fragmented from each other and lack unified association. Second, the intelligent adaptability is insufficient. The existing large model technologies lack targeted optimization for the non-standard logs and special fault modes of domestic systems, resulting in low retrieval accuracy, error-prone generated results, and the real-time performance cannot meet the requirements of key scenarios.

[0003] Currently, there are some monitoring and alerting systems based on rules or large language models (LLMs), which support alert analysis to a certain extent, but there are still the following problems: (1) Lack of a standard knowledge base. Data or knowledge is scattered everywhere, and operation and maintenance experience and technologies are scattered in the minds of operation and maintenance engineers and work orders, and cannot form standard and effective knowledge and experience to help those with less experience or for large model application fault alerts.

[0004] (2) Poor adaptability of large models and inaccurate answers: Existing models are all general large models, and they have poor adaptability when facing different software and hardware environment professional fields, and cannot accurately perform root cause analysis and diagnosis, and can only give relatively vague answers.

[0005] (3) Lack of a feedback optimization link for the generated results of the RAG knowledge base. When the adaptation system is not satisfied with the results generated by RAG retrieval during manual inspection, there is no optimization and improvement mechanism, or it can only go around and add new knowledge from the knowledge acquisition layer of the knowledge base, with a cumbersome process and a slow update frequency.

[0006] (4) The ordinary RAG retrieval method is single, and the coverage of long-tail problems is insufficient, which is suitable for scenarios with low timeliness requirements and little data change, resulting in problems such as insufficient accuracy and poor flexibility of naive RAG in complex scenarios.

[0007] In view of the above problems, there is an urgent need for a monitoring fault analysis method that integrates a multi-modal knowledge base and retrieval-augmented generation technology (RAG). By constructing a multi-modal knowledge base, the structural data of the CMDB and multi-modal industry knowledge (fault cases, product manuals, diagnostic libraries, etc.) are uniformly encoded into vectors to achieve semantic association of cross-modal data and break traditional data silos. Based on this, intelligent analysis of logs is performed through RAG technology. For example, when a "database connection timeout" log is detected, the database version in the CMDB and the associated middleware configuration can be automatically retrieved, and the SQL optimization solution in the knowledge base can be matched to generate a diagnostic report including root cause analysis. In addition, through the adaptive analysis ability, the retrieval strategy is continuously optimized according to work orders and manual feedback, the content of the knowledge base is dynamically updated, and the retrieval weights are adjusted, thereby improving the accuracy and response efficiency of fault diagnosis. Summary of the Invention

[0008] To overcome the above defects, the present invention provides a monitoring fault analysis method that integrates a multi-modal knowledge base, including the following steps: S1: Collect the original data of the monitoring fault logs, perform preprocessing and store them; S2: Perform data cleaning and feature extraction on the obtained original data of the monitoring fault logs; S3: Build a retrievable knowledge base based on the cleaned data; S4: When the system triggers an alarm, perform hybrid retrieval on the knowledge base through a dynamic routing mechanism; S5: Aggregate multiple retrieval results fed back by the hybrid retrieval to generate an executable repair plan; S6: For the generated executable repair plan, iteratively optimize the decision-making process through manual feedback; S7: Through the iteratively optimized decision-making process of manual feedback, continuously optimize the knowledge base and the diagnostic model to form a closed-loop iterative mechanism.

[0009] Further, the data cleaning includes duplicate removal, noise removal, and format standardization. The duplicate removal includes using the SimHash algorithm to remove duplicates from the original data of the monitoring fault logs, and at the same time introducing a time window parameter, device context encoding, and a dynamic similarity threshold. The introduction of the time window parameter includes segmenting the original data of the monitoring fault logs by time window, and giving priority to comparing the logs within the same window. The device context encoding includes adding hash bits of device ID and fault type in the improved SimHash algorithm. The dynamic similarity threshold includes dynamically adjusting the similarity threshold according to the type of the monitoring fault logs. The noise removal includes filtering invalid monitoring fault log data, including null values, garbled characters, format errors, and values exceeding the normal numerical range. The format standardization includes unifying the timestamp into the Unix millisecond format, mapping error codes to a standard coding table, and converting unstructured monitoring fault logs into a unified JSON format.

[0010] Furthermore, the feature extraction includes entity relationship extraction, data annotation and classification, and keyword extraction. The entity relationship extraction includes identifying the hardware model, operating system version, and dependencies in the original data of the monitoring fault logs after data cleaning based on the BiLSTM-CRF model. The data annotation and classification include annotating the original data of the monitoring fault logs after data cleaning, including fault type, fault level, trigger condition, device type, processing result, and whether it is the root cause. The keyword extraction includes extracting the preset-ranked keywords in the original data of the monitoring fault logs after data cleaning using the TF-IDF algorithm.

[0011] Furthermore, the partitioning methods for knowledge base construction include log BM25 index, vectorized index, and knowledge graph-based index. The log BM25 index includes constructing an inverted index based on the keywords extracted by feature extraction according to the BM25 algorithm and storing it in shards according to the log type. The vectorized index includes, after text segmentation, using the BGE-M3 improved model for vectorization, partitioning according to the device ID, and storing it in the FAISS vector library. The knowledge graph-based index includes dynamically partitioning subgraphs based on scenario labels and storing them in the Neo4j graph database in triple form.

[0012] Furthermore, the BGE-M3 improved model includes: During training, sampling negative samples in the domestic migration knowledge base. Adjust the temperature parameter of the contrastive loss according to the text complexity τ = α· Entropy( D )+ β , where Entropy( D ) is the text information entropy, and α and β are configured according to requirements. After segmenting long texts, hierarchical attention aggregation is adopted.

[0013] Furthermore, the step S4 includes: Pre-training a fault classifier based on the lightweight TextCNN model, and the fault classifier is used to output the probability of the fault type. Obtain the monitoring fault target data when the current alarm is triggered, including alarm information and device context. Input it into the pre-trained fault classifier, and output the probability of the fault type; Judge the probability of the fault type. If the highest probability is greater than 0.8, match the preset dynamic routing mechanism retrieval strategy; otherwise, start hybrid retrieval.

[0014] Furthermore, the preset dynamic routing mechanism retrieval strategy includes: For simple problems with clear error codes and standard solutions, directly query the technical documents; For complex problems involving multi-device association and requiring reasoning, when it is specifically a device topology problem, use KG retrieval; when it is specifically a historical case dependence, use work order + log retrieval; when it is specifically a real-time diagnosis requirement, use monitoring + log retrieval; For unknown problems, use HyDE to generate hypothetical queries and adopt hybrid retrieval.

[0015] Furthermore, the hybrid retrieval includes: a. Combine the log timestamp and device topology to optimize the BM25 score, and retrieve the candidate paragraphs with a preset ranking from the log BM25 index. The log timestamp weights down the old logs through a time decay factor, =BM25(q,d)· , where =0.01, Δt is the difference between the current time and the log time, and the device topology means that if there is a dependency between the log device and the current faulty device, the score increases = + β· TopoLinkScore, where β =0.2, and TopoLinkScore is the device topology association degree; b. Use BGE-M3 to calculate the similarity between the Query and the candidate paragraphs, and retain the data with a preset ranking; c. Load the fine-tuned MiniLM-L6-v2 model, and perform weighted ranking by integrating the BM25 score, vector similarity, and cross-encoder of knowledge graph retrieval, and calculate the final score final_score = 0.2 bm25 + 0.3 cos_sim + 0.5 cross_score, and output the data with a preset ranking Furthermore, the step S5 includes: Dynamically calculate the weights of keyword retrieval, knowledge graph, and vector retrieval according to the problem type and context; Dynamically load the domain adaptation template, use the DeepSeek-32B model, and output the structured result.

[0016] Further, the dynamic calculation of the weights of keyword retrieval, knowledge graph, and vector retrieval according to the question type and context includes: Using a lightweight TextCNN model to output the probability distribution of question types P = p 1, p 2,..., pn ; Calculate the weights of various retrieval types, keyword retrieval w BM25 = , knowledge graph w KG = , vector retrieval w Vector =1 - w BM25 - w KG, where is the probability of simple questions, is the probability of complex questions, and k = 2 is the adjustment coefficient.

[0017] Working principle and beneficial effects of the present invention: In implementing the technical solution of the present invention, by collecting and utilizing historical alarm data, quality detection, splitting, and cleaning are performed on the collected alarm data to obtain high-quality alarm and processing data. These processed high-quality data serve as the knowledge base of RAG. On this basis, the RAG model is used to realize the intelligent retrieval and processing of alarm information, and the fine-tuning technology is combined to improve the accuracy and adaptability of the model in specific scenarios. Compared with the traditional alarm processing method, the present invention can significantly reduce the diagnosis time, improve the accuracy and efficiency of alarm processing. At the same time, it can also provide effective training and auxiliary tools for operation and maintenance personnel, improving work efficiency. Brief description of the drawings

[0018] Referring to the accompanying drawings, the disclosure of the present invention will become more understandable. It is easy for those skilled in the art to understand that these drawings are only for illustrative purposes and are not intended to limit the protection scope of the present invention. In addition, similar numbers in the figures are used to represent similar components, where: Figure 1 is the main step flow diagram of a monitoring fault analysis method integrating a multi-modal knowledge base of the present invention; Figure 2 is the flow chart of the RAG hybrid retrieval and rearrangement work in the present invention; Figure 3 is the technical design drawing of a monitoring fault analysis system integrating a multi-modal knowledge base of the present invention. Detailed implementation manners

[0019] Some embodiments of the present invention will be described below with reference to the accompanying drawings. Those skilled in the art should understand that these embodiments are only used to explain the technical principles of the present invention and are not intended to limit the protection scope of the present invention.

[0020] Embodiment 1

[0021] Figure 1 is a schematic diagram of the main steps of a monitoring fault analysis method that integrates a multi-modal knowledge base according to the present invention. As Figure 1 shown, a monitoring fault analysis method that integrates a multi-modal knowledge base in an embodiment of the present invention mainly includes the following steps S1 - step S7.

[0022] Step S1: Collect the original data of the monitoring fault log from multi-modal heterogeneous data types such as technical documents (PPT, Word, PDF, Excel, etc.), CMDB configuration, web pages, monitoring data, operation and maintenance logs, and work records, and perform different types of preprocessing and storage on data in different formats.

[0023] Step S2: Perform data cleaning and feature extraction on the obtained original data of the monitoring fault log.

[0024] In one embodiment, data cleaning includes deduplication, denoising, and format standardization. Specifically: ① Use the SimHash algorithm (hash bit number 80bit) to deduplicate the original data of the monitoring fault log, and at the same time introduce a time window parameter, device context encoding, and dynamic similarity threshold.

[0025] Introduce the time window parameter: Segment the original data of the monitoring fault log according to a time window (such as 5 minutes), and give priority to comparing the logs within the same window; Device context encoding: Increase the hash bits of metadata such as device ID and fault type in the improved SimHash algorithm (the original 64bit is extended to 80bit, the first 64bit is text hash, and the last 16bit is device context encoding); Dynamic similarity threshold: Dynamically adjust the similarity threshold according to the type of the monitoring fault log (such as error log threshold = 0.85, warning log threshold = 0.7); The calculation formula using the improved SimHash algorithm is D = SimHash( D text) ⊕ Hash( D device, D type), where ⊕ is bit concatenation, D text is the log type, D device is the device ID, D type is the fault type.

[0026] ②Filter out invalid monitoring fault log data, such as null values, garbled characters, format errors, values exceeding the normal range, etc.

[0027] ③Format standardization: The timestamp is unified into the Unix millisecond format, and the error code is mapped to a standard coding table (e.g., "E1001" represents "driver compatibility error"). Convert unstructured monitoring fault logs into a unified JSON format.

[0028] In one implementation, feature extraction includes entity relationship extraction, data annotation and classification, and keyword extraction. Specifically: ①Entity relationship extraction: Based on the BiLSTM-CRF model, identify the hardware model (such as "Kunpeng 920"), operating system version (such as "Kylin V10"), and dependency relationships in the original monitoring fault log data after data cleaning. ②Data annotation and classification: Annotate the original monitoring fault log data after data cleaning, including fault type, fault level, trigger condition, device type, processing result, whether it is the root cause, etc.

[0029] ③Keyword extraction: Use the TF-IDF algorithm to extract the top 10 keywords in the original monitoring fault log data after data cleaning.

[0030] Step S3: Build a retrievable knowledge base based on the cleaned data.

[0031] In one implementation, knowledge base construction includes log BM25 index, vectorization index, and KG index based on knowledge graph. Specifically: ①Log BM25 index According to the keywords extracted by feature extraction, build an inverted index (BM25 algorithm, parameters k1 = 1.2, b = 0.75), and store it in slices according to the log type (error, warning, information).

[0032] ②Vectorization index After text segmentation, use the BGE-M3 improved model for vectorization, partition according to the device ID, and store it in the FAISS vector library.

[0033] In one implementation, the BGE-M3 improved model is aimed at the semantic ambiguity problem of non-standard logs in the domestic monitoring scenario, and introduces a domain-adapted contrast learning mechanism. The specific improvements include: a. During training, sample negative examples in the domestic migration knowledge base (such as "driver incompatibility" and "network interruption" as negative sample pairs).

[0034] b. Adjust the temperature parameter of the contrast loss according to the text complexity: τ = α· Entropy( D)+ β , where Entropy( D ) is the text information entropy, α = 0.1, β = 0.05, α and β are configurable.

[0035] C. After segmenting the long text, hierarchical attention aggregation is adopted.

[0036] ③ Based on the knowledge graph index Dynamically divide subgraphs based on scenario labels (such as "ARM migration", "driver installation"), and store them in the Neo4j graph database in the form of triples (head entity, relationship, tail entity) (such as "Kylin V10 - dependency - GCC 9.3").

[0037] Step S4: When the system triggers an alarm (such as "Failed to install NVIDIA driver on Kylin V10, error code E1001"), perform hybrid retrieval through the dynamic routing mechanism.

[0038] In one implementation, a fault classifier is pre - trained based on a lightweight TextCNN model (parameters: kernel_sizes = [3, 4, 5], filters = 128), and the fault classifier is used to output the probability of fault types (10 categories such as hardware compatibility, driver missing, API conflict, etc.).

[0039] Obtain the monitored fault target data when the current alarm is triggered, including alarm information (error code, log fragment), device context (model, operating system version), input it into the pre - trained fault classifier, and output the probability of fault types. Judge the probability of fault types. If the highest probability > 0.8, directly match the preset dynamic routing mechanism retrieval strategy; otherwise, start hybrid retrieval to reduce the risk of misjudgment. Hybrid retrieval includes KG retrieval (implemented based on knowledge graph storage) + keyword retrieval (implemented based on log BM25 index) + vector retrieval (implemented based on vectorized index) In one implementation, the preset dynamic routing mechanism retrieval strategy includes: ① For simple problems with clear error codes and standard solutions (such as "insufficient disk space"), directly query the technical documentation (such as "disk cleaning operation specifications").

[0040] ② For complex problems involving multi - device association and requiring reasoning (such as "Service A crashing causes Service B to time out"), when it is specifically a device topology problem, adopt KG retrieval (such as "status of database nodes on which Service A depends"); when it is specifically a historical case dependency, adopt work order + log retrieval (such as "solutions to similar faults"); when it is specifically a real - time diagnosis requirement, adopt monitoring + log (such as "current CPU / network abnormal mode") retrieval.

[0041] ③For unknown problems, use HyDE to generate hypothetical queries (such as "Service crashes may be caused by memory leaks") and adopt hybrid retrieval.

[0042] In this embodiment, HyDE hypothesis generation includes inputting the log text of the current monitored fault problem and real-time monitoring charts (index curves such as CPU / memory) into the T5-3B model to generate hypothetical answers (such as "Error code E1001 is usually caused by an incompatible CUDA version"). Use contrastive learning to screen and generate hypothetical answers, and retain the top 3 hypotheses with the highest consistency with the knowledge base. Dynamically adjust the temperature to temperature = 0.5 + 0.2·Uncertainty(q), where Uncertainty(q) is the entropy value output by the problem classification model. Take the hypothetical answer as the new monitored fault problem and perform vector retrieval (BGE-M3) to supplement the context.

[0043] In one implementation, the implementation of KG retrieval includes: Based on the Cypher query language, extract the subgraph within 3 hops (including dependency relationships and historical repair paths) associated with the current device model (such as "Kunpeng 920") and error code (such as "E1001") from the Neo4j knowledge graph; Sort according to the semantic similarity (vector cosine value of the improved BGE-M3 algorithm) between the nodes in the subgraph and the Query, and retain the top 5 associated nodes. (Extract the associated subgraph within 3 hops through Cypher and retain the top 5 nodes according to semantic similarity) In one implementation, Figure 2 is the flowchart of the RAG hybrid retrieval and rearrangement work in the present invention. As Figure 2 shown, after the user inputs a question or fault warning information, the implementation of hybrid retrieval includes the following steps: a. Keyword search - Use the BM25 algorithm to retrieve paragraphs containing keywords from the database. The present invention has improved the BM25 algorithm, optimized the BM25 score by combining the log timestamp and device topology, and retrieved the top 50 candidate paragraphs (score > 6.0) from the log BM25 index, that is, the blocks containing keywords. SQL is used to construct SQL query statements from the database through these keywords in order to retrieve relevant text or paragraphs (blocks containing keywords) from the relational database.

[0044] The log timestamp weights down the old logs through a time decay factor, =BM25(q,d)· where q is the user's query input text or search keyword, and d is the data or log in the knowledge base, = 0.01, where Δt is the difference (in hours) between the current time and the log time. For device topology, if there is a dependency between the log device and the current faulty device, the score increases: = + β· TopoLinkScore, where β = 0.2 and TopoLinkScore is the device topology correlation degree.

[0045] b. Vector similarity search: Use BGE-M3 to calculate the vector similarity between the Query and the candidate paragraphs, and retain the top 20 (threshold > 0.7), i.e., the blocks of similar content. FAISS is used as a vector similarity search library to efficiently retrieve the document blocks most similar to the user query vector, so as to quickly locate relevant operation and maintenance knowledge and fault information.

[0046] c. Knowledge graph search (keyword and semantic search of graph and subgraph entity names, attribute or relationship descriptions). Neo4j is used as a graph database to perform GraphRag search, and through keyword and semantic search of entity names, attributes or relationship descriptions in the graph, to return the entity attributes and association relationships closely related to the query input.

[0047] By loading the fine-tuned MiniLM-L6-v2 model, a cross-encoder that combines BM25 scoring, vector similarity, and knowledge graph retrieval is used for weighted ranking (weight ratio: 0.2:0.3:0.5), and the final score final_score = 0.2 bm25 + 0.3 cos_sim + 0.5 cross_score, where bm25 represents in keyword search, cos_sim represents the parameter of calculating the vector similarity between the Query and the candidate paragraph vectors using BGE-M3 in vector similarity search, and cross_score represents the values of entity attributes and association relationships closely related in knowledge graph search. Output the top 10, excluding the results with final_score < 0.6; sort in descending order of final_score and retain the top 10 to be passed into the large model generation stage (allowing less than 10, but also ensuring the accuracy of the retrieved content), that is, the relevant graphs and subgraphs.

[0048] Step S5: Aggregate the BM25 scores of multiple retrieval results to generate an executable repair plan.

[0049] ① Dynamic hybrid retrieval weight allocation algorithm, which dynamically calculates the weights of keyword retrieval, knowledge graph, and vector retrieval according to the problem type and context. Specifically, it includes the steps: a. Output the probability distribution of question types using a lightweight TextCNN model P = p 1, p 2,..., pn ; b. Calculate the weights of various retrieval types, keyword retrieval w BM25 = , knowledge graph w KG = , vector retrieval w Vector =1 - w BM25- w KG , where is the probability of simple questions, is the probability of complex questions, and k = 2 is the adjustment coefficient. Corresponding Figure 2 rerank all the retrieved blocks obtained in step S4 into weighted blocks in

[0050] ② Generative diagnosis Prompt template: Dynamically load domain-adapted templates (such as "You are a domestic OS migration expert and need to output comprehensively based on the following information: 1. Root cause analysis; 2. Step-by-step repair instructions; 3. Risk warnings"); Generation control: Select the top 15 blocks and input them into the large model, as well as input the user's question / fault warning information. Use the DeepSeek-32b model (top_p = 0.85, temperature = 0.7, repetition_penalty = 1.2, max_length = 512) to output structured results, and transform the warning data or code logs into text that users can understand, so as to achieve explanation, fault location analysis, and handling suggestions. For example: { "Root cause": "The CUDA version needs to be ≥11.4, and the current version is 11.2", "Repair steps": ["1. Download CUDA 11.4", "2. Update the environment variable PATH"], "Risk": "It needs to take effect after restarting the system, which may cause service interruption" } Step S6: Iteratively optimize the decision-making process through manual feedback

[0051] ①The operation and maintenance personnel mark the correctness of the generation result (correct / partially correct / wrong), and supplement the correction plan (such as "actually need to downgrade to CUDA 11.3"), and store the triple <original question, routing policy, generation result, manual correction> in MongoDB (index fields: error_code, route_type).

[0052] ②Calculate the total reward value L = α·user rating + β·repair success rate - γ·risk coefficient + δ· - ·operation and maintenance personnel experience level, where the operation and maintenance personnel experience level takes values from 0 to 1, α α = 0.4, β = 0.3, γ = 0.1, δ = 0.15, ε = 0.05, and the parameters support adjustment and configuration by operation and maintenance personnel.

[0053] In this embodiment, the user interaction information includes user rating (1 - 5 points, reflecting the effectiveness of the repair plan); manual correction record (such as correcting the root cause label or repair script); execution result (success / failure status and log details); context metadata (device type, system status when the alarm is triggered: CPU, operating system, network, memory, storage). Among them, the user rates the generated result (1 - 5 points, reflecting the effectiveness of the generated result). If it is completely in line, it is 5 points; if it is completely not in line, it is 0 points, and the default is completely in line. If it does not conform, the rating can be modified, and the result can be manually corrected, and the error reason and correct information can be filled in.

[0054] ③Use the PPO-like algorithm to train the routing decision model, and add a complexity regularization term to the loss function: L CLIP = E t [min( rt · At , clip( rt , 1 - , 1 + )· At )] + η· ComplexityPenalty, where η = 0.01 and ComplexityPenalty = ∑StepCount, representing the number of repair steps. Update the model parameters through the improved algorithm of PPO, and preferentially recommend high rewards (such as recommending low-risk, high-rating solutions). The routing decision model is used to generate the retrieval strategy of the dynamic routing mechanism in step S4.

[0055] Step S7: Based on the manual feedback data collected in step S7, the system continuously optimizes the knowledge base and the diagnosis model to form a closed-loop iterative mechanism.

[0056] ①Incremental update of the knowledge base: Associate the correction scheme marked in step S6 with the original knowledge base in step S3, and dynamically update the following components: BM25 index: Merge the manually corrected technical documents (source in step S1) Vector library: Trigger the incremental training of the BGE-M3 model (batch_size = 32, epochs = 2) to enhance the semantic understanding of unstandardized logs (continuing the domain adaptation optimization in step S3) Knowledge graph: Based on the triple correction records (data stored in MongoDB in step S6), supplement the missing dependency relationships (such as adding an edge of "Kylin V10 - incompatible - CUDA 11.2") Version control: Use Git to manage the knowledge graph snapshots and support rollback according to the fault timestamp (forming a fault-tolerant linkage with the KG subgraph retrieval in step S04) ②Model fine-tuning Feedback-driven lightweight update: Based on the manually modified and annotated data in step S5, use the LoRA technique (rank = 16, alpha = 32) to efficiently adjust the attention projection layers (q_proj / k_proj / v_proj) of the DeepSeek-32B model, and specifically optimize the following scenarios: Fix the problem of redundant steps (associated with the ComplexityPenalty item in step S5) Root cause analysis deviation (associated with the cross-encoder fine-ranking results in step S4) Enhanced adversarial training: Use the error cases marked in step S6 to construct adversarial samples (such as replacing "E1001" with a synonym "E1002"), and improve the robustness of the model to semantic interference through the KL divergence loss (L_KL = 0.1) Optimization of training efficiency: Adopt mixed precision (bf16) and gradient accumulation (steps = 8) to ensure that a single A100 card can complete the fine-tuning of a model with hundreds of billions of parameters (matching the real-time generation requirements in step S05).

[0057] It should be noted that although the above embodiments describe the various steps in a specific order, those skilled in the art can understand that in order to achieve the effects of the present invention, different steps do not necessarily have to be executed in such an order. They can be executed simultaneously (in parallel) or in other orders, and these changes are all within the protection scope of the present invention.

[0058] Based on the above steps S1 - S7, this embodiment can efficiently collect and utilize historical alarm data. Through data governance, quality detection, splitting, and cleaning are performed on the collected alarm data to obtain high-quality alarm and processing data. These processed high-quality data serve as the knowledge base of RAG. On this basis, the RAG model is used to achieve intelligent retrieval and processing of alarm information, and the fine-tuning technology is combined to improve the accuracy and adaptability of the model in specific scenarios. Compared with traditional alarm processing methods, the present invention can significantly reduce the diagnosis time, improve the accuracy and efficiency of alarm processing, and reduce the average fault repair time from 40 minutes to 15 minutes. At the same time, this embodiment can also provide effective training and auxiliary tools for operation and maintenance personnel to improve work efficiency.

[0059] The improvement points and advantages of this embodiment include: ① Improve and optimize the data and processes of existing algorithms based on domestic monitoring, making the parameters and variables of the algorithms more suitable for the operation and maintenance monitoring field. The improved algorithms include the improved SimHash algorithm for log deduplication, the improved BGE-M3 model for vectorization, the improved BM25 algorithm for keyword retrieval, the improved HyDE hypothesis generation, the dynamic calculation of weights for hybrid retrieval, the improvement of the result reward calculation formula, the improvement of the PPO algorithm for training the decision model, and the improvement of the large model fine-tuning algorithm. See the specific embodiments of the present invention for details.

[0060] ② High update frequency: Collect historical alarm data and real-time monitoring data through the alarm data collection module; secondly, use the data governance module to perform quality detection, splitting, and cleaning on the collected alarm data to obtain high-quality alarm and processing data. These processed high-quality data serve as the external knowledge base of RAG, and the retrieval module and generation module of the RAG model are used to achieve intelligent retrieval and processing of alarm information; improve the update frequency; ③ Modular RAG knowledge base construction: Construct a modular knowledge base for domestic adaptation monitoring scenarios (such as "ARM migration", "database migration", "operating system migration") through multi-modal heterogeneous data collection, class SimHash (80bit) deduplication, and rule engine cleaning. Combine the knowledge graph with hybrid indexing (BM25 + vector index BGE-M3) to achieve efficient retrieval enhanced generation; ④ Dynamic routing strategy: Dynamically route to KG subgraph retrieval, hybrid retrieval, or HyDE hypothesis generation (T5-3B virtual answer guidance), and output the top 15 results through weighted fusion to improve the recall rate and the accuracy of recall; ⑤ Continuous optimization of the artificial annotation feedback link: Optimize the routing strategy by combining the improved PPO reinforcement learning (the reward value is based on artificial scoring), and lightly fine-tune the DeepSeek-32B model through the improved fine-tuning algorithm to achieve high domain adaptation and efficient resource utilization ⑥The large model has a high monitoring adaptation degree in the field of domestic adaptation. The accuracy and adaptability of the model in specific scenarios are improved through fine-tuning technology. In addition, by introducing an enhanced learning mechanism to fine-tune domain-specific monitoring data and continuously reinforce new knowledge, the performance of the model is further optimized.

[0061] ⑦Driven by continuous accumulation of document updates and operation and maintenance knowledge, lightweight fine-tuning and automated knowledge injection have achieved the co-evolution of the model and the knowledge base, significantly improving the operation and maintenance efficiency and accuracy in the domestic migration scenario.

[0062] Example 2 In this example, by constructing an operation and maintenance knowledge base and a RAG model, the retrieval, supplementation and analysis of the content of the knowledge base for the fault alarms generated by the domestic software monitoring adaptation are realized. The overall architecture is divided into six modules: data source, knowledge base construction, index construction, knowledge base application and fault analysis, and feedback optimization, realizing the construction and application of the knowledge base, transforming artificial operation and maintenance experience into the knowledge of the large model, improving the professional experience and fault analysis ability of the large model in the monitoring field, and combining dynamic routing strategies to improve the retrieval accuracy, significantly improving the accuracy of fault location analysis.

[0063] Figure 3 It is the technical design diagram of a monitoring fault analysis system integrating a multi-modal knowledge base of the present invention. As Figure 3 shown, a monitoring fault analysis system integrating a multi-modal knowledge base in this example mainly includes: 1. Data source module Collect data such as fault alarms, CMDB configurations, technical documents, web data, monitoring data, operation and maintenance logs, and work order records. Preprocess the collected data, parse and extract the content of multi-modal files, unify the format, remove invalid data, deduplicate, etc., to ensure the quality and consistency of the data.

[0064] The above data source module is used to execute Figure 1 step S1 in a monitoring fault analysis method of a monitoring fault analysis system integrating a multi-modal knowledge base as shown.

[0065] 2. Knowledge base construction module After data governance of the data from each data source, a unified format is formed to construct a knowledge base, which contains the root causes of alarms, corresponding handling methods, alarm cases in different scenarios, and operation parameter information of devices or systems.

[0066] Data cleaning: Use data cleaning technology for quality inspection, remove incorrect or incomplete data, and unify the data format.

[0067] Feature extraction: Extract key features from the cleaned data, such as entities, relationships, keywords, etc., to provide a basis for subsequent indexing and retrieval.

[0068] Keyword indexing: Use the BM25 algorithm for keyword extraction and inverted indexing to improve the efficiency of keyword retrieval.

[0069] Text vectorization: Use the improved BGEM3 algorithm to segment and vectorize the text, construct a vector index, and support semantic similarity retrieval.

[0070] Knowledge graph construction: Construct a knowledge graph, store entity-relationship triples, and support graph structure queries with clear complex and associated relationships.

[0071] The above knowledge base construction module is used to execute Figure 1 Steps S2 - S3 in a monitoring fault analysis method for a multi-modal knowledge base fusion as shown.

[0072] 3. Hybrid Index Module This module realizes multi-dimensional efficient retrieval by constructing a keyword index library, a vector index library, and knowledge graph storage. See Appendix Figure 2 . The hybrid index module works through the following steps: Keyword index library: Construct an improved BM25 algorithm index for logs to support efficient keyword retrieval.

[0073] Vector index library: Construct a monitoring data vector library to support semantic similarity retrieval.

[0074] Knowledge graph storage: Construct a work order KG storage to support knowledge graph queries.

[0075] The above hybrid index module is used to execute Figure 1 Step S4 in a monitoring fault analysis method for a multi-modal knowledge base fusion as shown.

[0076] 4. Fault Analysis and Repair Module This module is responsible for analyzing and diagnosing newly generated faults or problems raised by users. If it is an operation-related problem, it will return the operation steps and guidance to the user. If it is a fault or log-related problem, it will dynamically route and select an appropriate retrieval strategy to more accurately find the corresponding fault analysis content and solution. Then, it will give the retrieved TOP-K knowledge and questions to the large model to generate the final answer. Convert alarm data or code logs into text that users can understand, and achieve explanation, fault location analysis, and handling opinions. It works through the following steps: Fault trigger: Trigger fault analysis through alarm information or logs to respond to operation and maintenance requirements in real time.

[0077] Dynamic Routing: Dynamically select the analysis path according to the fault type to improve the analysis efficiency.

[0078] KG Retrieval: Perform knowledge graph retrieval and subgraph retrieval to extract relevant knowledge.

[0079] Hybrid Retrieval: Combine keywords and vector retrieval of the graph to improve the accuracy and efficiency of retrieval.

[0080] HyDE Hypothesis Generation: Generate fault hypotheses to provide multiple possibilities for subsequent diagnosis.

[0081] Large Model Generation: Transmit the retrieved TOP-K knowledge to the large model to generate fault location, repair suggestions, and operation guides.

[0082] Result Output: Output the diagnosis results in a user-friendly manner, providing clear fault location and repair suggestions.

[0083] The above fault analysis and diagnosis module is used to execute Figure 1 Step S5 in a monitoring fault analysis method that integrates a multi-modal knowledge base as shown.

[0084] 5. Evaluation and Optimization Module: This module is responsible for evaluating and manually annotating the generated results. In particular, it annotates and modifies the answers that are not qualified in the manual evaluation, re-feeds them, updates the knowledge base and the large model. At the same time, it can configure and optimize the routing strategy and adjust the index path. It works through the following steps: Result Evaluation: Evaluate the generated results to judge whether they are correct and ensure the reliability of the diagnosis results.

[0085] When the judgment result is correct (corresponding to the logic pointed by the arrow "Y" in Figure 3 ), it directly ends; When the judgment result is incorrect (corresponding to the logic pointed by the arrow "N" in Figure 3 ), the following adjustments are made: Manual Annotation: Manually annotate and modify the incorrect results to accumulate more training data. Then, introduce incremental learning to quickly update the knowledge base, supplement the location analysis of alarm logs in new operation and maintenance environments, monitoring devices, and specific scenarios, as well as the processing methods.

[0086] Optimization Strategy: Configure and optimize the routing strategy, and adjust the analysis and index paths according to the actual situation.

[0087] Based on the feedback of the evaluation and optimization module, iteratively optimize the index strategy. By adjusting the weight distribution of keyword index, vector index, and knowledge graph index, as well as the index method matching strategy for different types of fault query inputs, optimize the synergistic effect of the index, and continuously optimize the retrieval efficiency and accuracy.

[0088] Reinforcement learning, calculating reward values: Use the PPO improvement algorithm to adjust the model reward parameters, optimize the recommendation priority of the large model, and achieve the self - evolution of the model.

[0089] Continuous improvement: Continuously optimize the knowledge base and the model through user feedback to form a closed - loop optimization mechanism.

[0090] User interaction and feedback: Through the user interface, enable users to conveniently query the knowledge base, submit new knowledge, or feedback inference results. Continuously optimize the content and routing strategy of the knowledge base using user feedback.

[0091] The above - mentioned evaluation and optimization module is used to execute Figure 1 Steps S6 - S7 in a monitoring and fault analysis method for a multi - modal knowledge base fusion as shown.

[0092] The improvement points and advantages of this embodiment include: (1) The modular RAG architecture improves the efficiency and quality of information retrieval and generation Decompose the system into multiple functionally independent modules. This architecture supports the dynamic adjustment and optimization of each module independently, providing great flexibility and adaptability to different tasks and data types. Its advantage lies in being able to flexibly handle complex and changing query scenarios, while maintaining the continuous evolution and performance optimization of the system, providing a powerful and efficient retrieval - enhanced generation framework for users.

[0093] (2) Multi - layer indexing and hierarchical retrieval improve the rag recall rate and accuracy Construct multi - layer indexing and recall in stages. Reduce the retrieval scope and improve the efficiency of small data sets. The first - layer rough screening (BM25): Use document summaries or category labels to filter out irrelevant documents and preferentially screen out categories related to the retrieval. The second - layer fine screening (vector): The BGE - M3 model calculates semantic similarity and sorts the top - 10 result vectors or keyword retrieval. Expansion layer (knowledge graph): Retrieve associated sub - graphs (such as "firmware version → compatibility → upgrade steps") (3)Dynamic routing decision, automatically select the optimal retrieval path according to the fault type (hardware / software / network), improving the accuracy of retrieval.

[0094] (4)Bidirectional evolution of the knowledge base and the model Integrate incremental learning (data update) with reinforcement learning (policy optimization) to achieve a closed-loop iteration of "data - model - policy". The knowledge base enables rapid and timely update of new data, and retrieves new knowledge accurately and promptly through RAG optimization technology. Continuously adjust the model based on user feedback to reduce the recommendation frequency of low-quality diagnostic results, and the model is more inclined to recommend low-risk and high-success-rate solutions in subsequent diagnoses. Use the memory replay method + LoRA to fine-tune the large model, establish an experience replay buffer pool with adjustable capacity, feed in new data, and at the same time introduce a part of the old data, allocate the weights of the new and old data, and achieve incremental training of the new and old data.

[0095] (5) Enhance the interpretability of fault log code error reports to assist in location and repair, provide text and picture explanations, enabling operation and maintenance personnel to find and analyze the root cause of the problem faster. Associate fault alarms with the knowledge base through RAG, retrieve and match historical experiences, quickly and accurately locate the root cause of the fault, and give repair references to shorten the mean time to repair (MTTR).

[0096] So far, the technical solution of the present invention has been described in conjunction with the preferred embodiments shown in the accompanying drawings. However, it is easy for those skilled in the art to understand that the protection scope of the present invention is obviously not limited to these specific embodiments. Without departing from the principle of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will fall within the protection scope of the present invention.

Claims

1. A monitoring fault analysis method integrating a multi-modal knowledge base, characterized in that, It includes the following steps: S1: Collect the original data of the monitoring fault log, preprocess it and store it; S2: Clean and extract features from the original data of the obtained monitoring fault log; S3: Build a retrievable knowledge base based on the cleaned data; S4: When the system triggers an alarm, perform hybrid retrieval on the knowledge base through a dynamic routing mechanism; S5: Aggregate multiple retrieval results feedback by the hybrid retrieval to generate an executable repair plan; S6: For the generated executable repair plan, iteratively optimize the decision-making process through manual feedback; S7: Through the iteratively optimized decision-making process of manual feedback, continuously optimize the knowledge base and the diagnostic model to form a closed-loop iterative mechanism.

2. The monitoring fault analysis method integrating a multi-modal knowledge base according to claim 1, wherein The data cleaning includes duplicate removal, noise removal and format standardization. The duplicate removal includes using the SimHash algorithm to remove duplicates from the original data of the monitoring fault log, and at the same time introducing a time window parameter, device context encoding and a dynamic similarity threshold. The introduction of the time window parameter includes segmenting the original data of the monitoring fault log by time window, and preferentially comparing the logs within the same window. The device context encoding includes adding hash bits of device ID and fault type in the improved SimHash algorithm. The dynamic similarity threshold includes dynamically adjusting the similarity threshold according to the type of the monitoring fault log. The noise removal includes filtering invalid monitoring fault log data, including null values, garbled characters, format errors, and values exceeding the normal range. The format standardization includes unifying the timestamp into the Unix millisecond format, mapping the error code to the standard coding table, and converting the unstructured monitoring fault log into a unified JSON format.

3. The monitoring fault analysis method integrating a multi-modal knowledge base according to claim 1, characterized in that, The feature extraction includes entity relationship extraction, data annotation and classification, and keyword extraction. The entity relationship extraction includes identifying the hardware model, operating system version and dependencies in the original data of the monitoring fault log after data cleaning based on the BiLSTM-CRF model; The data annotation and classification includes annotating the original data of the monitoring fault log after data cleaning, including fault type, fault level, trigger condition, device type, processing result, and whether it is the root cause; The keyword extraction includes using the TF-IDF algorithm to extract the preset ranked keywords in the original data of the monitoring fault log after data cleaning.

4. The monitoring fault analysis method integrating a multi-modal knowledge base according to claim 1, characterized in that, The partitioning methods for building the knowledge base include log BM25 index, vectorization index and knowledge graph-based index. The log BM25 index includes building an inverted index based on the keywords extracted by feature extraction according to the BM25 algorithm and storing it in slices according to the log type; The vectorization index includes, after segmenting the text, using the improved BGE-M3 model for vectorization, partitioning according to the device ID, and storing it in the FAISS vector library; The knowledge graph-based index includes dynamically partitioning subgraphs based on scenario labels and storing them in the Neo4j graph database in the form of triples.

5. The monitoring fault analysis method integrating a multimodal knowledge base according to claim 4, characterized in that, The improved BGE-M3 model includes: During training, sample and transfer negative samples in the knowledge base; Adjust the temperature parameter of the contrastive loss according to the text complexity τ = α· Entropy( D )+ β , where Entropy( D ) is the text information entropy, and α and β are configured according to requirements; After segmenting the long text, use hierarchical attention aggregation.

6. The monitoring fault analysis method integrating a multi-modal knowledge base according to claim 1, characterized in that The step S4 includes: Pre-trained fault classifier based on lightweight TextCNN model, and the fault classifier is used to output the probability of fault types; Obtain the monitored fault target data when the current alarm is triggered, including alarm information and device context; Input the monitored fault target data into the pre-trained fault classifier to output the probability of fault types; Judge the probability of fault types. If the highest probability is greater than 0.8, match the preset dynamic routing mechanism retrieval strategy. Otherwise, start hybrid retrieval.

7. The monitoring fault analysis method integrating a multi-modal knowledge base according to claim 6, characterized in that The preset dynamic routing mechanism retrieval strategy includes: For simple problems with clear error codes and standard solutions, directly query technical documents; For complex problems related to multiple devices and requiring reasoning, when it is specifically a device topology problem, use KG retrieval. When it is specifically a historical case dependency, use work order + log retrieval. When it is specifically a real-time diagnosis requirement, use monitoring + log retrieval; For unknown problems, use HyDE to generate hypothetical queries and adopt hybrid retrieval.

8. The monitoring fault analysis method integrating a multi-modal knowledge base according to claim 7, characterized in that, The hybrid retrieval includes: a. Combine the log timestamp and device topology to optimize the BM25 score, and retrieve candidate paragraphs with a preset ranking from the log BM25 index. The log timestamp is to downweight old logs through a time decay factor. =BM25(q,d)· , where =0.01, Δt is the difference between the current time and the log time. The device topology means that if there is a dependency relationship between the log device and the current faulty device, the score increases = + β· TopoLinkScore, where β =0.2 and TopoLinkScore is the device topology correlation degree. b. Use BGE-M3 to calculate the similarity between the Query and candidate paragraphs, and retain the data with the preset ranking; c. Load the fine-tuned MiniLM-L6-v2 model, perform weighted ranking using a cross-encoder that combines BM25 scores, vector similarity, and knowledge graph retrieval, and calculate the final score final_score = 0.2 bm25 + 0.3 cos_sim + 0.5 cross_score, and output data with a preset ranking.

9. The monitoring fault analysis method integrating a multi-modal knowledge base according to claim 1, characterized in that The step S5 includes: Dynamically calculate the weights of keyword retrieval, knowledge graph, and vector retrieval according to the problem type and context; Dynamically load the domain adaptation template, use the DeepSeek-32B model, and output the structured result.

10. The monitoring fault analysis method integrating a multi-modal knowledge base according to claim 9, wherein The dynamically calculating the weights of keyword retrieval, knowledge graph, and vector retrieval according to the problem type and context includes: Output the probability distribution of question types using a lightweight TextCNN model P = p 1, p 2,..., pn ; Calculate the weights of various retrieval types, keyword retrieval w BM25 = , knowledge graph w KG = , vector retrieval w Vector =1 - w BM25 - w KG , where is the probability of simple questions, is the probability of complex questions, and k = 2 is the adjustment coefficient.

Images