LLM large model-based operation and maintenance knowledge intelligent question and answer interaction method, apparatus and device

Abstract

The invention discloses an operation and maintenance knowledge intelligent question and answer interaction method, device and equipment based on an LLM large model. According to the method, questions of operation and maintenance personnel are received through a natural language interaction interface, semantics are analyzed through a pre-trained LLM, candidate answers are generated, the accuracy of the answers is verified in combination with a dynamic operation and maintenance knowledge graph (including equipment model and fault code mapping, a historical case library and a real-time updating knowledge base), and finally a verification result is returned. The device comprises an input module, a processing module, a verification module and an output module, the processing module integrates domain knowledge fine tuning and real-time data integration functions, and the verification module supports multi-source data fusion and confidence evaluation. The platform adopts a multi-tenant architecture, supports visual diagnosis, automatic equipment operation and knowledge use report generation, and ensures that data cannot be tampered through a block chain technology.

Description

Technical Field

[0001] The present invention relates to the field of computer software and information technology, and specifically to an intelligent question-answering system based on natural language processing (NLP) and operation and maintenance knowledge management, and more particularly to an operation and maintenance knowledge intelligent question-answering interactive method, device and equipment based on an LLM large model. Technical Background

[0002] With the development of natural language processing (NLP) technology, intelligent question-answering systems based on large models have been applied in various fields. For example, patent CN117633179A proposes an intelligent question-answering system for the railway industry. By fine-tuning the Qwen-7b model to build a vector database, it achieves automatic knowledge updates. Patent CN117874202A uses anisotropic disambiguation and attention interaction techniques to improve the accuracy of question-answering. Patent CN118039057B builds a multimodal large model to achieve intelligent interaction with home health service robots. Patent CN118194993A improves the intelligence level of digital campus question-answering through text vectorization and LLM models. Patent CN118332091A combines a multimodal vector database and word meaning matrix to optimize question-answering in ancient book knowledge bases.

[0003] However, existing technologies still have significant limitations in the field of operation and maintenance knowledge management:

[0004] The knowledge updating mechanism is rigid;

[0005] For example, patent CN117633179A relies on fine-tuning of instruction data sets, which makes it difficult to adapt to dynamic changes in equipment failure modes; patent CN118194993A processes campus data through text vectorization, but does not achieve real-time data integration, resulting in insufficient knowledge timeliness.

[0006] Insufficient multimodal support;

[0007] Patent CN117874202A only processes text data and cannot integrate multi-source information such as equipment monitoring logs and images; although patent CN118332091A constructs a multimodal vector database, it does not achieve deep collaboration of multimodal interaction.

[0008] Lack of real-time and automation capabilities;

[0009] Most existing systems are offline optimized (such as the home health service robot in patent CN118039057B), lack real-time data verification mechanisms, and are difficult to deal with sudden failure scenarios.

[0010] Weak ability to integrate cross-domain knowledge;

[0011] Patents CN117633179A and CN118194993A are both targeted at specific fields (railway, education), do not achieve cross-domain knowledge transfer, and cannot meet the needs of complex operation and maintenance scenarios.

[0012] The decision-making model lacks dynamic adjustment;

[0013] The similarity matching algorithm of patent CN117874202A relies on fixed weights, making it difficult to dynamically optimize the inference logic based on real-time data.

[0014] In response to the above pain points, the present invention proposes an intelligent question-answering system for operation and maintenance knowledge based on LLM. Through dynamic knowledge graph fusion, real-time data integration and multimodal interaction, it breaks through the limitations of traditional systems and realizes the intelligence and automation of operation and maintenance knowledge management. Summary of the Invention

[0015] The core principle of this invention is to combine the LLM model with the operation and maintenance knowledge graph. Through natural language processing technology, it can understand user questions and generate answers, and use the knowledge graph to verify and optimize the answers. At the same time, a dynamic update mechanism is introduced to ensure the real-time and accuracy of the knowledge graph.

[0016] The following is a detailed description of several aspects:

[0017] On the one hand, in an embodiment of an intelligent question-answering method based on LLM, the method flow provided by the present invention includes:

[0018] 1. Natural language interaction: The input layer receives natural language questions from operation and maintenance personnel. In actual operation and maintenance scenarios, operation and maintenance personnel may describe the problem in various ways, such as a detailed description of the equipment failure, and may mention abnormal sounds, indicator light status, data display abnormalities, and other information during equipment operation. The target detection model for image input is a YOLO series model (such as YOLOv5). The HSV color space is used to analyze the color ratio of the indicator light (such as the red indicator light accounts for 82%), and the OCR technology is combined to read the panel error code. The noise reduction processing of voice input uses the VAD noise reduction algorithm, and the speech-to-text conversion uses the CTC algorithm. After noise reduction, the speech recognition accuracy rate reaches 98% (such as the "NX5500 storage array IOPS drop" speech input-to-text case).

[0019] 2. Semantic Parsing and Candidate Answer Generation: The processing layer uses a pre-trained LLM model to parse the semantics of the question. The LLM model understands every word and sentence structure in the question input by the operator, identifying key information such as the device model and the fault symptom. For example, when the operator describes "Server A frequently crashes when running a large program," the LLM model can accurately identify the device as "Server A" and the fault symptom as "frequent crashes when running a large program." Based on these parsed results, the model draws on its extensive knowledge base to generate candidate answers. These candidate answers may be solutions based on previous similar cases or suggestions derived from relevant knowledge.

[0020] 3. Dynamic Knowledge Graph Verification: The verification layer uses a dynamic knowledge graph that includes device model and fault code mapping, a historical case library, and a real-time knowledge base. The dynamic knowledge graph is like a real-time updated "knowledge treasure house" that integrates multiple aspects of information. The device model and fault code mapping can help quickly locate possible fault causes, the historical case library records various previous faults and corresponding solutions, and the real-time knowledge base is updated based on the latest equipment operation data and industry knowledge. Through the multi-source data fusion engine, the system verifies the accuracy of candidate answers. The multi-source data fusion engine comprehensively considers various data sources and conducts a comprehensive evaluation and judgment of candidate answers.

[0021] 4. Confidence Assessment and Output: The confidence level of the answer is calculated using a confidence assessment algorithm. The confidence assessment algorithm acts like a "credibility evaluator," quantitatively assessing the credibility of the answer based on various factors. If the confidence level of the answer exceeds a threshold, it is directly output. This output is highly reliable and can provide an effective solution for operations personnel. If the confidence level falls below the threshold, manual review is triggered. Manual review acts as a "safety line" to ensure that if the system cannot determine the accuracy of the answer, professional operations personnel can make further judgments and take further action.

[0022] Formula 1: Confidence evaluation algorithm,

[0023] Among them, (ω i ): Data source weight (device model mapping 0.4, historical case 0.3, real-time knowledge base 0.3), set based on historical accuracy (device model mapping 70%) and data importance. (Score i): Match score for each data source (0-1), calculated based on exact match (device model), case similarity (historical cases, Apriori algorithm), and real-time data consistency (real-time knowledge base) (e.g., in the core switch case, device model match score = 0.9, historical case score = 0.75). RealTimeDataConsistency (δ): Real-time data consistency coefficient (0.1-0.5), measured using the Pearson correlation coefficient to measure the consistency of real-time data with historical failure patterns (e.g., δ = 0.4 when BGP session flapping is synchronized with CPU peaks).

[0024] For example, device model mapping is often directly linked to specific fault causes, so it carries a relatively high weight. Meanwhile, the real-time knowledge base reflects the latest device status and industry trends, and is also valuable as a reference. (δ) represents the real-time data consistency coefficient (ranging from 0.1 to 0.5), which measures the degree of match between the answer and the real-time device data. If the answer is highly consistent with the real-time data, the real-time data consistency coefficient increases, thereby increasing the confidence level of the answer.

[0025] On the other hand, the intelligent question-answering device and platform architecture, in one embodiment, the device modules interact as shown, and the modules cooperate with each other to jointly complete the processing task of intelligent question-answering.

[0026] Input module: Supports multimodal input via text, voice, and images. In practical applications, operators can choose different input methods based on their convenience. For example, in noisy environments, voice input may be more convenient; while for complex equipment failures, image input may provide a more intuitive understanding of the problem. The input module meets the input needs of different users in different scenarios.

[0027] Processing module: Integrates the domain knowledge fine-tuning submodule and the real-time data integration submodule. The domain knowledge fine-tuning submodule performs supervised learning based on historical conversation data to enhance the model's understanding of domain terminology. For example, for specific O&M terms, such as "E101 fault code" corresponding to "sensor anomaly," through continuous learning and training, the model can more accurately understand and process these terms. The real-time data integration submodule acts as a "data bridge," integrating device monitoring data in real time and dynamically updating inference logic. For example, by combining real-time parameters such as device temperature and pressure, the model can modify fault diagnosis results to improve diagnostic accuracy.

[0028] Verification Module: Verifies answers using a multi-source data fusion engine and confidence assessment algorithms. If the confidence level falls below a threshold, manual review is triggered. The verification module rigorously verifies and evaluates the answers generated by the processing module to ensure the high reliability of the output answers.

[0029] Output module: Returns verification results or manually reviewed answers. The output module presents the verified or manually reviewed answers to operations personnel in a clear and understandable manner, facilitating subsequent troubleshooting.

[0030] Formula 2: LLM domain knowledge fine-tuning loss function,

[0031] L=λ·L supervised +(1-λ)·L reward , where (L supervised ) Based on the supervised loss of the domain corpus training of 12,000 pages of equipment manuals and 8,000 fault cases, by annotating the mapping relationship between "equipment model-fault code" (such as "NX5500→V2.1.3 firmware defect") and "professional terminology-standard expression" (such as "circuit breaker trip→overload protection"), the model is strengthened to accurately parse the operation and maintenance domain terminology, reducing errors such as "equipment model identification error" and "fault phenomenon misjudgment". (L reward ) dynamically adjusts model parameters based on real-time sensor data (such as abnormal UPS battery internal resistance and fluctuations in temperature sampling frequency). When a change in equipment failure mode is detected (such as a 20% increase in the failure rate of a certain UPS battery model), the weight of the relevant inference path is strengthened. If noisy data is detected (such as abnormal sensor fluctuations), the data quality filter automatically reduces the weight of this data source by 10%-20% to prevent invalid data from interfering with inference. (λ) is the balancing coefficient (default 0.7). The default value of 0.7 indicates that the priority is to accumulate domain knowledge in the supervised learning phase (accounting for 70% of the weight), ensuring that the model first masters basic operation and maintenance knowledge such as "equipment model and fault code mapping" and "historical case solution solutions" before optimizing the inference logic through real-time data (accounting for 30% of the weight).

[0032] Further innovative design:

[0033] 1. Dynamic knowledge graph update strategy;

[0034] Formula 3: Knowledge graph version number management,

[0035] Among them, (Δt i ) is the (i)th data update interval, which records the time from the last update to the current update. (T update ) is the preset update cycle (default 24 hours), which is a fixed time period set according to actual conditions and used to measure the frequency of data updates. i) is the importance weight of the updated data (e.g., failure case weight is 0.8, industry standard weight is 0.6). Different types of updated data have different importance. By setting weights, we can more reasonably reflect the impact of these data on the knowledge graph.

[0036] 2. Multi-tenant data isolation mechanism,

[0037] Formula 4: Multi-tenant data isolation mechanism, Among them, (AccessRisk i ) is the access risk score for the (i)th tenant (calculated based on permission level, operation frequency, etc.). Tenants with higher permission levels and more frequent operations are likely to have higher access risk scores. (MaxRisk) is the maximum access risk value, a preset upper limit used to measure the maximum level of tenant access risk. The closer (S) is to 1, the more secure the isolation. This safety factor can be used to intuitively assess the security of multi-tenant data isolation.

[0038] Other innovative designs:

[0039] 1.Automated execution interface;

[0040] Formula 5: Operation instruction parsing accuracy,

[0041] Where (CorrectCommands) is the number of correctly parsed commands, and (TotalCommands) is the total number of commands. This formula accurately measures the accuracy of the automated execution interface's parsing of commands.

[0042] 2. Blockchain evidence storage;

[0043] Formula 6:

[0044] (UpdateDate) is the knowledge update data, which contains the specific content of the knowledge graph update. (Timestamp) is the timestamp used to record the update time. (Nonce) is a random number used to increase the randomness and security of the hash value. This information is hashed using the SHA256 algorithm to generate a unique hash digest.

[0045] 3. Anomaly detection module;

[0046] In one embodiment, the anomaly detection module analyzes conversation history data to identify high-frequency problems and generate knowledge update suggestions. The core process is as follows: Conversation history analysis: extract key features from the conversation, including device model, fault phenomenon, solution, etc.; use the TFIDF algorithm to calculate term weights and identify high-frequency fault keywords (such as "power module fault" with a frequency exceeding the threshold). High-frequency problem identification: use the sliding window algorithm to count the problem distribution per unit time.

[0047] Formula 7:

[0048] Frequency(q)=TotalConversationsCount(q)×100%, if the frequency of a question exceeds a preset threshold (such as 20%), it is marked as a high-frequency question. Figure 13 ): Discover the relationship between high-frequency problems and solutions through association rule mining (such as the Apriori algorithm); generate structured suggestions (such as "It is recommended to add 'power module replacement steps' to the knowledge base") and push them to the knowledge graph update module.

[0049] Beneficial effects:

[0050] The series of innovative designs of the present invention have brought about significant beneficial effects in many aspects, comprehensively improving the efficiency, accuracy, security and intelligence level of operation and maintenance knowledge management, and have great advantages over traditional solutions.

[0051] 1. Dynamic knowledge update mechanism to solve the pain points of manual maintenance;

[0052] Traditional systems rely on manual updating of knowledge bases (e.g., patent CN109800310A requires manual triggering of queries), which results in data lag. Figure 3 ) and version number management mechanism to achieve incremental updates of the knowledge graph in seconds.

[0053] 2. LLM-driven intelligent interaction breaks through the limitations of static rules;

[0054] Traditional rule engines (such as patent CN201810490177.2) rely on keyword matching and cannot handle complex semantics. This invention uses domain knowledge fine-tuning and contextual tag management to enable the LLM model to deeply understand operation and maintenance terminology (such as "E101 fault code" corresponds to "sensor anomaly") and support multi-round dialogue.

[0055] 3. Adaptive decision-making model to meet dynamic scenario requirements;

[0056] Static rule systems (such as patent CN117610854A) cannot adapt to changes in device status. The present invention integrates the real-time data consistency coefficient δ (0.10.5) through a confidence assessment algorithm to dynamically adjust the reasoning logic.

[0057] 4. Deep integration of multi-source data to break down data silos;

[0058] Traditional systems only process single text data (such as patent CN109800310A) and cannot integrate multimodal information such as images and logs. The present invention uses a multi-source data fusion engine (S23) to cross-validate the candidate answers generated by LLM with device monitoring data and image recognition results.

[0059] 5. Enhanced security and personalization to meet industry compliance requirements;

[0060] Traditional shared knowledge bases (such as patent CN202210010940.3) are subject to data leakage risks. This invention reduces the risk of customer data leakage through a multi-tenant data isolation architecture and blockchain evidence storage, and ensures that the knowledge update process is traceable.

[0061] Figures in the specification

[0062] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments of the present invention. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0063] Figure 1 This is a schematic diagram of the architecture flow of an LLM-based intelligent question-answering system for operation and maintenance knowledge in one embodiment of the present invention;

[0064] Figure 2 This is a schematic diagram of the dynamic knowledge graph verification process in one embodiment of the present invention;

[0065] Figure 3 This is a schematic diagram of the LLM domain knowledge fine-tuning process in one embodiment of the present invention;

[0066] Figure 4 This is a schematic diagram of the dynamic knowledge graph update process in one embodiment of the present invention;

[0067] Figure 5 This is a schematic diagram of the context tag management process in one embodiment of the present invention;

[0068] Figure 6 This is a schematic diagram of the interaction flow of modules of the intelligent question-answering device in one embodiment of the present invention;

[0069] Figure 71 is a flow chart of an answer confidence evaluation algorithm according to an embodiment of the present invention;

[0070] Figure 8 This is a flow chart of an intelligent question-answering platform in one embodiment of the present invention;

[0071] Figure 9 This is a schematic diagram of the process of generating a device status heat map in one embodiment of the present invention;

[0072] Figure 10 This is a schematic diagram of the automated execution interface process in one embodiment of the present invention;

[0073] Figure 11 This is a schematic diagram of a knowledge graph weight adjustment process based on user feedback in one embodiment of the present invention;

[0074] Figure 12 This is a schematic diagram of a multi-tenant data isolation architecture process in one embodiment of the present invention;

[0075] Figure 13 This is a schematic diagram of the data flow of the anomaly detection module in one embodiment of the present invention;

[0076] Figure 14 This is a schematic diagram of a multimodal interactive interface process in one embodiment of the present invention;

[0077] Figure 15 This is a schematic diagram of the blockchain knowledge update record process in one embodiment of the present invention. DETAILED DESCRIPTION

[0078] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0079] In one embodiment, as ( Figure 1 S01-S04, Figure 2 S05-S07, Figure 6 Middle S19-S22, Figure 9 S38-S40, Figure 14 As shown in S32-S34), the system uses the natural language interaction interface step S32 (reference Figure 14 ) Receive user input about the issue of "NX5500 storage array experiencing a sudden drop in IOPS at 3:00 AM every day" ( Figure 1 ,S01). Input module ( Figure 6 , S19) After converting the speech input into text, the environmental noise interference is removed through the preprocessing pipeline ( Figure 14, S34). Processing module ( Figure 6 , S20) activates the LLM model after fine-tuning domain knowledge ( Figure 3 , S09), the model has loaded a domain dataset containing 15,000 historical work orders ( Figure 3 , S08), identifies key features such as "IOPS drop", "scheduled tasks", and "firmware defects". LLM generates three candidate answers: "check RAID card firmware version", "review scheduled maintenance tasks", and "check hard disk backplane voltage" ( Figure 2 , S05). At this time, the verification module ( Figure 6 , S21) Start the multi-source verification process ( Figure 2 , S06): First, match the known firmware defect library of device model NX5500 (weight 0.4), and find that version V2.1.3 has a memory leak problem; secondly, search the historical case library (weight 0.3), and find 3 similar cases that all point to firmware upgrade solutions; finally, connect to the real-time monitoring system ( Figure 9 , S38), verify that the current firmware version is indeed V2.1.3 and the memory usage rate reaches 98% during the fault period.

[0080] Through formula 1:

[0081] Calculated confidence: 0.4×1.0 (exact match) + 0.3×0.9 (case matching) + 0.3×0.8 (real-time data consistency) = 0.91, far exceeding the threshold of 0.7. Output module ( Figure 6 , S22) returns a structured answer: "Immediately upgrade to V2.1.5 firmware. This must be performed during the maintenance window. Back up the configuration before upgrading ( Figure 8 , S51)". Preferably, the context tag management module ( Figure 5 , S29) synchronously record the device serial number, failure time pattern and solution hash value ( Figure 15 , S37), for subsequent automated upgrade operations ( Figure 10 , S17) provides a basis for tracing back to the source. Furthermore, the system triggers the automated execution interface ( Figure 10 ,S18), pre-generate a work order template containing the firmware download link and operation manual, and submit it directly to the device management system after confirmation by the operation and maintenance personnel.

[0082] In one embodiment, combining Figure 3 (S08-S10) fine-tuning mechanism, the system faces the challenge of insufficient domain knowledge during the cold start phase. Processing module ( Figure 6 , S20) first load the basic LLM model ( Figure 3 , S07), and then injected the operation and maintenance corpus covering six major fields such as power, communication, and data center ( Figure 3, S08), covering 12,000 pages of equipment manuals and 8,000 fault cases.

[0083] The domain knowledge fine-tuning submodule adopts a two-stage training strategy:

[0084] The first stage uses formula 2: L = λ·L supervised +(1-λ)·L reward , where the supervision loss (L supervised ), strengthen the mapping of professional terms such as "circuit breaker trip → overload protection" through comparative learning; the second stage introduces a real-time data reward mechanism (L reward ), when the failure rate of a certain type of UPS battery is monitored to rise abnormally, the weight of the relevant reasoning path is dynamically increased. Preferably, the progressive distillation technology is used in the fine-tuning process to convert the knowledge graph ( Figure 2 , the device topology relationship in S06) is encoded as an attention mask ( Figure 3 , S09), so that the model can automatically associate the physical relationship between the stacking cable specifications (SFP+28AWG) and signal attenuation when dealing with the "core switch stacking abnormality" problem. Furthermore, the real-time data integration submodule ( Figure 3 , S10) is designed with data quality filters ( Figure 4 , S26), when abnormal fluctuations in sensor data are detected (such as abnormal temperature sampling frequency), the weight coefficient δ of the data source is automatically reduced, which is calculated by Formula 1 to prevent noise data from interfering with the inference results.

[0085] On the other hand, in one embodiment, Figure 5 (S29-S31) and Figure 7 As shown in (S24), the system demonstrates context awareness when processing multiple rounds of complex conversations. When the user first asks "the temperature control system alarm in the computer room A3", the processing module ( Figure 6 , S20) generates the answer "check the refrigerant pressure of the precision air conditioner" (confidence 0.78). When the subsequent question "how to determine whether the compressor is damaged" is asked, the context tag management module ( Figure 5 , S29) extract the device identification tag "LiebertPEX4#07" and associate it with the knowledge graph ( Figure 2 , S06) in the failure mode library of this model (weight 0.6). Verification module ( Figure 6 , S21) synchronous access to real-time sensor network ( Figure 9 , S38), obtain the compressor current waveform data ( Figure 14 , S33), abnormal starting current was found through feature extraction ( Figure 14, S34). At this time, the confidence evaluation algorithm is calculated by formula 1 and the weight distribution is dynamically adjusted: the real-time data weight is increased from 0.3 to 0.5, and the historical case weight is reduced to 0.2, and the final calculated confidence is 0.83. Output module ( Figure 6 , S22) returns a multimodal answer: text instructions for "measuring the starting capacitor capacity", and a schematic diagram showing the comparison of normal and abnormal current waveforms ( Figure 9 , S39), and maintenance video link. Preferably, the system automatically generates preventive maintenance suggestions ( Figure 8 , S51), prompts the predicted value of the remaining life of the compressors of the same batch (calculated based on the LSTM model is 142 days).

[0086] In other embodiments, Figure 6 (S19-S22) and Figure 10 As shown in (S17-S18), the intelligent question-answering device realizes the closed-loop control function. When dealing with the problem of "frequent disconnection of network port optical module", the input module ( Figure 6 , S19) receiving an image containing the serial number of the SFP+ module ( Figure 14 , S33), optical character recognition submodule ( Figure 14 , S34) extracts the model information of "AXM763-50-31". Processing module ( Figure 6 , S20) query the compatibility database ( Figure 2 , S06), it was found that the module had a known compatibility issue with the switch's FWQ8923 chip (weight 0.7). Verification module ( Figure 6 , S21) combined with the CRC error count in the real-time log ( Figure 4 , S26), confirming that the fault feature matching degree reaches 92%. At this time, the system not only returns the suggestion of "replace compatible optical module" (confidence level 0.88), but also executes the fault feature through the automated execution interface ( Figure 10 , S17) Generate operation instructions with timing control: 1) Enter maintenance mode at 1:00 am; 2) Automatically issue a command to disable the port (CLI: interface shutdown); 3) Push the new module purchase list to the procurement system ( Figure 10 , S18).

[0087] It should also be noted that, in a preferred embodiment, Figure 2 (S06) and Figure 11 As shown in (S54-S55), the system implements dynamic optimization of the knowledge graph. When dealing with the problem of "UPS battery capacity decreasing too quickly", the initial answer "deep discharge maintenance every quarter" received multiple user feedback ( Figure 11 , S54), of which 82% were marked as "invalid". User behavior analysis module ( Figure 11, S55) Start the weight adjustment process: 1) Reduce the weight of the solution in the historical case library (from 0.3 to 0.15); 2) Increase the weight of the battery internal resistance detection indicator in the real-time monitoring data (from 0.2 to 0.35); 3) Add an ambient temperature association rule ( Figure 4 , S27), establishes the relationship edge "Room temperature > 25°C → Battery aging accelerates by 3 times." The next time a similar problem is handled, the system prioritizes "Install a constant-temperature cabinet and switch to gel batteries" (confidence level 0.79). This solution has been verified to have reduced the failure rate by 67% over six months. Preferably, calculation is performed through knowledge graph version management, using Formula 3:

[0088] During this process, the version number V2.1.7 is automatically generated, and the metadata including weight adjustment parameters, number of new rules, etc. is recorded. Figure 15 , S37). Furthermore, the multi-tenant isolation mechanism ( Figure 12 , S12) ensures that data updates of financial customers (such as battery safety standards) will not be leaked to manufacturing customers, through Formula 4:

[0089] The calculated data isolation coefficient S = 0.93, meeting ISO 27001 security requirements. S represents the data isolation coefficient, which measures the security of multi-tenant data isolation. The closer S is to 1, the more secure the isolation. K represents the number of tenants involved in the calculation.

[0090] In one embodiment, if Figure 2 (S06) and Figure 7 As shown in (S23-S24), the system implements cross-verification of complex faults through a multi-source data fusion engine. When dealing with the problem of "core switch CPU utilization periodically soaring to 95%", the processing module ( Figure 6 , S20) first generates two candidate answers: "check routing protocol oscillation" and "check DDoS attack" ( Figure 2 ,S05)Verification module ( Figure 6 , S21) starts the three-level verification process: first matching the known vulnerability library of device model Cisco Nexus 9508 ( Figure 2 , S06), found that the model has a memory leak defect in the OSPF protocol implementation (weight 0.4); secondly, search the historical case library ( Figure 2 , S06, weight 0.3), found 9 out of 12 similar cases were protocol configuration errors; finally connected to the NetFlow real-time traffic analysis system ( Figure 9 , S38), it is detected that the BGP session oscillation frequency is completely synchronized with the CPU peak value (δ=0.4).

[0091] The following formula 1 is used to calculate the confidence level: 0.4×0.9 (model matching) + 0.3×0.75 (case matching) + 0.3×0.85 (real-time data) × 1.4 (δ enhancement) = 0.89. Figure 7 , S23) Dynamically adjust the weight distribution strategy during this process - when the real-time data confidence exceeds 0.9 for 5 consecutive minutes, its weight is increased from 0.3 to 0.5 to ensure timely response to sudden traffic anomalies ( Figure 7 , S24). Furthermore, the system detects that BGP neighbors are frequently reset ( Figure 4 , S26), automatically triggering the knowledge graph ( Figure 2 , S06) and corrected the answer to "upgrade IOS XR7.3.2 and enable the Graceful Restart feature" (confidence 0.92). This process involves the collaborative analysis of 12 data sources, including SNMP trap logs ( Figure 14 , S33), traffic mirror data packet ( Figure 14 , S34) and device CLI configuration snapshots ( Figure 10 , S17).

[0092] In one embodiment, combining Figure 7 The confidence threshold mechanism (S24-S25) enables the system to demonstrate intelligent decision-making capabilities when processing edge scenarios. When the operation and maintenance personnel inquire about "the backup generator cannot switch automatically", the LLM generates the answer "check the ATS control module" (initial confidence level 0.68). Verification module ( Figure 6 , S21) detected the following contradiction: the knowledge graph ( Figure 2 In S06, there are 32 similar faults for this model of generator (weight 0.3), but the real-time sensor shows that the fuel pressure is normal (δ = 0.2). Using Formula 1, the final confidence level is calculated as 0.68 × (0.3 × 1.0 + 0.3 × 0.8 + 0.4 × 0.6) = 0.65.

[0093] Below the threshold of 0.7 triggers the manual review process ( Figure 7 During the review process, the expert found that LLM did not consider the logical changes of the new firmware and manually added the solution of "upgrading ATS firmware to V3.1.7" ( Figure 4 , S28). Preferably, the system activates a dual verification mechanism during this process: 1) Blockchain evidence module ( Figure 15 , S37) record the audit operation log throughout the process and generate an audit trail containing a timestamp and digital signature (Formula 6): 2) Multi-tenant isolation module ( Figure 12 , S12) ensures that the knowledge update is only pushed to the customer group using the same model of equipment (isolation coefficient S = 0.91).

[0094] It should also be noted that, in a preferred embodiment, Figure 10 (S17-S18) and Formula 5: As shown, the automated execution interface realizes the closed loop of operation and maintenance. When the system recommends "expanding the etcd node of the K8s cluster", the automation engine ( Figure 10 , S17) perform the following chain operations: 1) call Terraform to create three VMs (specifications: 8C16G); 2) deploy etcd3.5 binary files through Ansible; 3) configure SSL certificates ( Figure 10 , S18); 4) Perform cluster health check (timeout threshold 300 seconds). The whole process is calculated by formula 5 to calculate the instruction parsing accuracy: successful creation of VM (1 / 1), correct deployment version (1 / 1), correct certificate configuration (1 / 1), accuracy = 3 / 3 × 100% = 100%. Preferably, the system is designed with a rollback mechanism - when an abnormal etcd cluster heartbeat is detected ( Figure 4 , S26), automatically triggering the snapshot recovery process ( Figure 10 , S17), controlling the RPO within 15 seconds. Furthermore, the blockchain evidence module ( Figure 15 , S37) generates verifiable credentials (Formula 6) for each operation step, including: 1) VM creation timestamp; 2) AnsiblePlaybook hash value; 3) SSL certificate fingerprint. These credentials are synchronized to the audit system via the OAuth2.0 protocol ( Figure 8 , S51), meeting the compliance requirements of the financial industry.

[0095] In one embodiment, if Figure 12 (S12) and formula 4, as shown, the multi-tenant data isolation mechanism realizes enterprise-level security management and control. When financial customer A and manufacturing customer B access the platform at the same time, the user management module ( Figure 8 , S53) Create an independent knowledge base partition for each tenant ( Figure 12 , S12). The access control engine calculates tenant risk scores in real time: Customer A is involved in the core transaction system, so the permission level is set to P3 (AccessRisk_i = 0.15), and Customer B is in the R&D and testing environment, so the permission level is set to P1 (AccessRisk_i = 0.35). Using Formula 4, the isolation coefficient S = (1-0.15 / 0.5) × (1-0.35 / 0.5) = 0.85 × 0.3 = 0.255 is calculated, triggering the strict isolation policy - Customer A's knowledge update record ( Figure 4 , S28) uses AES-256 encryption for storage ( Figure 15 , S37), while client B's data is only BASE64 encoded.

[0096] In one embodiment, combining Figure 11 The feedback mechanism of (S54-S55) enables the system to realize self-optimization of the knowledge graph. When 20 users mark the solution of "replacing the RAID card battery" as invalid ( Figure 11 , S54), weight adjustment module ( Figure 11 , S55) Start the four-stage optimization: 1) Traceability analysis and association of 50 similar work orders ( Figure 13 , S41), found that this type of battery failure accelerated in high temperature environment; 2) reduce the weight of this solution in the historical case library (from 0.3 to 0.18); 3) increase the weight of ambient temperature monitoring data (from 0.2 to 0.4); 4) add a new knowledge graph relationship edge "computer room temperature > 28℃ → battery life shortening factor 1.8" ( Figure 2 , S06). Preferably, the system synchronously updates the equipment maintenance strategy ( Figure 10 , S17), when the temperature sensor ( Figure 9 , S38) automatically pushes the "install constant temperature cabinet" suggestion when detecting a continuous high temperature (confidence 0.91). Furthermore, the version management module ( Figure 4 , S27) generates the version number V3.2.1, obtained by the formula 3 technique, and records metadata including weight adjustment parameters, number of newly added rules, etc. ( Figure 15 , S37), and ensures that the update process is auditable through blockchain evidence storage (Formula 6). Experimental data shows that the adoption rate of the solution for this scenario increased from 58% to 89% after optimization.

[0097] On the other hand, in one embodiment, Figure 13 As shown in (S41-S43), the anomaly detection module realizes proactive operation and maintenance. The system analyzes 200,000 conversation records every day ( Figure 13 , S41), an improved TF-IDF algorithm (window size = 50) is used to identify high-frequency terms. When the "optical module compatibility" issue appears 47 times within 8 hours (frequency 23.5%), exceeding the threshold of 20% (Formula 7: Frequency (q) = TotalConversationsCount (q) × 100%), a three-level processing flow is triggered: 1) Association rule mining (Apriori algorithm) finds that the issue is 82% associated with the switch model N9K-C9336TC-FX; 2) Knowledge graph ( Figure 2 , S06) automatically marks the compatibility warning level of this model as severe ( Figure 4 , S28); 3) Push the optical module replacement list to the procurement system ( Figure 8 , S51).

[0098] In other embodiments, Figure 14As shown in (S32-S34), the multimodal interactive interface revolutionizes the operation and maintenance mode. When an engineer takes a photo of the equipment indicator light ( Figure 14 , S33) and asks "Is the system status normal?", the image recognition submodule ( Figure 14 , S34) performs the following processing: 1) YOLOv5 model locates 4 LED indicators; 2) HSV color space analysis shows that red indicators account for 82%; 3) OCR reads the panel error code "E207".

[0099] It should also be noted that, in a preferred embodiment, Figure 15 As shown in (S37) and Formula 6, the blockchain evidence storage mechanism ensures data credibility. When the knowledge graph updates the "UPS battery replacement cycle" rule ( Figure 4 , S28), the evidence storage module executes: 1) extracts the updated content (including 32 parameter changes); 2) generates the timestamp "2025-03-15T08:23:17Z"; 3) creates a random number Nonce = 0x7A3F19; 4) calculates the hash value Hash = SHA256 (UpdateData ⊕ Timestamp ⊕ Nonce) = a1b2...f9e0. The hash value is written to the Hyperledger Fabric ( Figure 15 , S37), forming an immutable record containing 6 confirmation nodes. Preferably, the evidence storage system is designed with a cross-chain verification interface ( Figure 8 , S51), supports interoperability with public chains such as Ethereum and Corda, and the verification delay is less than 200ms. Furthermore, when the auditors check the firmware upgrade records in December 2024, the system uses MerkleProof technology ( Figure 15 , S37), providing a complete chain of evidence containing 17 related blocks within 3 seconds, meeting GDPR compliance requirements ( Figure 12 , S12).

[0100] In one embodiment, if Figure 8 As shown in (S51) and formula 3, the system optimizes operation and maintenance decisions through knowledge usage reports. At the beginning of each month, the report generation module ( Figure 8 , S51) automatically analyzes 2.5TB of conversation data ( Figure 13 , S41), extracting three core indicators: 1) hot issue distribution (TF-IDF weighted ranking); 2) solution effectiveness score (user feedback weighted); 3) knowledge graph update impact (Formula 3, version number increment). For the monthly hot issue "storage delay" (occurrence frequency 27%), the report ( Figure 8, S51) presents multi-dimensional analysis: a) distribution of related device models (NX5500 accounts for 68%); b) comparison of solution adoption rates (firmware upgrade 92% vs. hardware replacement 35%); c) improvement in resolution rate due to knowledge graph update (from 71% to 89%). Optimally, the system uses association rule mining (Apriori algorithm) to find a strong correlation between "delay peaks and backup task overlap" (support 0.82, confidence 0.91), and automatically generates a policy recommendation to "adjust the backup window to the business off-peak period" ( Figure 10 , S17). Furthermore, the report integrates a prediction model (LSTM) to warn that the risk of NVMeSSD failure may increase by 300% in the next quarter ( Figure 9 , S38), it is recommended to purchase spare parts in advance ( Figure 10 , S18), and store evidence through blockchain ( Figure 15 , S37) Ensure that the procurement process is traceable.

[0101] In one embodiment, combining Figure 4 (S26-S28) dynamic update mechanism, the system realizes the real-time evolution of the knowledge graph. Figure 9 , S38) detected that the input voltage fluctuation of a certain model of UPS exceeded ±8% ( Figure 4 , S26), the dynamic update engine starts immediately: 1) extract relevant fault cases in the past 24 hours ( Figure 13 , S41) 42 cases; 2) Calculate the update priority (calculated by formula 3, Δt_i = 2 hours, Weight_i = 0.7); 3) Generate version number V3.4.1 (basic version V3.4.0 + ∑ (2 / 24 × 0.7) = 0.058). Update content ( Figure 4 , S28) includes: adding a "voltage tolerance threshold ±5%" rule (confidence level 0.88), adjusting the rectifier module fault weight (0.3→0.5), and associating the mains power quality monitoring data source (δ coefficient +0.2).

[0102] Preferably, the update process triggers an automated verification process ( Figure 10 , S17): Simulate voltage fluctuation scenarios (±12%) in a sandbox environment to verify that the new rules accurately intercept 92% of abnormal cases ( Figure 7 , S24). Furthermore, the multi-tenant synchronization module ( Figure 12 , S12) adopts a differential push strategy and sends emergency updates only to 19 customer groups (isolation coefficient S>0.85) using this UPS model. Figure 15 ,S37),avoiding the knowledge base pollution of irrelevant customers.

[0103] On the other hand, in one embodiment, Figure 7 (S25) and Figure 15As shown in (S37), the manual audit closed-loop mechanism improves system reliability. When dealing with the "virtual machine host kernel crash" problem, LLM recommends "upgrading the KVM version" (confidence 0.66), triggering a three-level audit process: 1) Primary operation and maintenance checks the kernel log ( Figure 14 , S33), confirmed the existence of "BUG:softlockup" error; 2) Senior engineers analyzed the core dump ( Figure 14 , S34), locate the NVMe driver defect; 3) The architect approved the addition of the "disable APST energy saving function" solution to the knowledge graph ( Figure 4 , S28). In other embodiments, as Figure 9 (S38-S39) and Figure 14 As shown in (S33-S34), 3D visualization and multimodal data fusion improve diagnostic accuracy. When dealing with the "abnormal speed drop of all-flash array", the visualization module ( Figure 9 , S39) generates four-dimensional analysis views: 1) 3D spatial heat map showing the physical topology of the controller and SSD (XYZ coordinate accuracy ±2mm); 2) Color gradient characterization of IO latency (0-50ms, RGB (0,0,255)→(255,0,0)); 3) Dynamic particle flow showing data path congestion points; 4) AR overlay showing SSD chip-level temperature distribution ( Figure 14 , S34).

[0104] It should also be noted that, in a preferred embodiment, Figure 10 (S17-S18) and formula 5 show that the automated execution interface achieves industrial-grade precision control. When handling a "hyper-converged cluster split-brain" fault, the system triggers a five-stage automated repair ( Figure 10 , S17): 1) Isolate the faulty node (execute the CLI command "cluster quorum force"); 2) Create a consistent snapshot (generate a LUKS encrypted image); 3) Rebuild the arbitration node (call Terraform to deploy 3 witness VMs); 4) Synchronize data (rsync differential synchronization, bandwidth limit 10Gbps); 5) Verify cluster health (perform 473 check items). Calculated by formula 5, instruction parsing accuracy = 473 successful items / 473 total items × 100% = 100%. Preferably, the system is designed with atomic operation rollback ( Figure 10 ,S18),When any stage fails, the reverse operation chain (such as deleting the witness VM and restoring the snapshot) is automatically executed to ensure RTO < 5 minutes.

[0105] Those skilled in the art will clearly understand that for the sake of convenience and brevity of description, only the division of the above-mentioned functional units and modules is used as an example. In actual applications, the above-mentioned functions can be distributed and completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0106] The embodiments described above are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention, and should all be included in the scope of protection of the present invention.

Claims

1. An intelligent question-answering method for operation and maintenance knowledge based on LLM, characterized by: The following steps are involved: S1: Receive questions from operators through a natural language interface that supports multimodal input of text, voice, and images. Image input uses an object detection model to identify device indicator lights, and voice input undergoes noise reduction and then is converted to text. S2: Use the pre-trained LLM model to parse the semantics of the question and generate candidate answers, where the LLM model is optimized in the following ways: A two-stage fine-tuning process was conducted based on a domain dataset containing a large number of historical work orders. The first stage used supervised learning to enhance the mapping of professional terminology, and the second stage introduced a real-time data reward mechanism. The device topology relationship in the knowledge graph is encoded into the model reasoning process through attention mask technology; S3: Call the dynamic operation and maintenance knowledge graph to verify the accuracy of the candidate answer; S4: The verified answer is returned to the interactive interface through the structured output module. The output content includes: Multimodal information text, schematics, links to maintenance videos; Predicted value based on equipment remaining life prediction model; associated automated execution instructions; S5: Records conversation history and generates context tags containing device ID, fault time pattern, and solution hash value. It uses a text feature extraction algorithm to identify high-frequency fault keywords and employs time window statistics to analyze problem distribution. S6: Optimize subsequent conversation processes based on contextual tags, establish a cross-system association matrix to support complex problem solving, dynamically adjust the weight of each node in the knowledge graph, and ensure data security through a multi-tenant data isolation mechanism.

2. The LLM-based intelligent question-answering method for operation and maintenance knowledge according to claim 1 is characterized in that: In step S1, the target detection model for image input is a YOLO series model, the noise reduction processing of speech input adopts the VAD noise reduction algorithm, and the speech-to-text conversion adopts the CTC algorithm.

3. The LLM-based intelligent question-answering method for operation and maintenance knowledge according to claim 1 is characterized in that: In step S2, the domain dataset for two-stage fine-tuning is historical operation and maintenance work order data covering different types and scenarios, and the first-stage supervised learning is trained by annotating the mapping relationship between professional terms and standard expressions, and the second-stage real-time data reward mechanism adjusts model parameters based on feedback from real-time operation and maintenance data.

4. The LLM-based intelligent question-answering method for operation and maintenance knowledge according to claim 1 is characterized in that: In step S3, the version number management mechanism of the device model and fault code mapping library will update the version in real time according to the update of the device and the change of the fault code; the historical solution case library uses the Apriori algorithm to mine association rules; the real-time data consistency coefficient of the real-time updated knowledge base is used to measure the consistency between real-time data and historical data and model prediction results.

5. The LLM-based intelligent question-answering method for operation and maintenance knowledge according to claim 1 is characterized in that: In step S3, the multi-level verification of the multi-source data fusion engine includes data layer verification, logic layer verification and result layer verification, and the accessed device monitoring data includes but is not limited to NetFlow traffic and SMART logs.

6. The LLM-based intelligent question-answering method for operation and maintenance knowledge according to claim 1 is characterized in that: In step S4, the device remaining life prediction model is an LSTM model, and the automated execution instructions include but are not limited to firmware upgrade work order templates and device restart instructions.

7. The LLM-based intelligent question-answering method for operation and maintenance knowledge according to claim 1 is characterized in that: In step S5, the text feature extraction algorithm is the TFIDF algorithm, and the time window statistics technology uses the sliding window technology to count the problem distribution of different devices and different fault types within a unit time.

8. The LLM-based intelligent question-answering method for operation and maintenance knowledge according to claim 1 is characterized in that: In step S6, a cross-system association matrix is ​​established based on the business associations and data interaction relationships between different operation and maintenance systems, and the basis for dynamically adjusting the weights of knowledge graph nodes includes but is not limited to the frequency of occurrence of questions and the accuracy of answers.

9. An intelligent question-answering device for operation and maintenance knowledge based on LLM, characterized in that: include: A multimodal input module is used to receive questions from operators through a natural language interaction interface that supports text, voice, and image multimodal input; A semantic parsing and answer generation module, which uses a pre-trained LLM model to parse the question semantics and generate candidate answers, wherein the LLM model is optimized by the method according to any one of claims 1 to 3; An answer verification module calls a dynamic operation and maintenance knowledge graph to verify the candidate answer, wherein the knowledge graph and verification process are the method according to any one of claims 1, 4, or 5; A structured output module returns the verified answer to the interactive interface through the structured output module, and the output content is the method according to any one of claims 1 and 6; A conversation recording and analysis module records conversation history and generates context tags, and performs high-frequency fault keyword recognition and problem distribution analysis using the method described in any one of claims 1 and 7; A process optimization module that optimizes subsequent conversation processes based on context tags, establishes a cross-system association matrix, dynamically adjusts knowledge graph node weights, and ensures data security through a multi-tenant data isolation mechanism, as described in any one of claims 1 and 8.

10. An electronic device, characterized in that: The method comprises a processor and a memory, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of the LLM-based operation and maintenance knowledge intelligent question answering method according to any one of claims 1 to 8 are implemented.

Images