Abnormality diagnosis method and device, storage medium and program product

Abstract

The invention discloses an anomaly diagnosis method and device, a storage medium and a program product, and relates to the technical field of servers, through the anomaly diagnosis method and device, multi-modal fusion detection is carried out on multi-source and different-modal data, potential complex anomalies in the running state of a server can be more comprehensively captured, the probability of missing detection and misjudgment is reduced, and the reliability of the server is improved. A knowledge graph in the field of server maintenance is established based on a server maintenance document, knowledge association and graph reasoning rules of related information of the server are effectively established, and knowledge reasoning is performed based on the knowledge graph, so that potential semantic association among various entities of the server can be comprehensively analyzed; therefore, the diagnosis report not only indicates the fault, but also can provide detailed explanation and repair suggestions, and the accuracy and comprehensiveness of abnormality diagnosis are improved.

Description

Technical Field

[0001] The present application relates to the field of server technology, and in particular to abnormality diagnosis methods, devices, storage media, and program products. Background Art

[0002] As the core hardware of the information system, the stability of the server is an important factor affecting the business continuity of the information system.

[0003] In related technologies, anomaly diagnosis can be performed by collecting key performance indicators such as the server's central processing unit (CPU) utilization and memory usage. However, the accuracy of anomaly diagnosis in this method is relatively low. Summary of the Invention

[0004] This application provides an anomaly diagnosis method, device, storage medium, and program product to improve the accuracy of server anomaly diagnosis.

[0005] The present application provides an abnormality diagnosis method, comprising:

[0006] Obtain multimodal detection data of the device to be diagnosed;

[0007] Inputting the multimodal detection data into the first model to obtain abnormal conditions;

[0008] According to the abnormal situation and graph reasoning rules, the knowledge graph retrieval information corresponding to the abnormal situation is matched from the knowledge graph; the knowledge graph is constructed based on the maintenance documents of the equipment to be diagnosed; the graph reasoning rules are constructed based on the knowledge graph;

[0009] The abnormal situation and knowledge graph retrieval information are input into the second model to obtain the abnormality report.

[0010] The present application also provides an abnormality diagnosis device, comprising:

[0011] An acquisition module, used to acquire multimodal detection data of the device to be diagnosed;

[0012] An input module, configured to input the multimodal detection data into the first model to obtain abnormal conditions;

[0013] The matching module is used to match the knowledge graph corresponding to the abnormal situation from the knowledge graph based on the abnormal situation and the graph reasoning rules; the knowledge graph is constructed based on the maintenance documents of the equipment to be diagnosed; the graph reasoning rules are constructed based on the knowledge graph;

[0014] The input module is also used to input the abnormal situation and knowledge graph retrieval information into the second model to obtain an abnormality report.

[0015] The present application also provides an electronic device, comprising: a memory for storing a computer program; and a processor for implementing the steps of any of the above-mentioned abnormality diagnosis methods when executing the computer program.

[0016] The present application also provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the steps of any of the above-mentioned abnormality diagnosis methods are implemented.

[0017] The present application also provides a computer program product, including a computer program, which implements the steps of any of the above-mentioned abnormality diagnosis methods when executed by a processor.

[0018] Through this application, multimodal fusion detection of data from multiple sources and different modalities can be performed to more comprehensively capture potential complex anomalies in the server's operating status, reduce the probability of missed detection and misjudgment, and establish a knowledge graph in the field of server maintenance based on server maintenance documents, effectively establish knowledge associations and graph reasoning rules for server-related information. Knowledge reasoning based on the knowledge graph can ensure a comprehensive analysis of the potential semantic associations between various entities in the server, so that the diagnostic report not only points out the fault, but also provides detailed explanations and repair suggestions, thereby improving the accuracy and comprehensiveness of anomaly diagnosis. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0020] Figure 1 A schematic diagram of an application scenario of the abnormality diagnosis method provided in an embodiment of the present application;

[0021] Figure 2 Schematic diagram of the abnormality diagnosis method provided in the embodiment of the present application Figure 1 ;

[0022] Figure 3 Schematic diagram of the abnormality diagnosis method provided in the embodiment of the present application Figure 2 ;

[0023] Figure 4 A schematic diagram of the structure of an abnormality diagnosis device provided in an embodiment of the present application;

[0024] Figure 5 This is a schematic diagram of the structure of the electronic device provided in this application. DETAILED DESCRIPTION

[0025] The following will be combined with the accompanying drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0026] It should be noted that, in the description of this application, the terms "comprises," "includes," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. The terms "first," "second," etc., in this application are used to distinguish similar objects, and are not used to describe a particular order or sequence.

[0027] With the rapid development of internet technology and cloud computing, servers, as the core hardware supporting the operation of various information systems, play a vital role in business continuity and digital transformation through their stability and high availability. With the continuous improvement of hardware performance and the optimization of network environments, server management and anomaly detection technologies are also developing continuously, with significant progress in data collection and real-time monitoring, fault prediction, and automated diagnosis.

[0028] Related technologies collect key performance indicators (KPIs) from server operations (such as CPU utilization, memory usage, and network bandwidth), then use a Long Short-Term Memory (LSTM) autoencoder to extract features from this data. The difference between the two feature constructs is then used to determine server anomalies. The core of this technology is to use the encoder to automatically identify data features under normal conditions and detect deviations to generate anomaly alerts. This technology uses an autoencoder model to automatically learn and extract features from numerical data, effectively reducing manual intervention.

[0029] However, the performance indicators focused on in the above methods are only numerical indicators with a single data type, and the accuracy of abnormality diagnosis results is low.

[0030] In order to solve the above technical problems, the inventors of this application have found that in addition to numerical indicators, other information sources such as log texts and configuration files can also be tested to fully describe the server's operating status and improve the accuracy of abnormal diagnosis results. In addition, the inventors also found that the above method did not conduct sufficient semantic analysis of the relationship between the various components of the server, lacked an in-depth explanation of the cause of the abnormality, and affected the guidance and practicality of abnormal diagnosis. Therefore, a domain knowledge graph can be established based on the server's maintenance documents to effectively establish knowledge associations of server-related information, thereby improving the accuracy of abnormality detection and fault diagnosis. Based on this, an embodiment of the present application provides an abnormality diagnosis method.

[0031] In order to enable those skilled in the art to better understand the present application, the present application is further described in detail below with reference to the accompanying drawings and specific implementation methods.

[0032] In conjunction with the specific application environment architecture or specific hardware architecture on which the execution of the abnormality diagnosis method depends, the specific application environment architecture or specific hardware architecture is described here. Figure 1 , Figure 1 Schematic diagram of the application scenario of the abnormality diagnosis method provided in the embodiment of this application. Figure 1 As shown, the terminal device 101 is communicatively connected to multiple servers 102.

[0033] In a specific implementation, the terminal device 101 can first construct a knowledge graph based on the maintenance documents of the server 102, and then construct graph inference rules based on the knowledge graph. During the anomaly monitoring process, the terminal device 101 can obtain multimodal detection data from the server 102 in real time, input the multimodal detection data into the first model to obtain the anomaly, and then, based on the anomaly and graph inference rules, match the knowledge graph to obtain the knowledge graph retrieval information corresponding to the anomaly from the knowledge graph. The anomaly and the knowledge graph retrieval information are then input into the second model to obtain an anomaly report. The abnormality diagnosis method provided in the embodiment of the present application can more comprehensively capture potential complex abnormalities in the operating status of the server 102 by performing multimodal fusion detection on data from multiple sources and different modalities, reduce the probability of missed detection and misjudgment, and effectively establish knowledge associations and graph reasoning rules for information related to the server 102 by establishing a knowledge graph in the server 102 maintenance field based on the server 102 maintenance document. Knowledge reasoning based on the knowledge graph can ensure a comprehensive analysis of the potential semantic associations between various entities of the server 102, so that the diagnostic report not only points out the fault, but also provides detailed explanations and repair suggestions, thereby improving the accuracy and comprehensiveness of abnormality diagnosis.

[0034] Figure 2 Schematic diagram of the abnormality diagnosis method provided in the embodiment of the present application Figure 1 ,like Figure 2As shown, the embodiment of the present application provides an abnormality diagnosis method, which is described in detail as follows:

[0035] 201. Obtain multimodal detection data of a device to be diagnosed.

[0036] The execution subject of this embodiment may be a terminal device or a server.

[0037] In this embodiment, multimodal detection data can include sensor data such as ambient temperature and humidity, and power supply voltage, as well as text data such as hardware logs and configuration files. The device to be diagnosed can be a server or industrial equipment. Specifically, multimodal detection data can include sensor data (such as temperature, vibration, and pressure) from industrial equipment, as well as maintenance records and fault logs.

[0038] Specifically, multimodal detection data can be collected synchronously for the device to be diagnosed. For example, various detection data such as ambient temperature and humidity, power supply voltage, hardware logs, CPU utilization, memory usage, network latency, intrusion detection, etc. can be collected. In order to avoid misjudgment and improve the accuracy of abnormal diagnosis, the collection time of different data can be synchronized.

[0039] For example, when a hard drive is about to fail, the hardware layer can simultaneously capture error code 0x5A, the system layer's disk I / O latency soars to 500ms, and the environment layer's hard drive zone temperature reaches 65°C. The acquisition frequencies of different data sources vary significantly. Temperature sensors can collect data once a minute, while network latency can be collected once a second. Hardware logs are event-triggered. Therefore, it's possible to align multi-source detection data based on data acquisition timestamps using algorithms such as interpolation and padding.

[0040] 202. Input the multimodal detection data into the first model to obtain abnormal conditions.

[0041] Specifically, after obtaining the multimodal detection data, a machine learning model may be used to identify abnormal categories of the multimodal detection data to obtain abnormal situations corresponding to the multimodal detection data. The abnormal situations may include one or more abnormal categories.

[0042] Among them, the first model can be a deep learning model based on the transformer, which fuses multimodal detection data through a multi-head self-attention mechanism.

[0043] In some embodiments, inputting multimodal detection data into a first model to obtain abnormal conditions may include: performing data cleaning processing on the multimodal detection data to obtain cleaned detection data; the data cleaning processing includes at least one of the following: eliminating outliers and completing missing data; the cleaned detection data includes numerical data and text data; obtaining indicator features of the numerical data based on a preset time window; the characteristic indicators include at least one of the following: mean, standard deviation, maximum value, minimum value, and data change trend; using different indicator features of the numerical data as different components of the numerical feature vector to obtain a numerical feature vector of the numerical data; performing information extraction on the text data to obtain corresponding key information; determining a weight matrix of the key information based on the word frequency and inverse document frequency of the key information; performing dimensionality reduction processing on the weight matrix to obtain a text feature vector of the text data; concatenating the numerical feature vector and the text feature vector to obtain an input vector; inputting the input vector into the first model to identify abnormal categories to obtain the probabilities corresponding to multiple abnormal categories; and determining, among the multiple abnormal categories, an abnormal category with a probability greater than a preset abnormal threshold as an abnormal situation. The method provided in the embodiment of the present application cleans and extracts features from multimodal detection data, fuses the feature vectors of numerical and text data, and inputs them into the model for anomaly detection. This process improves data quality and the recognition ability of the model, ensuring the accuracy and efficiency of anomaly detection. By eliminating outliers, filling in missing data, and performing dimensionality reduction processing on text information, the model can more accurately identify anomalies and reduce the false alarm rate. Compared with using LSTM neural networks to judge anomalies in a single mode, it is less sensitive to abnormal data (such as irregular fluctuations or outlier noise), less likely to miss detection or misjudgment in complex anomaly patterns, and has a higher diagnostic accuracy rate.

[0044] Specifically, to improve data quality, multimodal data can be cleaned. For example, outliers can be identified and removed based on box plots to reduce the impact of extreme values on analysis. Missing monitoring data can be supplemented using interpolation to ensure data continuity and integrity.

[0045] After data cleaning is completed, feature extraction can be performed on the cleaned data. Multimodal detection data includes various data types, such as numerical data and text data such as hardware logs.

[0046] For numerical data, you can set a time window and perform multi-dimensional analysis on the data within the window to extract key features that reflect data patterns. For example, you can set a time window Tc and calculate the mean, standard deviation, maximum, and minimum values of numerical data within Tc (such as ambient temperature and humidity, network latency, etc.). You can also determine data trends by calculating the difference between adjacent data within the window. This solves the problem of high dimensionality and scattered information in original time series data.

[0047] Then, each numerical data indicator is mapped to a component in the numerical feature vector, thus constructing the numerical feature vector of the numerical data. For example, assuming there are n numerical indicators in the system, and each indicator extracts m features (such as the mean, standard deviation, etc., a total of 5), then the final numerical feature vector is a vector of length n×m, in the following form:

[0048] [T_mean, T_std, T_max, T_min, T_trend, D_mean, D_std, D_max, D_min,D_trend, ...]

[0049] For text data, we can first break the text data into independent tokens, retaining tokens with business value, such as error codes and information identifiers, and filter out meaningless characters (such as punctuation and common vocabulary) to reduce noise. We can then measure local importance based on the frequency of a token's appearance in a single log within the text data, known as word frequency. We can also measure global rarity based on the inverse of the frequency of a token's appearance across the text data (i.e., multiple logs), known as inverse document frequency. A weight matrix is determined based on word frequency and inverse document frequency. To remove redundant information from the weight matrix, we can perform dimensionality reduction on the weight matrix through a linear transformation. This involves projecting the original features into a lower-dimensional space to obtain the text feature vector for the text data.

[0050] After obtaining the numerical feature vector and the text feature vector, the numerical feature vector and the text feature vector can be concatenated into a complete feature vector X. A Transformer-based server anomaly analysis model y=Transformer(X) is constructed, and the feature vector X is input into the model for identification to obtain the anomaly probability y of different anomaly categories. A corresponding anomaly threshold can be set for each anomaly category, and all anomaly categories with an anomaly probability y exceeding the corresponding anomaly threshold are considered anomalies. By introducing a more advanced real-time fusion mechanism for multimodal data features, the Transformer model can be used to fuse the global features of multimodal data to alleviate the interference of noisy data; and timely respond to changes in the server environment, achieve fault prediction and rapid response, and greatly improve the efficiency of operation and maintenance management.

[0051] 203. According to the abnormal situation and graph reasoning rules, the knowledge graph retrieval information corresponding to the abnormal situation is matched from the knowledge graph; the knowledge graph is constructed based on the maintenance documents of the equipment to be diagnosed; the graph reasoning rules are constructed based on the knowledge graph.

[0052] Specifically, a knowledge graph can be pre-built based on relevant documentation, such as maintenance documents, for the device to be diagnosed (e.g., a server). Graph inference rules can then be constructed based on this knowledge graph. Graph inference rules represent the inference paths between various server entities. For example, if the CPU temperature is high and the hard drive error code is 0x5A, the inference path can be the path between the high CPU temperature and the hard drive. The knowledge graph can then be used to retrieve information showing that the hard drive failure rate for the same model increases by 300% at high temperatures, and that the error code 0x5A indicates a hard drive firmware defect. A diagnostic report can then be generated based on the large model. The report can document the root cause analyzed, such as a hard drive firmware defect causing heat dissipation anomalies, and the solution: immediately replace the hard drive (model: XXX).

[0053] The entities in the knowledge graph can include server components, equipment parts, operating principles, failure modes, and more. Optionally, industry standards and maintenance manuals can be used as data sources for the knowledge graph. To improve diagnostic accuracy, the knowledge graph can also be dynamically updated using real-time monitoring data.

[0054] In some embodiments, based on the abnormal situation and the graph reasoning rules, the knowledge graph retrieval information corresponding to the abnormal situation is matched from the knowledge graph, including: determining the vector representation of the abnormal situation; matching and obtaining candidate entities from multiple entities based on the vector representation of the abnormal situation; matching and obtaining candidate reasoning rules from the graph reasoning rules based on the vector representation of the abnormal situation; filling the candidate entities into the placeholders in the candidate reasoning rules, querying the knowledge graph, and obtaining knowledge graph retrieval information. The method provided in this embodiment achieves accurate information matching and efficient reasoning queries by combining the abnormal situation with the reasoning rules of the knowledge graph. By determining the vector representation of the abnormal situation, the system can quickly match related entities and reasoning rules in the knowledge graph, providing rich background information. This not only improves the accuracy and efficiency of retrieval, but also supports dynamic adaptation to different abnormality types, expands the capabilities of the knowledge base, and provides strong data support for decision-making.

[0055] For example, after identifying an anomaly, a vector representation of the anomaly can be obtained by calling a vector model. For each anomaly category in the anomaly, the vector distance between the anomaly category and each entity in the vector library (including the vector representation of each entity in the knowledge graph) is calculated using cosine similarity, and the vector distances are sorted. Entities Ent_sim with similarity greater than a threshold value Sim_ex are selected.

[0056] Graph inference rules include an inference rule head and an inference rule body. For each anomaly category in the abnormal situation, the vector distance between the anomaly category and each inference rule head is calculated from the vector library using cosine similarity, and the graph inference rule Rule_sim with a similarity greater than the threshold Sim_rx is selected;

[0057] The entities in the similar entity Ent_sim are filled into the placeholders of the graph inference rule Rule_sim. Based on the filled graph inference rule, the query result is queried from the knowledge graph to obtain the query result. This query result can be used as knowledge graph retrieval information. To reduce the amount of computation, the query result can also be deduplicated based on the matched entities and inference rules to obtain the knowledge graph retrieval information Cont_kg.

[0058] 204. Input the abnormal situation and the knowledge graph retrieval information into the second model to obtain an abnormality report.

[0059] Specifically, after obtaining the abnormal situation and obtaining knowledge graph retrieval information from the knowledge graph based on the abnormal situation and graph reasoning rules, the abnormal situation and knowledge graph information can be input into the second model. With the help of the knowledge association of server-related information in the knowledge graph, a comprehensive and accurate abnormal diagnosis report can be generated to reflect the current abnormality and the possible failures that may occur next.

[0060] The second model may be a Large Language Model (LLM).

[0061] For example, the abnormal situation and knowledge graph retrieval information Cont_kg can be formatted and then filled into a preset prompt template (which can include placeholders for the abnormal situation, knowledge graph retrieval information, root cause diagnosis, and treatment suggestions). That is, the abnormal situation and knowledge graph retrieval information Cont_kg replace the reserved placeholders in the prompt template. Using the large language model LLM, an abnormality diagnosis report is generated based on the prompt template, and the generated root cause and treatment suggestions are filled into the prompt template. Based on the large language model, a domain knowledge graph is constructed and knowledge reasoning is performed to ensure a comprehensive analysis of the potential semantic associations between various entities on the server, so that the diagnosis report not only points out the fault but also provides detailed explanations and repair suggestions.

[0062] The abnormality diagnosis method provided in the embodiment of the present application can more comprehensively capture potential complex abnormalities in the server operation status by performing multimodal fusion detection on data from multiple sources and different modalities, reduce the probability of missed detection and misjudgment, and effectively establish knowledge associations and graph reasoning rules for server-related information by establishing a knowledge graph in the server maintenance field based on server maintenance documents. Knowledge reasoning based on the knowledge graph can ensure a comprehensive analysis of the potential semantic associations between various entities of the server, so that the diagnostic report not only points out the fault, but also provides detailed explanations and repair suggestions, thereby improving the accuracy and comprehensiveness of abnormality diagnosis.

[0063] Figure 3Schematic diagram of the abnormality diagnosis method provided in the embodiment of the present application Figure 2 ,like Figure 3 As shown, the construction process of the knowledge graph is exemplarily introduced in the embodiment of this application. The method is as follows:

[0064] 301. Obtain maintenance documents for the equipment to be diagnosed and construct a knowledge graph based on the maintenance documents.

[0065] Specifically, different types of maintenance documentation required for server maintenance can be obtained, such as hardware manuals, standard operating procedures (SOPs), configuration lists, and troubleshooting documentation for the device being diagnosed (e.g., a server). Different extraction techniques can then be used to extract knowledge from different types of maintenance documentation. For example, table parsing can be used to memorize entity knowledge in hardware manuals, while process mining techniques can be used to extract event relationships from maintenance SOPs.

[0066] In some embodiments, constructing a knowledge graph based on maintenance documents includes: segmenting the maintenance documents to obtain multiple target text blocks; performing knowledge extraction on the multiple target text blocks to obtain multiple entities and multiple entity relationships; and constructing a knowledge graph based on the multiple entities and multiple entity relationships. The method provided in this embodiment significantly improves operational efficiency and decision-making accuracy by constructing a knowledge graph through segmentation and knowledge extraction.

[0067] For example, documents of various formats within the maintenance document can be parsed and cleaned. For example, an application programming interface (API) can be used to parse and clean text from files. Specifically, in a file conversion module, documents of different formats can be passed to a file parsing interface based on a multimodal large model to obtain document content in Hypertext Markup Language (HTML) format parsed by the model. Furthermore, to remove redundant text, the parsed document content can be converted to Markdown format for efficiency, compatibility, and processability, and nearly duplicate or redundant text can be removed.

[0068] After you have a long text in Markdown format, you can divide it into shorter sub-text blocks.

[0069] In some embodiments, a maintenance document is segmented to obtain a plurality of target text blocks, including: based on preset breakpoints, the maintenance document is split into a plurality of initial text blocks; the preset breakpoints include at least one of the following: a title, a quote, a list, a line break, and a blank line; the number of characters in the plurality of initial text blocks is determined; for each initial text block, if the number of characters in the initial text block is greater than a preset value, a plurality of sentence breakpoints of the initial text block are obtained; a first position in the initial text block that is a preset value away from the starting character is determined; a first sentence breakpoint that is before the first position and closest to the first position is determined from the plurality of sentence breakpoints; the initial text block is cut off at the position of the first sentence breakpoint, and the first The text before the position of the sentence breakpoint is determined as the target text block; if the number of characters of the remaining text of the initial text block after the first sentence breakpoint is greater than a preset value, the second position of the remaining text that reaches the preset value from the starting character is repeatedly determined, and a second sentence breakpoint that is before the second position and closest to the second position is determined from multiple sentence breakpoints. The remaining text block is cut at the position of the second sentence breakpoint, and the text before the position of the second sentence breakpoint is determined as the target text block until the number of characters of the remaining text after the second sentence breakpoint is less than or equal to the preset value; if the number of characters of the initial text block is less than or equal to the preset value, the initial text block is determined as the target text block. The method provided in this embodiment significantly improves the readability and processing efficiency of the document by segmenting the maintenance document into multiple target text blocks. By performing intelligent segmentation based on preset breakpoints, the logical integrity and semantic coherence of the text blocks are ensured, and information loss is avoided. At the same time, this method enhances the flexibility and adaptability of the document, supports subsequent automated analysis and information retrieval, and improves the user experience and the accuracy of information processing.

[0070] Specifically, the maximum character length of each text block can be defined as C; the structural elements in the Markdown format (such as titles, quotes, lists, etc.) are used as potential natural breakpoints; the document content is preliminarily divided into paragraphs or small text blocks TB according to the text's line breaks, blank lines or natural breakpoints; the number of characters in each preliminarily split text block TBi is calculated, recorded as Len_i; it is determined whether each text block TBi meets the condition of character length Len_i≤C; if so, the text block is kept unchanged and can be used as the target text block; if not, the text block TBi can be further segmented to obtain subdivided text blocks with a length less than the maximum character length C, and then these subdivided text blocks can be used as target text blocks.

[0071] For example, during the refined block processing, a text block TBi with a character length Len_i exceeding C can be further segmented based on sentence breakpoints. For a text block TBi with a character length Len_i exceeding C, a position Pos_c with a distance of C from the start of the processing block is found. The nearest sentence-level breakpoint Pos_tb (such as a period, exclamation mark, etc.) is found before Pos_c. The block is cut off at Pos_tb, and this block is used as the new starting point to traverse the entire TBi until all sub-blocks separated from the block do not exceed the maximum length C.

[0072] To maintain the integrity of the Markdown format, you can add missing Markdown symbols to text where the formatting is broken.

[0073] After completing the text segmentation process, knowledge extraction can be performed on the multiple target text blocks obtained through segmentation based on a large language model (LLM).

[0074] In some embodiments, knowledge extraction is performed on multiple target text blocks to obtain multiple entities and multiple entity relationships, including: for each target text block, the target text block is filled into a first preset prompt board, and knowledge extraction is performed on the target text block based on the first preset prompt board through a third model to obtain the entities and entity relationships corresponding to the target text block. In this embodiment, by performing knowledge extraction on the target text block, the third model and the preset prompt board are used to automatically identify and extract entities and entity relationships in the text. This process improves the efficiency and accuracy of knowledge extraction, converts unstructured information into structured data, and facilitates subsequent analysis and management.

[0075] The third model may be a large language model (LLM).

[0076] For example, a prompt template specifically for extracting entities in the server maintenance field (such as hardware nouns, professional terms, and organization names) and their relationships can be created, and placeholders can be used to represent text blocks; the text blocks TBi are filled into the prompt template; the LLM is allowed to extract the entity set Ei and relationship set Ri of each text block according to the prompt template, and record the mapping between the entity and the text block index; the entities and relationships extracted from each text block are fused and represented as a knowledge graph.

[0077] In some embodiments, a knowledge graph is constructed based on multiple entities and multiple entity relationships, including: deduplicating multiple entities corresponding to multiple target text blocks to obtain an entity set; determining the text block index corresponding to each entity in the entity set based on the multiple target text blocks, deduplicating entities that appear repeatedly in the text block index to obtain a text block index set; clustering the entity relationships corresponding to the multiple target text blocks to obtain multiple categories; for each category, determining the entity relationship with the highest frequency of use under the category as the entity relationship corresponding to the category; determining an entity relationship set based on the entity relationships corresponding to the multiple categories; and constructing a knowledge graph using the entities in the entity set as nodes, the entity relationships in the entity relationship set as edges, and the text block indexes in the text block index set as attributes of the corresponding entities. In this embodiment, multiple entities and entity relationships are integrated into a structured knowledge graph through deduplication and clustering. The graph uses entities as nodes, relationships as edges, and combines text block indexes as attributes to provide a clear and efficient way to express information. This not only improves the accuracy and relevance of data, but also supports dynamic updates to ensure the timeliness of information.

[0078] Specifically, we can first summarize the entity sets of each text block, deduplicate the entities therein, ensure the uniqueness of each entity, and obtain the final entity set E. At the same time, summarize the text block indexes involved in duplicate entities and deduplicate the duplicate entities in the text block indexes; summarize the entity relationship set R0 of each text block; obtain the vector representation of each relationship in R0 by calling the vector model, and cluster R0 based on the vector representation of the relationship in R0 using DBSCAN. In the obtained relationship cluster Cl_r, the most frequently used relationship Ri represents the relationship of the cluster category, and the final relationship set R is obtained; thus, we can use each entity in entity E as a node, the text block index mapped by each entity as the entity's attribute, and the relationships in the set R as the edge to construct a knowledge graph.

[0079] For the convenience of subsequent use, the vector representation of each entity and text block can be obtained by calling the vector model and stored in the vector library.

[0080] 302. Construct graph reasoning rules based on the knowledge graph.

[0081] Specifically, we can manually analyze the knowledge graph to determine the entities and their relationships in the graph that can trigger reasoning; describe the rules in natural language, expressed as rule headers; write corresponding graph query statements, and use placeholders to represent dynamically changing entities, expressed as rule bodies.

[0082] 303. Obtain multimodal detection data of the device to be diagnosed.

[0083] 304. Input the multimodal detection data into the first model to obtain abnormal conditions.

[0084] 305. According to the abnormal situation and graph reasoning rules, the knowledge graph retrieval information corresponding to the abnormal situation is matched from the knowledge graph.

[0085] Steps 303 to 305 in this embodiment are similar to steps 201 to 203 in the above embodiment, and are not described again here.

[0086] 306. According to the abnormal situation, text block retrieval information is obtained by matching from multiple target text blocks.

[0087] Specifically, the multiple target text blocks obtained by maintaining document splitting record more complete information and can supplement the knowledge graph retrieval information. Therefore, based on the entities associated with the abnormal situation, multiple text blocks containing the associated entities can be matched to form text block retrieval information to assist in generating more accurate and comprehensive abnormality diagnosis reports.

[0088] In some embodiments, based on the abnormal situation, text block retrieval information is obtained by matching from multiple target text blocks, including: obtaining the text block index corresponding to the candidate entity; determining the candidate text block based on the text block index; and determining the text block index information based on the vector representation of the abnormal situation and the vector representation of the candidate text block.

[0089] Exemplarily, the text block index of each relevant entity matched with the abnormal situation can be obtained; the text block index of each relevant entity of the abnormal situation is summarized and deduplicated, and the top k text blocks Top-k are screened out based on the deduplicated text block index and the vector similarity between the abnormal situation and the target text block; the text block retrieval information Cont_tb is determined based on the top k target text blocks.

[0090] 307. Input the abnormal situation, knowledge graph retrieval information, and text block retrieval information into the second model to obtain an abnormality report.

[0091] Specifically, the step exception, knowledge graph retrieval information (Cont_kg), and text block retrieval information (Cont_tb) can be formatted and then populated into a preset prompt template. This replaces the placeholders in the prompt template with the exception and knowledge graph retrieval information (Cont_kg). Using the Large Language Model (LLM), an exception diagnosis report is generated based on the prompt template. The exception diagnosis report can include a root cause diagnosis and treatment suggestions generated based on the knowledge graph retrieval information, text block retrieval information, and the exception.

[0092] The method provided in the embodiment of the present application collects data from multiple sources (including numerical monitoring data, text logs, operation and maintenance documents, etc.) and implements deep feature extraction through a multimodal fusion algorithm based on the Transformer model to ensure the comprehensiveness and accuracy of anomaly detection; by segmenting, extracting and fusing server maintenance documents, a knowledge graph covering multi-level entities and relationships such as hardware, software, network and operation and maintenance organizations is constructed, and the semantic relationships contained in the knowledge graph are used to construct fault cause inference rules, and the anomaly detection results are efficiently matched with the entities and inference rules in the knowledge graph, thereby realizing closed-loop processing from data to knowledge and from knowledge to diagnosis.

[0093] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus the necessary general hardware platform, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method.

[0094] Figure 4 This is a schematic diagram of the structure of the abnormality diagnosis device provided in the embodiment of the present application. Figure 4 As shown, an embodiment of the present application further provides an abnormality diagnosis device, including.

[0095] The acquisition module 401 is used to acquire multimodal detection data of the device to be diagnosed.

[0096] The input module 402 is used to input the multimodal detection data into the first model to obtain abnormal conditions.

[0097] Matching module 403 is used to match the knowledge graph retrieval information corresponding to the abnormal situation from the knowledge graph based on the abnormal situation and graph reasoning rules; the knowledge graph is constructed based on the maintenance documents of the equipment to be diagnosed; and the graph reasoning rules are constructed based on the knowledge graph.

[0098] The input module 402 is also used to input the abnormal situation and knowledge graph retrieval information into the second model to obtain an abnormality report.

[0099] In some embodiments, the input module 402 is specifically used to: perform data cleaning processing on the multimodal detection data to obtain cleaned detection data; the data cleaning processing includes at least one of the following: eliminating outliers and filling in missing data; the cleaned detection data includes numerical data and text data; based on a preset time window, obtaining indicator characteristics of the numerical data; the characteristic indicators include at least one of the following: mean, standard deviation, maximum value, minimum value, and data change trend; using different indicator characteristics of the numerical data as different components of the numerical feature vector to obtain the numerical feature vector of the numerical data; performing information extraction on the text data to obtain corresponding key information; determining the weight matrix of the key information based on the word frequency and inverse document frequency of the key information; performing dimensionality reduction processing on the weight matrix to obtain the text feature vector of the text data; splicing the numerical feature vector and the text feature vector to obtain the input vector; inputting the input vector into the first model to identify the abnormal category to obtain the probabilities corresponding to multiple abnormal categories; determining the abnormal category with a probability greater than the preset abnormal threshold among the multiple abnormal categories as an abnormal situation.

[0100] In some embodiments, the matching module 403 is specifically used to: determine the vector representation of the abnormal situation; match and obtain candidate entities from multiple entities based on the vector representation of the abnormal situation; match and obtain candidate reasoning rules from graph reasoning rules based on the vector representation of the abnormal situation; fill the candidate entities into the placeholders in the candidate reasoning rules, query the knowledge graph, and obtain knowledge graph retrieval information.

[0101] In some embodiments, the matching module 403 is also used to: match and obtain text block retrieval information from multiple target text blocks based on the abnormal situation; the multiple text blocks are determined based on the maintenance documents; the input module 402 is also used to: input the abnormal situation, knowledge graph retrieval information and text block retrieval information into the second model to obtain an abnormality report.

[0102] In some embodiments, the matching module 403 is specifically used to: obtain the text block index corresponding to the candidate entity; determine the candidate text block based on the text block index; and determine the text block index information based on the vector representation of the abnormal situation and the vector representation of the candidate text block.

[0103] In some embodiments, the acquisition module 401 is also used to: obtain maintenance documents of the equipment to be diagnosed; perform block processing on the maintenance documents to obtain multiple target text blocks; perform knowledge extraction on the multiple target text blocks to obtain multiple entities and multiple entity relationships; construct a knowledge graph based on the multiple entities and multiple entity relationships; and construct graph inference rules based on the knowledge graph.

[0104] In some embodiments, the acquisition module 401 is specifically used to: deduplicate multiple entities corresponding to multiple target text blocks to obtain an entity set; determine the text block index corresponding to each entity in the entity set based on the multiple target text blocks, deduplicate entities that appear repeatedly in the text block index, and obtain a text block index set; cluster the entity relationships corresponding to the multiple target text blocks to obtain multiple categories; for each category, determine the entity relationship with the highest frequency of use under the category as the entity relationship corresponding to the category; determine the entity relationship set based on the entity relationships corresponding to the multiple categories; construct a knowledge graph with the entities in the entity set as nodes, the entity relationships in the entity relationship set as edges, and the text block indexes in the text block index set as attributes of the corresponding entities.

[0105] For the description of the features in the embodiment corresponding to the abnormality diagnosis device, please refer to the relevant description of the embodiment corresponding to the abnormality diagnosis method, and will not be repeated here.

[0106] Figure 5 This is a schematic diagram of the structure of the electronic device provided in this application. Figure 5 As shown, the electronic device 50 provided in this embodiment includes: at least one processor 501 and a memory 502. Optionally, the electronic device 50 further includes a communication component 503. The processor 501, the memory 502 and the communication component 503 are connected via a bus.

[0107] During the specific implementation process, at least one processor 501 executes the computer-executable instructions stored in the memory 502 , so that the at least one processor 501 executes the above-mentioned abnormality diagnosis method embodiment.

[0108] The specific implementation process of the processor 501 can be found in the above method embodiment. Its implementation principle and technical effects are similar and will not be repeated here in this embodiment.

[0109] In the above embodiments, it should be understood that the processor may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the application may be directly executed by a hardware processor or by a combination of hardware and software modules within the processor.

[0110] The memory may include random access memory (RAM) and may also include non-volatile memory (NVM), such as at least one disk storage.

[0111] A bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus. Buses can be categorized as address buses, data buses, and control buses. For ease of illustration, the buses in the drawings of this application are not limited to just one bus or just one type of bus.

[0112] An embodiment of the present application further provides a computer-readable storage medium, in which a computer program is stored, wherein the computer program is configured to execute the steps of any one of the above-mentioned XX method embodiments when run.

[0113] In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to, various media that can store computer programs, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk, or an optical disk.

[0114] An embodiment of the present application further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the steps in any of the above-mentioned abnormality diagnosis method embodiments are implemented.

[0115] An embodiment of the present application further provides another computer program product, including a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of any of the above-mentioned abnormality diagnosis method embodiments are implemented.

[0116] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0117] The above is a detailed introduction to the abnormality diagnosis method provided by the present application. Specific examples are used herein to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only intended to help understand the method and core concept of the present application. It should be noted that, for those skilled in the art, without departing from the principles of the present application, several improvements and modifications can be made to the present application, and these improvements and modifications also fall within the scope of protection of the claims of the present application.

Claims

1. A method for abnormality diagnosis, characterized in that: include: Obtain multimodal detection data of the device to be diagnosed; Inputting the multimodal detection data into a first model to obtain abnormal conditions; According to the abnormal situation and graph inference rules, matching the knowledge graph to obtain the knowledge graph retrieval information corresponding to the abnormal situation from the knowledge graph; The knowledge graph is constructed based on the maintenance document of the device to be diagnosed; the graph inference rule is constructed based on the knowledge graph; The abnormal situation and the knowledge graph retrieval information are input into the second model to obtain an abnormality report.

2. The abnormality diagnosis method according to claim 1, characterized in that: Inputting the multimodal detection data into a first model to obtain an abnormality includes: Performing data cleaning on the multimodal detection data to obtain cleaned detection data; the data cleaning includes at least one of: removing outliers and completing missing data; the cleaned detection data includes numerical data and text data; Based on a preset time window, obtain the indicator characteristics of the numerical data; the characteristic indicators include at least one of the following: mean, standard deviation, maximum value, minimum value, and data change trend; Using different indicator features of the numerical data as different components of a numerical feature vector to obtain a numerical feature vector of the numerical data; Extracting information from the text data to obtain corresponding key information; Determining a weight matrix of the key information according to the word frequency and inverse document frequency of the key information; Performing dimensionality reduction processing on the weight matrix to obtain a text feature vector of the text data; Concatenate the numerical feature vector and the text feature vector to obtain an input vector; Inputting the input vector into the first model to identify the abnormal category and obtain the probabilities corresponding to the multiple abnormal categories; Among the multiple abnormal categories, an abnormal category with a probability greater than a preset abnormal threshold is determined as an abnormal situation.

3. The abnormality diagnosis method according to claim 1, characterized in that: The step of matching and obtaining knowledge graph retrieval information corresponding to the abnormal situation from the knowledge graph according to the abnormal situation and the graph inference rule includes: determining a vector representation of the abnormal condition; According to the vector representation of the abnormal situation, matching and obtaining a candidate entity from multiple entities in the knowledge graph; According to the vector representation of the abnormal situation, matching and obtaining candidate inference rules from the graph inference rules; Fill the candidate entity into the placeholder in the candidate inference rule, query the knowledge graph, and obtain the knowledge graph retrieval information.

4. The abnormality diagnosis method according to claim 1, characterized in that: The method further comprises: According to the abnormal situation, matching is performed from a plurality of target text blocks to obtain text block retrieval information; the plurality of text blocks are determined according to the maintenance document; Accordingly, the abnormal situation and the knowledge graph retrieval information are input into the second model to obtain an abnormality report, including: The abnormal situation, the knowledge graph retrieval information and the text block retrieval information are input into the second model to obtain an abnormality report.

5. The abnormality diagnosis method according to claim 4, characterized in that: The step of matching and obtaining text block retrieval information from a plurality of target text blocks according to the abnormal situation includes: Obtaining the text block index corresponding to the candidate entity matching the abnormal situation; Determining a candidate text block according to the text block index; The text block index information is determined according to the vector representation of the abnormal situation and the vector representation of the candidate text block.

6. The abnormality diagnosis method according to any one of claims 1 to 5, characterized in that: The method further comprises: Obtaining maintenance documents of the device to be diagnosed; Performing block processing on the maintenance document to obtain multiple target text blocks; Performing knowledge extraction on the plurality of target text blocks to obtain a plurality of entities and a plurality of entity relationships; Constructing a knowledge graph based on the plurality of entities and the plurality of entity relationships; Construct graph inference rules based on the knowledge graph.

7. The abnormality diagnosis method according to claim 6, characterized in that: The step of constructing a knowledge graph based on the plurality of entities and the plurality of entity relationships includes: Deduplication is performed on multiple entities corresponding to the multiple target text blocks to obtain an entity set; Determining, based on the plurality of target text blocks, a text block index corresponding to each entity in the entity set, and removing duplicate entities in the text block index to obtain a text block index set; Clustering entity relationships corresponding to a plurality of target text blocks to obtain a plurality of categories; For each of the categories, determining the entity relationship with the highest frequency of use under the category as the entity relationship corresponding to the category; Determine an entity relationship set according to the entity relationships corresponding to the plurality of categories; A knowledge graph is constructed with the entities in the entity set as nodes, the entity relationships in the entity relationship set as edges, and the text block indexes in the text block index set as attributes of the corresponding entities.

8. An electronic device, characterized in that: include: memory for storing computer programs; A processor, configured to implement the steps of the abnormality diagnosis method according to any one of claims 1 to 7 when executing the computer program.

9. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, wherein when the computer program is executed by a processor, the steps of the abnormality diagnosis method according to any one of claims 1 to 7 are implemented.

10. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the abnormality diagnosis method according to any one of claims 1 to 7 are implemented.

Images