Fault reasoning analysis method and system based on large language model

Abstract

The application provides a fault reasoning analysis method and system based on a large language model, first, a multi-source operation and maintenance data set of a system to be diagnosed is acquired, including structured performance indicators, semi-structured service logs and unstructured text description data, then the multi-source operation and maintenance data set is subjected to semantic enhancement, semantic data units containing entity, relationship and attribute semantic labels are obtained, a semantic association network is constructed based on the semantic data units, a pre-trained large language model is called to perform root cause reasoning analysis on the network, a candidate root cause set sorted by confidence is generated, finally, operation and maintenance decision instructions containing entity operation sequences and priority sorting are generated according to the candidate root cause set and sent to a system management terminal to trigger an automatic repair process, thereby the system operation and maintenance efficiency and reliability can be improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of system operation and maintenance, in particular to a fault reasoning analysis method and system based on a large language model. BACKGROUND

[0002] In modern complex system operation and maintenance scenarios, the system to be diagnosed is often composed of numerous components that work together to achieve specific functions. With the continuous expansion of system size and the increasing complexity, the frequency and complexity of system failures also increase significantly. Traditional system fault diagnosis methods mainly rely on human experience and pre-set rule engines.

[0003] Although manual experience diagnosis can handle some complex problems with the deep knowledge and rich experience of professionals, it has obvious limitations. On the one hand, manual diagnosis is inefficient. In the face of massive multi-source operation and maintenance data, manual analysis one by one not only consumes time and effort, but also easily misses critical information. On the other hand, the results of manual diagnosis are greatly influenced by individual experience and subjective factors. Different personnel may draw different diagnostic conclusions for the same fault phenomenon, lacking consistency and accuracy.

[0004] Although pre-set rule engines can quickly handle some known and clearly defined rule faults, they are often powerless for new and complex fault patterns. Because the system's operating environment and component interaction relationships are constantly changing, pre-set rules are difficult to cover all possible fault scenarios comprehensively, and the cost of updating and maintaining the rules is high. In addition, existing methods do not fully consider the semantic association between different types of data when processing multi-source operation and maintenance data, and cannot grasp the overall system operating state and fault root cause, resulting in insufficient accuracy and comprehensiveness of fault reasoning analysis. SUMMARY

[0005] In view of the above-mentioned problems, in combination with the first aspect of the present application, the embodiments of the present application provide a fault reasoning analysis method based on a large language model, which comprises:

[0006] obtaining a multi-source operation and maintenance data set of a system to be diagnosed, the multi-source operation and maintenance data set comprising structured performance indicator data, semi-structured service log data and unstructured text description data sorted by timestamp;

[0007] performing semantic enhancement on the multi-source operation and maintenance data set to obtain semantic data units containing entity semantic labels, relationship semantic labels and attribute semantic labels, the entity semantic labels corresponding to system component entities, the relationship semantic labels corresponding to component interaction relationships, and the attribute semantic labels corresponding to entity state attributes;

[0008] construct a semantic association network based on the semantic data units, nodes of the semantic association network being the entity semantic labels, directed edges between the nodes being the relation semantic labels, and edge weights being relation strength parameters calculated based on the attribute semantic labels;

[0009] invoke a pre-trained large language model to perform root cause inference analysis on the semantic association network, generate a candidate root cause set sorted by confidence, the candidate root cause set containing potential cause entities of the system anomaly and corresponding association path descriptions;

[0010] generate operation and maintenance decision instructions containing entity operation sequences and priority orders according to the candidate root cause set, and send the operation and maintenance decision instructions to a system management terminal to trigger an automated repair process.

[0011] In still another aspect, the embodiments of the present application also provide a fault inference analysis system based on a large language model, comprising a processor, a machine-readable storage medium, the machine-readable storage medium being connected with the processor, the machine-readable storage medium being used to store programs, instructions or codes, and the processor being used to execute the programs, instructions or codes in the machine-readable storage medium to realize the above-mentioned method.

[0012] Based on the above aspects, the embodiments of the present application can obtain a multi-source operation and maintenance data set of a system to be diagnosed, comprehensively covering structured performance index data, semi-structured service log data and unstructured text description data sorted by timestamps, perform semantic enhancement on the multi-source operation and maintenance data set, obtain semantic data units containing entity semantic labels, relation semantic labels and attribute semantic labels, accurately identify system component entities, interaction relationships between components and entity state attributes, construct a semantic association network based on the semantic data units, take entity semantic labels as nodes, relation semantic labels as directed edges, and edge weights as relation strength parameters calculated based on attribute semantic labels, present complex association relationships between system components, and help to grasp the running state of the system as a whole. Invoking a pre-trained large language model to perform root cause inference analysis on the semantic association network, utilizing the powerful language understanding and inference capability of the large language model, generating a candidate root cause set sorted by confidence, accurately finding out potential cause entities of the system anomaly and corresponding association path descriptions, greatly improving the accuracy and comprehensiveness of fault inference. Generating operation and maintenance decision instructions containing entity operation sequences and priority orders according to the candidate root cause set, and sending the operation and maintenance decision instructions to a system management terminal to trigger an automated repair process, realizing the automation and intelligentization of fault diagnosis and repair, significantly improving the efficiency and reliability of system operation and maintenance, and reducing the cost and error rate of manual intervention. BRIEF DESCRIPTION OF DRAWINGS

[0013] Figure 1is a flowchart of a fault reasoning analysis method based on a large language model provided by an embodiment of the present application.

[0014] Figure 2 is a schematic diagram of exemplary hardware and software components of a fault reasoning analysis system based on a large language model provided by an embodiment of the present application. DETAILED DESCRIPTION

[0015] The present application will be described in detail below with reference to the accompanying drawings, Figure 1 is a flowchart of a fault reasoning analysis method based on a large language model provided by an embodiment of the present application, which will be described in detail below.

[0016] This embodiment takes fault diagnosis of a distributed server cluster as an application scenario, and details the specific implementation process of the fault reasoning analysis method based on a large language model.

[0017] Step S110: Obtain a multi-source operation and maintenance data set of the system to be diagnosed, which includes structured performance indicator data, semi-structured service log data, and unstructured text description data sorted by timestamp.

[0018] In a distributed server cluster, the system to be diagnosed covers multiple physical servers, various application services deployed on the servers, network switches, storage devices, and other components. To fully understand the system running state, multi-source operation and maintenance data needs to be collected from the above components.

[0019] The structured performance indicator data is derived from the monitoring agent program built into each component. These monitoring agent programs collect data at fixed time intervals (such as every 30 seconds) and store them in a preset data format (such as JSON format). This includes the CPU usage, memory usage, disk I / O rate, network bandwidth utilization of the server, the response time, concurrent connection number, and error request number of the application service, the port traffic and forwarding delay of the network switch, and the read / write speed and storage space usage of the storage device. The above data all have accurate timestamps and are arranged in chronological order to form a structured performance indicator data set.

[0020] Semi-structured service log data is automatically generated by application services during operation and is usually stored in the form of text files, with each log entry containing fields such as timestamps, log levels (e.g., INFO, WARNING, ERROR), source service identifiers, target service identifiers, and interaction operation descriptions. However, the separation between fields may not be fixed, and some fields may be missing. For example, a log entry for a certain application service may be "[2025-08-03 10:00:05] ERROR: ServiceA->ServiceB: Connection timeout", which contains timestamps, log levels, source service identifiers (ServiceA), target service identifiers (ServiceB), and interaction operation descriptions (Connection timeout).

[0021] Unstructured text description data comes from various channels, including descriptions of system abnormalities recorded by operation and maintenance personnel during inspections (e.g., "Server 1 in the server room has abnormally high body temperature, accompanied by strange noises"), user-submitted fault repair information (e.g., "When using the App, there is no response for a long time after submitting an order"), and communication records between technical support personnel and developers (e.g., "Service C crashes when handling a large number of concurrent requests, and still frequently reports errors after restarting"). The above data has no fixed format and exists in the form of natural language text.

[0022] When collecting these data, privacy protection techniques are required for data involving privacy-sensitive information (e.g., user account information that may be included in user-submitted fault repair information). For example, user account information can be desensitized by replacing specific account numbers with meaningless identifiers; data encryption techniques can be used to encrypt data during transmission and storage to prevent data leakage; and access permission control can be set so that only authorized operation and maintenance personnel can access related data.

[0023] Step S120: Perform semantic enhancement on the multi-source operation and maintenance data set to obtain semantic data units containing entity semantic labels, relationship semantic labels, and attribute semantic labels, wherein the entity semantic labels correspond to system component entities, the relationship semantic labels correspond to inter-component interaction relationships, and the attribute semantic labels correspond to entity state attributes.

[0024] The semantic enhancement of the multi-source operation and maintenance data set is to convert the original data into a more understandable and manageable semantic form for subsequent construction of a semantic association network. The above process requires separate processing of structured performance indicator data, semi-structured service log data, and unstructured text description data.

[0025] Step S121: Perform index semantic mapping processing on the structured performance index data, extract the system component keywords in the index name, generate entity semantic labels corresponding to the system component keywords based on a preset entity dictionary, and the entity semantic labels include component name, component level and unique identification code.

[0026] The preset entity dictionary is pre-constructed and contains relevant information of all possible system component entities in the distributed server cluster. Each entry in the preset entity dictionary corresponds to a system component entity and contains component name (such as "Server1", "ServiceA", "Switch1", "Storage1"), component level (such as "physical device layer-server", "application service layer-business service", "network device layer-switch", "storage device layer-disk array") and unique identification code (such as "PHY-SRV-001", "APP-SVC-001", "NET-SWT-001", "STR-DEV-001").

[0027] When performing index semantic mapping processing on structured performance index data, first analyze the index name of each performance index data. For example, in the index name "CPU usage rate of Server1", the system component keyword is "Server1"; in the index name "response time of ServiceA", the system component keyword is "ServiceA".

[0028] Then, match the extracted system component keywords with the preset entity dictionary. If the matching is successful, obtain the component name, component level and unique identification code corresponding to the system component from the dictionary, and generate the entity semantic label. For example, after "Server1" is matched to the entry in the preset entity dictionary, the generated entity semantic label is (component name: Server1, component level: physical device layer-server, unique identification code: PHY-SRV-001); the entity semantic label corresponding to "ServiceA" is (component name: ServiceA, component level: application service layer-business service, unique identification code: APP-SVC-001).

[0029] Step S122: Perform log field structuring processing on semi-structured service log data, parse the source component field, target component field and interactive operation field in the log entry, and generate a relationship semantic label representing the calling direction and interaction type between components according to the verb meaning of the interactive operation field, and the relationship semantic label includes source entity identification, target entity identification and relationship type code.

[0030] When performing log field structuring processing on semi-structured service log data, first, regular expression matching is used to extract the source component field, the target component field and the interactive operation field from each log entry. For example, for the log entry "[2025-08-03 10:00:05] ERROR: ServiceA->ServiceB: Connection timeout", the source component field is "ServiceA", the target component field is "ServiceB", and the interactive operation field is "Connection timeout" can be extracted by regular expression.

[0031] Next, the source component field and the target component field are matched with a preset entity dictionary respectively to obtain the corresponding unique identification code as the source entity identifier and the target entity identifier. For example, the unique identification code corresponding to "ServiceA" is "APP-SVC-001", and the unique identification code corresponding to "ServiceB" is "APP-SVC-002", so the source entity identifier is "APP-SVC-001" and the target entity identifier is "APP-SVC-002".

[0032] Then, the verb meaning of the interactive operation field is analyzed to determine the interaction type between components. The preset interaction types include calling (such as "call" "invoke"), responding (such as "response" "reply"), connecting (such as "connect" "link"), disconnecting (such as "disconnect" "unlink"), data transmission (such as "send" "receive"), etc. Each interaction type corresponds to a relationship type code (such as "REL-001" for calling, "REL-002" for responding, "REL-003" for connecting, "REL-004" for disconnecting, and "REL-005" for data transmission).

[0033] For the interactive operation field "Connection timeout", the core verb meaning is connection failure, which can be classified as a connection-related interaction type, and the corresponding relationship type code is "REL-003" (here, connection failure is also classified as a special case of connection type for subsequent unified processing). Therefore, the generated relationship semantic label is (source entity identifier: APP-SVC-001, target entity identifier: APP-SVC-002, relationship type code: REL-003).

[0034] Step S123: Call the large language model to perform semantic parsing processing on the unstructured text description data, identify entity mentions, attribute descriptions and relation assertions, perform consistency matching between entity mentions and entity semantic tags, and map attribute descriptions and relation assertions to attribute semantic tags containing attribute names, attribute values ​​and timestamps and supplementary relation semantic tags respectively.

[0035] Step S1231: Perform text preprocessing on the unstructured text description data, remove duplicate characters, divide it into multiple text segment units according to sentence boundaries, and associate each text segment unit with the position index of the original unstructured text description data.

[0036] Unstructured text description data may contain various special symbols (such as "@", "#", "$", etc.) and repeated characters (such as multiple consecutive spaces and newlines), which can affect subsequent semantic parsing. In the text preprocessing process, special symbols are first removed using a character filtering algorithm, and then repeated characters are reduced to single characters using a repeated character compression algorithm.

[0037] For example, after removing the special symbol "!" and repeated characters ", " from the text description "Server1 in the server room has an abnormally high temperature, accompanied by abnormal noises!", we get "Server1 in the server room has an abnormally high temperature, accompanied by abnormal noises".

[0038] Next, the preprocessed text is segmented into multiple text fragment units according to sentence boundaries (such as periods, question marks, exclamation marks, commas, etc.). The above example can be segmented into two text fragment units: "Server1's chassis temperature rises abnormally in the server room" and "accompanied by abnormal noises." Each text fragment unit is associated with a location index, which records the start and end positions of the fragment in the original unstructured text description data for subsequent tracing.

[0039] Step S1232: Construct a semantic parsing prompt template for each text fragment unit. The semantic parsing prompt template includes a task description, a list of entity types, a list of relation types, and a list of attribute types.

[0040] The semantic parsing prompt template's task description is "Please analyze the following text fragment and identify the entity mentions, attribute descriptions, and relation assertions." The entity type list contains entity types that may exist in a distributed server cluster, such as "server," "application service," "network switch," and "storage device." The relation type list is consistent with the preset interaction types in step S122, such as "call," "response," and "connection." The attribute type list includes attributes that each entity may possess, such as "temperature," "response time," "CPU utilization," and "storage space."

[0041] For example, the semantic parsing prompt template constructed for the text segment unit "Server1 body temperature abnormally high in server room" is: "Please analyze the following text segment and identify the entity mentions, attribute descriptions, and relationship assertions. Entity type list: server, application service, network switch, storage device; relationship type list: call, response, connection, disconnection, data transmission; attribute type list: temperature, response time, CPU usage, storage space. Text segment: Server1 body temperature abnormally high in server room."

[0042] Step S1233: Splice the text segment unit and the semantic parsing prompt template into a model input text, call a large language model to perform sequence labeling processing on the model input text, and generate a labeling result sequence containing entity labeling, attribute labeling, and relationship labeling. The entity labeling contains entity name and entity type, the attribute labeling contains attribute name, attribute value, and the corresponding entity, and the relationship labeling contains source entity, target entity, and relationship type.

[0043] After splicing the text segment unit "Server1 body temperature abnormally high in server room" and the corresponding semantic parsing prompt template, a model input text is formed. A pre-trained large language model (such as a model based on the Transformer architecture) is called to process the model input text.

[0044] The large language model performs sequence labeling processing through understanding of the model input text. For the above model input text, the generated entity labeling is (entity name: Server1, entity type: server); the attribute labeling is (attribute name: temperature, attribute value: abnormally high, corresponding entity: Server1); and the relationship labeling is empty because the text segment does not involve relationships between entities.

[0045] Step S1234: Perform entity linking processing on the labeling result sequence, match the identified entity mentions with the standard entity names in the preset entity dictionary, and generate standardized entity identifiers. The preset entity dictionary contains the standard names and unique identification codes of all component entities in the system.

[0046] The entity mention "Server1" is successfully matched with the standard entity name "Server1" in the preset entity dictionary, and its unique identification code "PHY-SRV-001" is obtained from the dictionary as the standardized entity identifier.

[0047] Step S1235: Based on the standardized entity identifier, associate the attribute labeling to the corresponding entity, and generate an attribute semantic label containing the entity identifier, attribute name, attribute value, and extraction confidence.

[0048] The attribute label (attribute name: temperature, attribute value: abnormally high, and belonging entity: Server1) is associated with the standardized entity identifier "PHY-SRV-001", and an attribute semantic label is generated. At the same time, the large language model gives the confidence of the attribute extraction (such as 0.92), which is used to evaluate the reliability of the extraction result. Therefore, the generated attribute semantic label is (entity identifier: PHY-SRV-001, attribute name: temperature, attribute value: abnormally high, and extraction confidence: 0.92).

[0049] Step S1236: Replace the source entity and the target entity in the relationship label with the standardized entity identifier to generate a supplementary relationship semantic label containing the source entity identifier, the target entity identifier, the relationship type, and the extraction confidence.

[0050] If there is a relationship label in the text segment, for example, "ServiceA calls ServiceB", the relationship label is (source entity: ServiceA, target entity: ServiceB, and relationship type: call). Replace the source entity "ServiceA" and the target entity "ServiceB" with the corresponding standardized entity identifiers "APP-SVC-001" and "APP-SVC-002", and combine the extraction confidence (such as 0.95) to generate a supplementary relationship semantic label (source entity identifier: APP-SVC-001, target entity identifier: APP-SVC-002, relationship type: call, and extraction confidence: 0.95).

[0051] Step S1237: Integrate the attribute semantic label and the supplementary relationship semantic label to generate a semantic analysis result set corresponding to the text segment unit. Each label entry in the semantic analysis result set is associated with the location index of the text segment unit.

[0052] Integrate the attribute semantic label generated in step S1235 and the supplementary relationship semantic label generated in step S1236 to form a semantic analysis result set. Each label entry is associated with the location index of the text segment unit to trace its source. For example, for the text segment unit "Server room Server1 body temperature abnormally high", the semantic analysis result set is [ (entity identifier: PHY-SRV-001, attribute name: temperature, attribute value: abnormally high, extraction confidence: 0.92, and location index: 0-25) ].

[0053] Step S124: Perform a redundancy detection process on the entity semantic label, the relationship semantic label, and the supplementary relationship semantic label, remove duplicate label entries and low-confidence label entries, and the low-confidence label entries are the labels corresponding to the confidence score output by the large language model that is lower than the pre-set confidence threshold.

[0054] The pre-set confidence threshold can be set according to the actual application scenario, such as 0.8. During the redundancy detection process, first, the contents of each label entry are compared. If all fields of two label entries (such as component name, component level, and unique identification code of entity semantic labels; source entity identifier, target entity identifier, and relationship type code of relationship semantic labels; entity identifier, attribute name, and attribute value of attribute semantic labels) are completely the same, it is determined that the label entries are duplicate label entries, and only one of them is retained.

[0055] Then, the confidence score of the label entry is checked (for label entries generated by a large language model, such as attribute semantic labels and supplementary relationship semantic labels). If the confidence score is lower than the pre-set confidence threshold (such as 0.8), it is determined that the label entry is a low-confidence label entry, and it is removed. For example, the extraction confidence of a certain attribute semantic label is 0.75, which is lower than 0.8, so the label entry is removed.

[0056] Step S125: fuse the entity semantic labels, relationship semantic labels, and attribute semantic labels after redundancy removal to generate a semantic data unit containing label type identifiers, associated data sources, and timestamp information. Each label entry of the semantic data unit is associated with a data segment index in the original multi-source operation and maintenance data set, and the data segment index is used to trace the original data position corresponding to the label.

[0057] The entity semantic labels, relationship semantic labels, and attribute semantic labels after redundancy removal need to be fused. A label type identifier (such as “LABEL-ENT” for entity semantic labels, “LABEL-REL” for relationship semantic labels, and “LABEL-ATR” for attribute semantic labels), an associated data source (such as from structured performance indicator data, semi-structured service log data, or unstructured text description data), and timestamp information (obtained from the original data) are added to each label entry.

[0058] At the same time, each label entry is associated with a data segment index in the original multi-source operation and maintenance data set, which records the position of the label entry corresponding to the original data in the multi-source operation and maintenance data set. For example, a certain entity semantic label is derived from the “CPU usage rate of Server1” and the above indicators in the structured performance indicator data, and its data segment index records the storage position of the indicator in the structured performance indicator data set. Through these information, a semantic data unit is generated.

[0059] Step S130: based on the semantic data unit, a semantic association network is constructed, the nodes of the semantic association network are the entity semantic labels, the directed edges between the nodes are the relationship semantic labels, and the edge weights are the relationship strength parameters calculated based on the attribute semantic labels.

[0060] The semantic association network can intuitively show the association relationship between system component entities and the strength of the relationship. The construction process includes determination of node set and directed edge set, collection of node attribute characteristics, calculation of edge weight, and dynamic evolution of the network, etc.

[0061] Step S131: Extract all entity semantic labels from the semantic data unit as a network node set, assign a unique node identifier and corresponding component type attribute to each node, the component type attribute includes hardware component type, software component type and external dependency type, each node is associated with the component name and unique identification code in the corresponding entity semantic label.

[0062] All entity semantic labels are extracted from the semantic data unit, duplicate entity semantic labels are removed to form a network node set. Assign a unique node identifier to each node (the same code as the unique identification code in the entity semantic label can be used), and determine the component type attribute according to the component hierarchy in the entity semantic label.

[0063] For example, the node corresponding to the entity semantic label (component name: Server1, component hierarchy: physical device layer-server, unique identification code: PHY-SRV-001), its unique node identifier is "PHY-SRV-001", and the component type attribute is hardware component type; the node corresponding to the entity semantic label (component name: ServiceA, component hierarchy: application service layer-business service, unique identification code: APP-SVC-001), the component type attribute is software component type; if there is a component that depends on an external system (such as a third-party payment interface), the component type attribute is external dependency type. Each node is associated with the corresponding component name and unique identification code to clearly identify the system component entity corresponding to the node.

[0064] Step S132: Extract the relationship semantic labels in the semantic data unit to construct a directed edge set between nodes, the directed edge set represents the interaction relationship direction between components, each directed edge is associated with a corresponding relationship type identifier, the relationship type identifier includes deployment relationship, call relationship and dependency relationship, the source node and target node of each directed edge correspond to the source entity identifier and target entity identifier in the relationship semantic label respectively.

[0065] All relationship semantic labels (including the relationship semantic labels generated in step S122 and the supplementary relationship semantic labels generated in step S1236) are extracted from the semantic data unit, which will be used as directed edges between nodes. The direction of each directed edge is determined by the source entity identifier and the target entity identifier, the node corresponding to the source entity identifier is the source node of the directed edge, and the node corresponding to the target entity identifier is the target node of the directed edge.

[0066] Each directed edge is associated with a corresponding relationship type identifier, which is determined in the relationship semantic label generation process, such as deployment relationship (e.g. an application service is deployed on a server), call relationship (e.g. Service A calls Service B), dependency relationship (e.g. a service depends on the storage space provided by a storage device), etc. For example, the directed edge corresponding to the relationship semantic label (source entity identifier: APP-SVC-001, target entity identifier: APP-SVC-002, relationship type identifier: REL-001) has APP-SVC-001 as the source node, APP-SVC-002 as the target node, and the relationship type identifier as the call relationship.

[0067] Step S133: Collect the attribute semantic labels in the semantic data unit as node attribute features, which include current state parameters, historical state parameters, and threshold range parameters. The current state parameters are attribute values corresponding to the latest timestamp, and the historical state parameters are attribute value sequences within a preset time window.

[0068] Attribute semantic labels are extracted from the semantic data unit and associated with corresponding nodes according to entity identifiers, serving as node attribute features. The current state parameters refer to attribute values corresponding to the latest timestamp in the attribute semantic labels. For example, in the attribute semantic labels of a certain node (PHY-SRV-001), the temperature attribute value corresponding to the latest timestamp is "abnormally high", so the temperature parameter in the current state parameters of the node is "abnormally high".

[0069] The historical state parameters are attribute value sequences within a preset time window (e.g. the past 1 hour). For example, for the temperature attribute of Server1, the attribute values recorded in chronological order within the past 1 hour may be "normal", "slightly high", "obviously high", and "abnormally high", forming a historical state parameter sequence.

[0070] The threshold range parameters are the normal value range of the attribute. For example, the threshold range parameter of the server temperature may be "normal range: 20-35 degrees Celsius". When the current state parameter exceeds this range, it indicates that there may be an abnormality.

[0071] Step S134: Calculate the dynamic relationship weight of each directed edge based on the node attribute features. The dynamic relationship weight is the product of the current state parameters of the node and the relationship influence coefficient, which is determined according to the preset weight matrix of the relationship type identifier. Different relationship type identifiers correspond to different initial values of the relationship influence coefficient.

[0072] Step S1341: Extract the current state parameter from the node attribute feature as the node activity indicator, which includes CPU utilization, memory occupancy, and response time parameters. Different component type attributes correspond to different combinations of activity indicators.

[0073] For nodes of hardware component type (such as servers), node activity indicators may include CPU utilization, memory occupancy, disk I / O rate, etc.; for nodes of software component type (such as application services), node activity indicators may include response time, concurrent connection number, error request number, etc.; for nodes of external dependency type, may include interface call success rate, data transmission delay, etc. For example, the CPU utilization of the server node (PHY-SRV-001) in the current state parameter is "80%", and the memory occupancy is "70%", so its node activity indicator is CPU utilization 80%, memory occupancy 70%.

[0074] Step S1342: According to the relationship type identifier of the directed edge, query the preset relationship influence coefficient matrix to obtain the corresponding basic influence coefficient of the relationship type identifier. Different relationship type identifiers in the relationship influence coefficient matrix correspond to different numerical range basic influence coefficients.

[0075] The preset relationship influence coefficient matrix is preset according to historical experience and system characteristics. The rows and columns in the matrix correspond to different relationship type identifiers, and the matrix elements are the basic influence coefficients corresponding to the relationship type identifier. For example, the basic influence coefficient corresponding to the call relationship may be between 0.6-0.8, the basic influence coefficient corresponding to the deployment relationship may be between 0.4-0.6, and the basic influence coefficient corresponding to the dependency relationship may be between 0.7-0.9. When the relationship type identifier of the directed edge is the call relationship, the corresponding basic influence coefficient can be obtained by querying the matrix, such as 0.7.

[0076] Step S1343: Collect the threshold range parameter in the node attribute feature, and calculate the ratio of the current state parameter to the upper threshold as the state deviation, which is the current state parameter divided by the upper threshold, with a numerical range of 0 to 1.

[0077] Taking the CPU utilization of the server as an example, the upper threshold in the threshold range parameter is 100%, and the CPU utilization in the current state parameter is 80%, so the state deviation is 80% / 100%=0.8. If the current state parameter is 120% (assuming there is an over-threshold case), the state deviation is 120% / 100%=1.2, but it can be limited to the range of 0 to 1 through subsequent processing.

[0078] Step S1344: multiplying the base influence coefficient with the state deviation degree of the source node to obtain a preliminary relationship weight, the preliminary relationship weight reflecting the influence of the source node state on the relationship strength.

[0079] For example, the base influence coefficient is 0.7, and the state deviation degree of the source node is 0.8, then the preliminary relationship weight is 0.7*0.8=0.56.

[0080] Step S1345: collecting attribute semantic labels related to the directed edge in the semantic data unit, and extracting a change rate of the attribute value as a dynamic adjustment factor, the change rate being a difference between the attribute value at the current timestamp and the attribute value at the previous timestamp divided by the time interval.

[0081] The attribute semantic labels related to the directed edge refer to those attribute labels that can reflect the change of the relationship strength represented by the directed edge. For example, for the directed edge that Service A calls Service B, the attribute semantic label related to the directed edge can be the calling frequency of Service A to Service B. If the calling frequency at the current timestamp is 100 times per minute, the calling frequency at the previous timestamp is 80 times per minute, and the time interval is 1 minute, then the change rate is (100-80) / 1=20 times per minute.

[0082] Step S1346: adding the preliminary relationship weight and the dynamic adjustment factor to obtain a dynamic relationship weight, the numerical range of the dynamic relationship weight being limited in a preset interval through normalization processing, the normalization processing mapping the weight value to the range of 0 to 1 by using the maximum-minimum normalization method.

[0083] Suppose the preliminary relationship weight is 0.56, and the dynamic adjustment factor is 0.2 (converted from the calling frequency change rate to a value in the range of 0-1), then the dynamic relationship weight is 0.56+0.2=0.76. If the value exceeds the preset interval, it is mapped to the range of 0 to 1 by using the maximum-minimum normalization method. For example, if the calculation result is 1.2, and the maximum possible value is 1.5 and the minimum possible value is 0, then the normalized value is 1.2 / 1.5=0.8.

[0084] Step S135: integrating the node set, the directed edge set, and the dynamic relationship weight into an initial semantic association network, and performing time slicing processing on the initial semantic association network according to the timestamp information of the semantic data unit to generate multiple time period semantic association network snapshots arranged in time sequence, each semantic association network snapshot corresponding to the network state in a time window.

[0085] The node set determined in step S131, the directed edge set determined in step S132, and the dynamic relationship weight calculated in step S134 are integrated together to form an initial semantic association network. Then, according to the timestamp information of the semantic data unit, the initial semantic association network is time-sliced according to a fixed time window (for example, every 5 minutes as a window).

[0086] Each time window corresponds to a semantic association network snapshot, which contains the node set, directed edge set, and corresponding dynamic relationship weight in the time window, reflecting the association state between system component entities in the time period. For example, the snapshot in the time window from 10:00:00 to 10:05:00 contains the attribute characteristics of each node, the directed edges between nodes, and the dynamic relationship weight in the time period.

[0087] Step S136: Perform dynamic evolution analysis on the multi-period semantic association network snapshots, calculate the change amount of node attribute characteristics and the change rate of directed edge relationship weight between adjacent snapshots, and generate a semantic association network containing network topology evolution trend, the relationship weight in the semantic association network is updated in real time according to the node attribute characteristics, and the update frequency is consistent with the collection frequency of the multi-source operation and maintenance data set.

[0088] For two adjacent semantic association network snapshots (such as snapshot T1 and snapshot T2, T2 is after T1), the change amount of each node attribute characteristic is calculated, that is, the attribute value at T2 minus the attribute value at T1. For example, the temperature attribute value of Server1 at T1 is "normal", and at T2 is "slightly elevated", and the change amount is "slightly elevated-normal" (the calculation is performed after converting the text description to a numerical value through a preset numerical conversion rule).

[0089] At the same time, the change rate of each directed edge relationship weight is calculated, that is, (relationship weight at T2-relationship weight at T1) / (time interval of T2-T1). Through these change amounts and change rates, the evolution trend of the network topology structure is analyzed, such as the change trend of the node attribute, the increase and decrease trend of the relationship weight, etc.

[0090] The generated semantic association network will update the relationship weight in real time according to the change of the node attribute characteristics, and the update frequency is consistent with the collection frequency of the multi-source operation and maintenance data set (such as once every 30 seconds), so as to ensure that the network can timely reflect the latest state of the system.

[0091] Step S140: calling a pre-trained large language model to perform root cause reasoning analysis on the semantic association network, generating a candidate root cause set sorted by confidence, the candidate root cause set contains potential cause entities and corresponding association path descriptions of system abnormalities.

[0092] By analyzing the semantic association network through a large language model, potential root causes and associated paths of system abnormalities can be mined, including network topology data extraction, graph structure description text conversion, and multi-round reasoning processing.

[0093] Step S141 : Extract network topology data of the current time from the semantic association network, which includes a node set, a directed edge set, dynamic relationship weights, and current values of node attribute characteristics. The current value is the node state parameter corresponding to the latest timestamp.

[0094] The network topology data of the current time refers to the latest updated content in the semantic association network, including information of all nodes (node identifier, component type attribute, etc.), directed edge information between nodes (source node, target node, relationship type identifier, etc.), dynamic relationship weights of each directed edge, and current values (state parameters corresponding to the latest timestamp) of each node attribute characteristic. For example, the node set of the current time includes PHY-SRV-001, APP-SVC-001, etc., the directed edge includes a call relationship edge from APP-SVC-001 to APP-SVC-002, the dynamic relationship weight is 0.7, and the current attribute value of PHY-SRV-001 is "abnormally high temperature", etc.

[0095] Step S142: Convert the network topology data into a graph structure description text that can be parsed by a large language model, which includes a node identifier-component type correspondence table, a directed edge relationship type list, and a natural language description of the dynamic relationship weight matrix. The natural language description uses a preset template to convert structured data into a text paragraph.

[0096] The preset template is used to convert structured network topology data into natural language text. For example, the natural language description of the node identifier-component type correspondence table may be "the component type of node PHY-SRV-001 is hardware component type (server), the component type of node APP-SVC-001 is software component type (application service) …"; the description of the directed edge relationship type list may be "there is a directed edge of call relationship from node APP-SVC-001 to node APP-SVC-002, there is a directed edge of deployment relationship from node PHY-SRV-001 to node APP-SVC-001 …"; the description of the dynamic relationship weight matrix may be "the dynamic relationship weight of the directed edge from APP-SVC-001 to APP-SVC-002 is 0.7, the dynamic relationship weight of the directed edge from PHY-SRV-001 to APP-SVC-001 is 0.5 …". Through these descriptions, a graph structure description text is formed.

[0097] Step S143: Call the large language model to perform multi-round reasoning processing on the graph structure description text, and generate an initial root cause hypothesis set in the first round of reasoning, which contains potential abnormal nodes and corresponding abnormal propagation path descriptions.

[0098] A pre-trained large language model (such as an industry-specific large model after fine-tuning) is called to process the graph structure description text. In the first round of reasoning, the model generates an initial root cause hypothesis set based on its understanding of the text and the knowledge learned during its training process. For example, the model may speculate that "node PHY-SRV-001 (Server1) temperature anomaly is a potential abnormal node, and its anomaly may propagate to node APP-SVC-001 (ServiceA) through the deployment relationship, causing ServiceA to have a longer response time, and then propagate to node APP-SVC-002 (ServiceB) through the call relationship, causing ServiceB to have a connection timeout", which is one of the hypotheses in the initial root cause hypothesis set.

[0099] Step S144: Based on the multi-period semantic association network snapshot of the semantic association network, perform temporal consistency verification on the abnormal propagation path in the initial root cause hypothesis set, calculate the matching degree of the attribute feature change trend of each node in the abnormal period and the propagation path, and the matching degree is the consistency score of the node state parameter change direction and the path propagation direction.

[0100] Step S1441: Extract the multi-period semantic association network snapshot of the abnormal occurrence period from the semantic association network, and the abnormal occurrence period is a preset time window before and after the system alarm trigger timestamp.

[0101] After the system alarm is triggered, the abnormal occurrence period is determined as a preset time window before and after the alarm trigger timestamp (for example, the alarm trigger time is 10:00:00, and the preset time window is 30 minutes before and after, then the abnormal occurrence period is 9:30:00 to 10:30:00). Extract the multi-period semantic association network snapshot in this period from the semantic association network for subsequent temporal consistency verification.

[0102] Step S1442: For each initial root cause hypothesis abnormal propagation path sequence, extract the node identifiers in the abnormal propagation path in the order of propagation to generate a node sequence list, and the first node in the node sequence list is the root cause entity and the last node is the abnormal performance entity.

[0103] For the abnormal propagation path description in the initial root cause hypothesis, the node identifiers are extracted in the propagation order. For example, the abnormal propagation path is “PHY-SRV-001->APP-SVC-001->APP-SVC-002”, and the generated node sequence list is [PHY-SRV-001, APP-SVC-001, APP-SVC-002], wherein PHY-SRV-001 is the root cause entity, and APP-SVC-002 is the abnormal manifestation entity.

[0104] Step S1443: For each node in the node sequence list, the attribute feature time series of the corresponding node in the abnormal occurrence period is extracted from the multi-period semantic association network snapshot, and the attribute feature time series is a set of state parameter values sorted by timestamp.

[0105] From the multi-period semantic association network snapshot of the abnormal occurrence period, the attribute feature time series of each node in the node sequence list is extracted. For example, for the node PHY-SRV-001, the time series of its temperature attribute in the abnormal occurrence period may be [normal, slightly elevated, significantly elevated, abnormally elevated], arranged in chronological order.

[0106] Step S1444: Calculate the change trend slope of the attribute feature time series, wherein the change trend slope is the slope value obtained by linear regression fitting, and a positive value indicates an upward trend in the state parameter, and a negative value indicates a downward trend.

[0107] The attribute feature time series is subjected to linear regression fitting to obtain the change trend slope. For example, after converting the temperature attribute time series of PHY-SRV-001 into numerical values (e.g., normal=1, slightly elevated=2, significantly elevated=3, and abnormally elevated=4), linear regression fitting is performed to obtain a positive slope value, indicating that the temperature is rising.

[0108] Step S1445: According to the propagation direction of the abnormal propagation path, it is determined whether the change trend slope of the adjacent node meets the causal relationship expectation.

[0109] The abnormal propagation path has a certain propagation direction, such as from PHY-SRV-001 to APP-SVC-001 and then to APP-SVC-002. The causal relationship expectation is that if the attribute feature of the root cause node shows an upward trend (e.g., temperature rises), the relevant attribute feature of the next node to which it propagates should also show an upward trend (e.g., response time becomes longer). For example, the temperature change trend slope of PHY-SRV-001 is positive, and the response time change trend slope of APP-SVC-001 is expected to be positive. If the actual situation is so, it meets the causal relationship expectation.

[0110] Step S1446: count the proportion of the number of adjacent node pairs that meet the causal expectation in the abnormal propagation path in the total number of node pairs as the matching degree, and the higher the matching degree, the stronger the timing consistency of the abnormal propagation path.

[0111] For example, there are 3 nodes in the node sequence list, forming 2 pairs of adjacent node pairs. If 1 pair meets the causal expectation, the matching degree is 1 / 2=0.5; if 2 pairs meet, the matching degree is 1.

[0112] Step S145: adjust the confidence score of each hypothesis in the initial root cause hypothesis set according to the matching degree, retain the hypotheses with a matching degree higher than a preset matching degree threshold, and generate an intermediate root cause hypothesis set, and the confidence score adjustment is a weighted sum of the original score and the matching degree.

[0113] The preset matching degree threshold can be set to 0.6. For each hypothesis in the initial root cause hypothesis set, the original confidence score (given by the first round of reasoning of the large language model) is weighted and summed with the matching degree (for example, the weights are 0.7 and 0.3, respectively) to obtain the adjusted confidence score. If the matching degree is higher than 0.6, the hypothesis is retained in the intermediate root cause hypothesis set. For example, the original confidence score of a certain initial root cause hypothesis is 0.8, and the matching degree is 0.7. After weighted sum, the adjusted confidence score is 0.8*0.7+0.7*0.3=0.56+0.21=0.77, and since the matching degree 0.7 is higher than the preset threshold 0.6, the hypothesis is retained. If the matching degree of another hypothesis is 0.5, which is lower than 0.6, regardless of its original confidence score, it will be excluded.

[0114] Step S146: call the large language model to perform conflict detection processing on the intermediate root cause hypothesis set, identify and remove hypothesis entries with logical contradictions, where a logical contradiction refers to the existence of mutually exclusive propagation path descriptions for the same abnormal node, and mutual exclusivity refers to opposite propagation directions or conflicting relationship types.

[0115] Step S1461: convert each hypothesis entry in the intermediate root cause hypothesis set into a logical expression, which includes a root cause entity, a propagation path condition, and an abnormal phenomenon description.

[0116] Each hypothesis entry contains information such as root cause entity, propagation path and abnormal phenomenon, which is converted into a logical expression. For example, a hypothesis entry is "root cause entity PHY-SRV-001 causes APP-SVC-002 to have a connection timeout exception through path PHY-SRV-001->APP-SVC-001->APP-SVC-002", which is converted into a logical expression "root cause entity = PHY-SRV-001 ∧ propagation path = PHY-SRV-001->APP-SVC-001->APP-SVC-002 ∧ abnormal phenomenon = APP-SVC-002 connection timeout".

[0117] Step S1462: constructing a conflict detection prompt template, which contains a task description, a conflict definition and a list of hypothesis entries.

[0118] The task description is "please detect whether there is a logical conflict between the following hypothesis entries"; the conflict definition is "there are mutually exclusive propagation path descriptions for the same abnormal node, including opposite propagation directions or conflicting relationship types"; and the list of hypothesis entries is the logical expression corresponding to all hypothesis entry pairs in the intermediate root cause hypothesis set. For example, the conflict detection prompt template can be "please detect whether there is a logical conflict between the following hypothesis entries. Conflict definition: there are mutually exclusive propagation path descriptions for the same abnormal node, including opposite propagation directions or conflicting relationship types. Hypothesis entry list: 1. root cause entity = PHY-SRV-001 ∧ propagation path = PHY-SRV-001->APP-SVC-001->APP-SVC-002 ∧ abnormal phenomenon = APP-SVC-002 connection timeout; 2. root cause entity = APP-SVC-003 ∧ propagation path = APP-SVC-003->APP-SVC-002 ∧ abnormal phenomenon = APP-SVC-002 connection timeout……".

[0119] Step S1463: concatenating the logical expression and the conflict detection prompt template into a model input text, calling a large language model to perform conflict judgment on the model input text, and generating a conflict matrix between hypothesis entries, which is a two-dimensional matrix, and the matrix elements represent whether there is a conflict between the corresponding two hypothesis entries.

[0120] The logical expressions of all the hypothesis entries are spliced into model input text according to the format of the conflict detection prompt template, and a large language model is called for processing. The model analyzes the logical relationship of each hypothesis entry, judges whether there is a conflict between any two hypothesis entries, and generates a conflict matrix. The rows and columns of the conflict matrix correspond to the hypothesis entries, respectively. If the matrix element is 1, it means that the corresponding two hypothesis entries have a conflict; if it is 0, it means that there is no conflict. For example, for two hypothesis entries, if they both involve the abnormal node APP-SVC-002 but the propagation path direction is opposite, the corresponding element in the conflict matrix is 1.

[0121] Step S1464: Construct a conflict graph based on the conflict matrix, and the nodes of the conflict graph are the hypothesis entries, and the directed edges represent the conflict relationship between the entries.

[0122] According to the conflict matrix, a conflict graph is constructed. Each node in the conflict graph represents a hypothesis entry. If there is a conflict between two hypothesis entries (i.e., the corresponding element in the conflict matrix is 1), a directed edge is added between the two nodes to represent the conflict relationship between them. For example, if hypothesis entry 1 and hypothesis entry 2 have a conflict, there is a directed edge between node 1 and node 2 in the conflict graph.

[0123] Step S1465: Perform maximum conflict-free subset selection on the conflict graph to select a subset containing the most hypothesis entries without mutual conflicts.

[0124] The conflict graph is analyzed by a graph algorithm (such as a greedy algorithm) to select the maximum conflict-free subset. The maximum conflict-free subset contains the most hypothesis entries, and there is no conflict between any two entries. For example, there are 5 hypothesis entry nodes in the conflict graph, among which node 1 conflicts with nodes 2, 3, node 2 conflicts with node 4, and node 3 conflicts with node 5. After the algorithm is selected, the maximum conflict-free subset may contain nodes 1, 4, and 5 (assuming that there is no conflict between them).

[0125] Step S1466: Remove the hypothesis entries not selected into the maximum conflict-free subset from the intermediate root cause hypothesis set to generate a post-conflict intermediate root cause hypothesis set.

[0126] According to the selection result of the maximum conflict-free subset, the hypothesis entries not selected in the intermediate root cause hypothesis set are removed. For example, if the maximum conflict-free subset contains hypothesis entries 1, 4, and 5, hypothesis entries 2 and 3 are removed from the intermediate root cause hypothesis set to obtain the post-conflict intermediate root cause hypothesis set.

[0127] Step S1467: Recalculate the confidence score of the post-conflict hypothesis entries, increase the score of the hypothesis entries verified to have no conflict in the conflict detection process by a preset reward value, and improve their ranking priority.

[0128] The preset reward value can be set as 0.1. For each hypothesis entry after conflict resolution, the reward value is added to the confidence score adjusted before it. For example, the adjusted confidence score of a certain hypothesis entry is 0.77, and after adding 0.1, it becomes 0.87, so that it has a higher priority in subsequent sorting.

[0129] Step S147: Sort the intermediate root cause hypothesis set after conflict resolution according to the confidence score from high to low, extract the preset number of hypothesis entries in the sorted order as the candidate root cause set, and the candidate root cause set contains the root cause entity identifier, the abnormal propagation path sequence and the confidence score, and the abnormal propagation path sequence is a list of node identifiers arranged in the propagation order.

[0130] The preset number can be set according to actual needs, such as 5. The hypothesis entries after conflict resolution and recalculation of the confidence score are sorted according to the score from high to low, and the first 5 hypothesis entries are taken as the candidate root cause set. Each candidate root cause contains a root cause entity identifier (such as PHY-SRV-001), an abnormal propagation path sequence (such as [PHY-SRV-001, APP-SVC-001, APP-SVC-002]), and a corresponding confidence score (such as 0.87).

[0131] Step S150: Generate an operation and maintenance decision instruction containing an entity operation sequence and a priority order according to the candidate root cause set, and send the operation and maintenance decision instruction to a system management terminal to trigger an automated repair process.

[0132] Generating an operation and maintenance decision instruction is to convert the candidate root cause set into specific operation steps in order to repair system abnormalities. The above process needs to determine the target entity, query the operation process, adjust the operation sequence, set the priority, etc.

[0133] Step S151: Analyze the root cause entity identifier and abnormal propagation path sequence corresponding to each candidate root cause in the candidate root cause set, determine the target entity set that needs to perform intervention operation and the dependency order between entities, and the dependency order is the reverse order of the abnormal propagation path sequence.

[0134] The root cause entity identifier and the abnormal propagation path sequence of each candidate root cause are parsed to determine the target entities that need to be intervened. For example, the abnormal propagation path sequence of the candidate root cause is [PHY-SRV-001, APP-SVC-001, APP-SVC-002], and the target entity set is {PHY-SRV-001, APP-SVC-001, APP-SVC-002}. The dependency order between entities is the reverse order of the abnormal propagation path sequence, i.e., APP-SVC-002--APP-SVC-001--PHY-SRV-001, which means that APP-SVC-002 needs to be operated first, then APP-SVC-001, and finally PHY-SRV-001, to ensure that the operation is performed in the order from the end entity to the root cause entity, and the abnormality is gradually eliminated.

[0135] Step S152: Based on the target entity set, query the preset operation and maintenance manual to obtain the standard operation process corresponding to each target entity, which includes an operation step sequence, a precondition constraint, and an expected effect description. The precondition constraint is the entity state parameter range that needs to be met before the operation is performed.

[0136] The preset operation and maintenance manual stores the standard operation process corresponding to each system component entity. For example, for the target entity PHY-SRV-001 (server), its standard operation process may be: the operation step sequence is [check the status of the cooling fan, clean the internal dust of the server, restart the server]; the precondition constraint is "the current load rate of the server is less than 30%"; and the expected effect description is "the temperature of the server returns to the normal range (20-35 degrees Celsius)". For APP-SVC-001 (application service), the standard operation process may be [stop the service, check the configuration file, restart the service], the precondition constraint is "no other service depends on the operation of this service", and the expected effect description is "the service response time returns to the normal range (<1 second)".

[0137] Step S153: Call a large language model to perform adaptability analysis on the standard operation process and the abnormal propagation path sequence, and adjust the execution order of the operation steps to match the reverse path of the abnormal propagation, so that the operation is performed in the order from the root cause entity to the end entity.

[0138] For example, step S1531: convert the operation step sequence of the standard operation process into an operation directed graph, where the nodes of the operation directed graph are operation steps, and the directed edges represent the dependency relationship between steps.

[0139] For example, the standard operation step sequence of PHY-SRV-001 is [check the state of the cooling fan, clean the dust inside the server, restart the server], and when converted into an operation directed graph, the nodes are step 1 (check the state of the cooling fan), step 2 (clean the dust inside the server), and step 3 (restart the server). The directed edges are step 1-step 2 (indicating that the dust cleaning needs to be completed before the cooling fan state checking), and step 2-step 3 (indicating that the server needs to be restarted after the dust cleaning).

[0140] Step S1532: Extract the reverse path of the abnormal propagation path sequence as the target operation sequence, wherein the reverse path is the node sequence of the abnormal propagation path sequence from the last node to the first node.

[0141] The abnormal propagation path sequence is [PHY-SRV-001, APP-SVC-001, APP-SVC-002], and the reverse path is [APP-SVC-002, APP-SVC-001, PHY-SRV-001], that is, the target operation sequence is to execute the corresponding operation in the order of APP-SVC-002, APP-SVC-001, and PHY-SRV-001.

[0142] Step S1533: Associate a corresponding target entity identifier with each operation step in the operation directed graph, and determine the system component entity acted by each step.

[0143] For example, in the operation directed graph of PHY-SRV-001, steps 1, 2, and 3 are all associated with the target entity identifier PHY-SRV-001; and in the operation directed graph of APP-SVC-001, all steps are associated with the target entity identifier APP-SVC-001.

[0144] Step S1534: Match the target operation sequence with the node target entity identifier of the operation directed graph, identify the correspondence between the operation step and the target entity, and generate an entity-step mapping table.

[0145] The target operation sequence is [APP-SVC-002, APP-SVC-001, PHY-SRV-001], and after matching with the target entity identifier of each operation directed graph, the entity-step mapping table is generated, such as APP-SVC-002 corresponding to the step sequence in its operation directed graph, APP-SVC-001 corresponding to the step sequence in its operation directed graph, and PHY-SRV-001 corresponding to the step sequence in its operation directed graph.

[0146] Step S1535: Construct an adaptability analysis prompt template, wherein the adaptability analysis prompt template includes operation directed graph description, target operation sequence description, and adaptability adjustment requirements.

[0147] The operation directed graph is described as a textual description of the operation directed graph corresponding to each target entity; the target operation sequence is described as "the target operation sequence is APP-SVC-002--APP-SVC-001--PHY-SRV-001"; and the adaptability adjustment requirement is "adjust the execution order of the operation steps in each operation directed graph so that the overall execution order is consistent with the target operation sequence and does not violate the dependency relationship between steps".

[0148] Step S1536: input the operation directed graph, target operation sequence, and entity-step mapping table into the adaptability analysis prompt template, call a large language model to perform sequence planning processing on the adaptability analysis prompt template, and generate an adjusted operation step sequence.

[0149] The large language model adjusts the step sequence in each operation directed graph according to the input information to ensure that the overall operation sequence conforms to the target operation sequence. For example, the operation step sequence of APP-SVC-002 is executed first, followed by the operation step sequence of APP-SVC-001, and finally the operation step sequence of PHY-SRV-001, while ensuring that the step dependency relationship within each operation directed graph remains unchanged.

[0150] Step S1537: verify the dependency relationship of the adjusted operation step sequence, check whether it violates the step dependency relationship in the original operation directed graph, and if there is a step sequence that violates the dependency relationship, call the large language model again for local adjustment.

[0151] For example, if step 3 (restart server) of PHY-SRV-001 in the adjusted operation step sequence is executed before step 2 (clean up server internal dust), it violates the dependency relationship in the original operation directed graph, and the large language model needs to be called again for local adjustment of this part of the step sequence to ensure that step 2 is executed before step 3.

[0152] Step S1538: calculate the matching degree of the adjusted operation step sequence corresponding to the entity sequence and the target operation sequence, which is the proportion of the length of the continuous subsequence consistent with the entity sequence to the total length of the target operation sequence.

[0153] The total length of the target operation sequence is 3 (including 3 entities). If the entity sequence corresponding to the adjusted operation step sequence is [APP-SVC-002, APP-SVC-001, PHY-SRV-001], which is completely consistent with the target operation sequence, the matching degree is 3 / 3=1; if the entity sequence is [APP-SVC-002, PHY-SRV-001, APP-SVC-001], the continuous subsequence [APP-SVC-002] is consistent with the target sequence, the length is 1, and the matching degree is 1 / 3≈0.33.

[0154] Step S1539: If the matching degree reaches the preset matching degree threshold, the adjusted operation step sequence is determined as the adapted operation process; if the matching degree does not reach the preset matching degree threshold, the constraint condition in the adaptability analysis prompt template is increased, and the sequential planning processing is re-executed until the matching degree reaches the standard or the maximum number of retries is reached.

[0155] The preset matching degree threshold can be set to 0.8. If the matching degree is 1, the threshold is reached, and the operation step sequence is determined as the adapted operation process; if the matching degree is 0.33, the threshold is not reached, and the constraint condition (such as "the operation steps of each entity must be arranged in strict accordance with the order of APP-SVC-002--APP-SVC-001--PHY-SRV-001") is added in the adaptability analysis prompt template, and the large language model is re-called for sequential planning processing. If the matching degree still does not reach the standard after multiple retries (such as 5 times), the operation step sequence with the highest matching degree is used.

[0156] Step S154: Determine the priority weight of each target entity operation according to the confidence score of the candidate root cause set. The higher the confidence score, the greater the priority weight corresponding to it, and the priority weight is used to determine the execution order of the operations corresponding to different candidate root causes.

[0157] The confidence scores of each candidate root cause in the candidate root cause set are normalized to obtain the priority weight of each target entity operation. For example, the confidence score of candidate root cause 1 is 0.87, the confidence score of candidate root cause 2 is 0.75, and the total score is 0.87+0.75=1.62. The priority weight of the target entity operation corresponding to candidate root cause 1 is 0.87 / 1.62≈0.54, and the priority weight of the target entity operation corresponding to candidate root cause 2 is 0.75 / 1.62≈0.46. The greater the priority weight, the earlier the corresponding operation is executed.

[0158] Step S155: Generate a preliminary operation sequence based on the priority weight and the adjusted operation step sequence, the preliminary operation sequence including an operation object identifier, an operation type, an execution time window, and an expected state parameter, and the execution time window is determined according to the entity dependency order.

[0159] The operation object identifier is the unique identification code of the target entity (such as PHY-SRV-001); the operation type is a specific operation action (such as checking, cleaning, restarting, etc.); the execution time window is determined according to the entity dependency order and the estimated execution time of the operation step, for example, the operation of APP-SVC-002 is estimated to take 5 minutes, and its execution time window is 10:00:00-10:05:00; the operation of APP-SVC-001 starts after the operation of APP-SVC-002 is completed, and its estimated execution time is 3 minutes, and its execution time window is 10:05:00-10:08:00; the operation of PHY-SRV-001 starts after the operation of APP-SVC-001 is completed, and its estimated execution time is 10 minutes, and its execution time window is 10:08:00-10:18:00. The expected state parameter is the state that the entity should reach after the operation is completed (such as the expected temperature of PHY-SRV-001 is 20-35 degrees Celsius).

[0160] Step S156: Perform conflict detection on the preliminary operation sequence, identify operation steps with the same operation object or resource competition, and adjust the execution order of conflicting operations based on priority weight.

[0161] If there are two operation steps in the preliminary operation sequence that target the same operation object (such as simultaneously performing restart and check operations on PHY-SRV-001), or the operation steps require the use of the same resource (such as the same maintenance terminal), it is determined that there is a conflict. According to the priority weight, the execution order of the conflicting operations is adjusted, and the operation with higher priority weight is executed first. For example, if the operation corresponding to candidate root cause 1 competes for the same resource as the operation corresponding to candidate root cause 2, and the priority weight of candidate root cause 1 is higher, then the operation corresponding to candidate root cause 1 is executed first.

[0162] Step S157: Merge the operation sequence after conflict processing and the priority weight to generate an operation decision instruction containing operation sequence number, target entity identifier, operation instruction content, priority order and expected completion time, the priority order of the operation decision instruction is positively correlated with the confidence score of the candidate root cause set, and the expected completion time is calculated by accumulating the estimated execution time of the operation step.

[0163] When merging the operation sequence after conflict processing and the priority weight, first assign a unique operation sequence number to each operation step, which is incremented in the order of operation execution. For example, the operation sequence after conflict processing is to cool down PHY-SRV-001, restart APP-SVC-001, and check the connection status of APP-SVC-002, and the corresponding operation sequence numbers are 001, 002, and 003, respectively.

[0164] The target entity identifier is the unique identifier code of the node that the operation is directed to, such as PHY-SRV-001, APP-SVC-001, etc. The operation instruction content is a specific operation description, such as "turn on the cooling fan of PHY-SRV-001 at maximum power to reduce the body temperature", "restart the APP-SVC-001 service", and "check whether the connection between APP-SVC-002 and APP-SVC-001 is restored to normal".

[0165] The priority ranking is determined according to the priority weight, and the operation step with a high priority weight is ranked first. Since the priority weight is positively correlated with the confidence score of the candidate root cause set, the operation step corresponding to the candidate root cause with a higher confidence score has a higher priority ranking.

[0166] The calculation of the expected completion time needs to determine the estimated execution duration of each operation step, which can be set according to historical operation records or experience data. For example, the estimated execution duration of the cooling process for PHY-SRV-001 is 10 minutes, the estimated execution duration of restarting APP-SVC-001 is 5 minutes, and the estimated execution duration of checking the connection status of APP-SVC-002 is 3 minutes. Taking the start time of the first operation step as the reference, the expected completion time of the first operation is the start time plus 10 minutes, the expected completion time of the second operation is the expected completion time of the first operation plus 5 minutes, and the expected completion time of the third operation is the expected completion time of the second operation plus 3 minutes. The cumulative calculation is performed in this way.

[0167] In the above manner, a complete operation and maintenance decision instruction is generated, which contains all the key information required for executing the operation and maintenance operation and can guide the system management terminal to accurately and orderly execute the automatic repair process.

[0168] Step S160: Send the operation and maintenance decision instruction to the system management terminal to trigger the automatic repair process.

[0169] Before sending the operation and maintenance decision instruction to the system management terminal, the instruction needs to be converted in format to conform to the format (such as XML format or specific API calling format) that the system management terminal can recognize. After conversion, the instruction is sent to the system management terminal through a secure communication protocol (such as HTTPS protocol).

[0170] After receiving the operation and maintenance decision instruction, the system management terminal analyzes the instruction content and executes the corresponding operation steps in sequence according to the operation sequence number and priority order. During the execution process, the system management terminal will feedback the operation execution state in real time (such as "operation 001 is executing", "operation 001 is completed", "operation 002 fails" and the like). If the operation execution fails, the system management terminal will retry according to the preset retry mechanism, and if the retry fails for multiple times, it will send an alarm information to the fault reasoning analysis system for further processing.

[0171] Through the above process, a closed loop from fault reasoning analysis to automatic repair is realized, and the efficiency and accuracy of distributed server cluster fault processing are improved.

[0172] Further, the method can further include the step S210 of pre-training the large language model.

[0173] Step S211: Collecting operation and maintenance field corpus data, the operation and maintenance field corpus data including historical fault handling records, system operation and maintenance manuals, technical documents and the like.

[0174] The collected historical fault handling records contain information such as phenomenon description, root cause analysis, processing process and results of various faults occurred in the past; the system operation and maintenance manual details the operation specification, fault troubleshooting method and the like of various system components; the technical documents include system architecture design documents, component interface documents, performance index description and the like. The above corpus data need to be screened and cleaned to remove invalid information (such as repeated content, unclear description) and sensitive information (such as data involving user privacy). For sensitive information, data desensitization technology is used for processing, such as replacing key identifiers, fuzzing processing and the like, to ensure data security.

[0175] Step S212: Preprocessing the collected operation and maintenance field corpus data, including word segmentation, part-of-speech tagging, entity recognition and relationship extraction and the like.

[0176] Word segmentation is to divide continuous text into independent words or lexical units, which is convenient for model processing. Part-of-speech tagging is to tag the part-of-speech of each word (such as noun, verb, adjective, etc.). Entity recognition is to identify system component entities, fault type entities, and other entities involved in the text. Relation extraction is to extract the relationship between entities (such as "deployed on", "call", "cause", etc.). For example, for the text "ServiceA is deployed on Server1, when Server1 has CPU overload, it can cause ServiceA response delay", after word segmentation, "ServiceA / deploy / in / Server1 / on / , / when / Server1 / has / CPU / overload / , / will / cause / ServiceA / response / delay / " is obtained; part-of-speech tagging is "ServiceA (noun) / deploy (verb) / in (preposition) / Server1 (noun) / on (auxiliary) / …"; entity recognition identifies "ServiceA", "Server1", "CPU overload", "response delay", etc. entities; and relation extraction obtains "ServiceA-deployed on-Server1", "Server1-appeared-CPU overload", "CPU overload-caused-response delay", etc. relationships.

[0177] Step S213: constructing pre-training tasks, the pre-training tasks including a mask language model task, a next sentence prediction task, and an operation and maintenance knowledge question and answer task.

[0178] The mask language model task is to randomly mask part of the words in the corpus, and let the model predict the masked words to enhance the model's understanding of the context semantics. The next sentence prediction task is to let the model judge whether two sentences are continuous context, to enhance the model's grasp of the logical relationship between sentences. The operation and maintenance knowledge question and answer task is to construct question and answer pairs based on operation and maintenance field corpus data (such as "Question: What application services may be abnormal due to server CPU overload? Answer: It may cause the application services deployed on the server to have response delay and concurrent processing capacity decline, etc."), and let the model generate answers according to the questions to enhance the model's application ability of operation and maintenance knowledge.

[0179] Step S214: based on the pre-processed operation and maintenance field corpus data and the constructed pre-training tasks, pre-training the basic large language model, adjusting the model parameters, until the performance of the model on the pre-training task reaches the preset index.

[0180] The base large language model can select a general Transformer architecture model. In the pre-training process, the pre-processed corpus data is input into the Transformer architecture model, the loss function is calculated according to the requirements of the pre-training task, and the weight parameters of the model are adjusted through the back propagation algorithm. The preset indicators include the prediction accuracy on the masked language model task, the classification accuracy on the next sentence prediction task, the answer similarity on the operation and maintenance knowledge question and answer task, etc. When the performance of the model on these indicators reaches the preset threshold, the pre-training is stopped, and the pre-trained large language model suitable for the operation and maintenance field is obtained.

[0181] Step S215: Fine-tuning the pre-trained large language model with partially labeled fault reasoning samples to further optimize the performance of the model on the fault reasoning task.

[0182] The labeled fault reasoning samples include semantic association network description, correct root cause reasoning result, and operation and maintenance decision suggestion, etc. In the fine-tuning process, the semantic association network description in the sample is taken as the model input, the correct root cause reasoning result and the operation and maintenance decision suggestion are taken as the expected output, the loss between the model output and the expected output is calculated, and the model parameters are adjusted by the gradient descent method. After fine-tuning, the model is evaluated, and if the accuracy, recall rate, etc. of the model on the fault reasoning task meet the requirements, the large language model used for fault reasoning analysis is determined.

[0183] Figure 2 A schematic diagram of exemplary hardware and software components of the large language model-based fault reasoning analysis system 100 that can implement the idea of the present application is shown. For example, the processor 120 can be used in the large language model-based fault reasoning analysis system 100 and used to perform the functions in the present application.

[0184] For example, the large language model-based fault reasoning analysis system 100 can include a network port 110 connected to a network, one or more processors 120 for executing program instructions, a communication bus 130, and different forms of storage media 140, such as a disk, a ROM, or a RAM, or any combination thereof. Exemplarily, the large language model-based fault reasoning analysis system 100 can also include program instructions stored in the ROM, the RAM, or other types of non-transitory storage media, or any combination thereof. The methods of the present application can be implemented according to these program instructions. The large language model-based fault reasoning analysis system 100 also includes an I / O interface 150 between the computer and other input / output devices.

[0185] In addition, the embodiment of the present application also provides a readable storage medium, wherein computer executable instructions are preset, and when a processor executes the computer executable instructions, the fault reasoning analysis method based on the large language model is realized.

[0186] It should be noted that, in order to simplify the expression of the present disclosure and help to understand one or more embodiments of the present application, in the foregoing description of the embodiments of the present application, various features are sometimes combined into one embodiment, figure or description thereof.

Claims

1. A large language model-based fault reasoning analysis method, characterized in that, The method comprises: acquiring a multi-source operation and maintenance data set of a system to be diagnosed, the multi-source operation and maintenance data set containing timestamp-ordered structured performance indicator data, semi-structured service log data and unstructured text description data; performing semantic enhancement on the multi-source operation and maintenance data set to obtain a semantic data unit containing entity semantic labels, relationship semantic labels and attribute semantic labels, the entity semantic labels corresponding to system component entities, the relationship semantic labels corresponding to inter-component interaction relationships, and the attribute semantic labels corresponding to entity state attributes; constructing a semantic association network based on the semantic data unit, the nodes of the semantic association network being the entity semantic labels, the directed edges between the nodes being the relationship semantic labels, and the edge weights being relationship strength parameters calculated based on the attribute semantic labels; calling a pre-trained large language model to perform root cause reasoning analysis on the semantic association network to generate a candidate root cause set ordered by confidence, the candidate root cause set containing potential cause entities of system abnormalities and corresponding association path descriptions; generating operation and maintenance decision instructions containing entity operation sequences and priority orders based on the candidate root cause set, and sending the operation and maintenance decision instructions to a system management terminal to trigger an automated repair process. 2.The large language model-based fault reasoning analysis method of claim 1, wherein, The semantic enhancement on the multi-source operation and maintenance data set to obtain a semantic data unit containing entity semantic labels, relationship semantic labels and attribute semantic labels comprises: performing index semantic mapping processing on the structured performance indicator data, extracting system component keywords in index names, generating entity semantic labels corresponding to the system component keywords based on a preset entity dictionary, the entity semantic labels containing component names, component levels and unique identification codes; performing log field structuring processing on semi-structured service log data, parsing source component fields, target component fields and interaction operation fields in log entries, and generating relationship semantic labels representing the calling direction and interaction type between components according to the verb meaning of the interaction operation fields, the relationship semantic labels containing source entity identifiers, target entity identifiers and relationship type codes; calling a large language model to perform semantic analysis processing on the unstructured text description data, identifying entity mentions, attribute descriptions and relationship assertions therein, performing consistency matching between entity mentions and the entity semantic labels, and mapping attribute descriptions and relationship assertions into attribute semantic labels containing attribute names, attribute values and timestamps and supplementary relationship semantic labels, respectively; performing redundancy detection processing on the entity semantic labels, relationship semantic labels and the supplementary relationship semantic labels, removing duplicate label entries and low-confidence label entries, the low-confidence label entries being label entries corresponding to a confidence score of the large language model output being lower than a preset confidence threshold. The fused de-redundant entity semantic label, relationship semantic label and attribute semantic label are fused to generate a semantic data unit containing label type identification, associated data source and timestamp information, each label entry of the semantic data unit is associated with a data segment index in the original multi-source operation and maintenance data set, and the data segment index is used to trace the original data position corresponding to the label. 3.The large language model-based fault reasoning analysis method of claim 2, wherein, The semantic analysis processing is performed on the non-structured text description data by calling a large language model, and entity mentions, attribute descriptions and relationship assertions in the non-structured text description data are identified, including: Text preprocessing is performed on the non-structured text description data to remove repeated characters, and the non-structured text description data is divided into multiple text segment units according to sentence boundaries, and each text segment unit is associated with a position index of the original non-structured text description data; A semantic analysis prompt template is constructed for each text segment unit, and the semantic analysis prompt template contains task description, entity type list, relationship type list and attribute type list; The text segment unit and the semantic analysis prompt template are spliced into model input text, a large language model is called to perform sequence labeling processing on the model input text, and an annotation result sequence containing entity annotation, attribute annotation and relationship annotation is generated, the entity annotation contains entity name and entity type, the attribute annotation contains attribute name, attribute value and belonging entity, and the relationship annotation contains source entity, target entity and relationship type; Entity linking processing is performed on the annotation result sequence, and the identified entity mentions are matched with standard entity names in a preset entity dictionary to generate standardized entity identifiers, the preset entity dictionary contains standard names and unique identification codes of all component entities in the system; Based on the standardized entity identifiers, the attribute annotation is associated with the corresponding entity to generate attribute semantic labels containing entity identifiers, attribute names, attribute values and extraction confidence; The source entity and the target entity in the relationship annotation are replaced by the standardized entity identifiers to generate supplementary relationship semantic labels containing source entity identifiers, target entity identifiers, relationship types and extraction confidence; The attribute semantic labels and the supplementary relationship semantic labels are integrated to generate a semantic analysis result set corresponding to the text segment unit, and each label entry in the semantic analysis result set is associated with a position index of the text segment unit. 4.The method of claim 1, wherein, The semantic association network is constructed based on the semantic data unit, including: All entity semantic labels in the semantic data unit are extracted as a network node set, each node is assigned a unique node identifier and a corresponding component type attribute, the component type attribute contains a hardware component type, a software component type and an external dependency type, each node is associated with a component name and a unique identification code in the corresponding entity semantic label; extracting a relationship semantic label in the semantic data unit to construct a set of directed edges between nodes, the set of directed edges representing an interaction direction between components, each directed edge being associated with a corresponding relationship type identifier, the relationship type identifier including a deployment relationship, a calling relationship, and a dependency relationship, a source node and a target node of each directed edge corresponding to a source entity identifier and a target entity identifier in the relationship semantic label; collecting attribute semantic labels in the semantic data unit as node attribute features, the node attribute features including a current state parameter, a historical state parameter, and a threshold range parameter, the current state parameter being an attribute value corresponding to a latest timestamp, and the historical state parameter being a sequence of attribute values within a preset time window; calculating a dynamic relationship weight of each directed edge based on the node attribute features, the dynamic relationship weight being a product of a current state parameter of a node and a relationship influence coefficient, the relationship influence coefficient being determined according to a preset weight matrix of the relationship type identifier, different relationship type identifiers corresponding to different initial values of the relationship influence coefficient; integrating the set of nodes, the set of directed edges, and the dynamic relationship weight into an initial semantic association network, and performing time slicing processing on the initial semantic association network according to timestamp information of the semantic data unit to generate a plurality of time-period semantic association network snapshots arranged in time sequence, each semantic association network snapshot corresponding to a network state within a time window; performing dynamic evolution analysis on the plurality of time-period semantic association network snapshots to calculate a change amount of node attribute features and a change rate of directed edge relationship weights between adjacent snapshots, and generating a semantic association network including a network topology evolution trend, the relationship weight in the semantic association network being updated in real time according to the node attribute features, and an update frequency being consistent with a collection frequency of the multi-source operation and maintenance data set. 5.The method of claim 4, wherein, The calculating of the dynamic relationship weight of each directed edge based on the node attribute features includes: extracting a current state parameter from the node attribute features as a node activity index, the node activity index including a CPU utilization rate, a memory occupancy rate, and a response time parameter, different groups of component type attributes corresponding to different combinations of activity indexes; querying a preset relationship influence coefficient matrix according to the relationship type identifier of the directed edge to obtain a basic influence coefficient corresponding to the relationship type identifier, different relationship type identifiers in the relationship influence coefficient matrix corresponding to basic influence coefficients in different numerical ranges; collecting a threshold range parameter in the node attribute features, calculating a ratio of the current state parameter to an upper threshold as a state deviation, the state deviation being the current state parameter divided by the upper threshold, and a numerical range being 0 to 1; multiplying the basic influence coefficient and the state deviation of the source node to obtain a preliminary relationship weight, the preliminary relationship weight reflecting an influence of a state of the source node on a relationship strength; collecting attribute semantic labels related to the directed edge in the semantic data unit, and extracting a change rate of an attribute value as a dynamic adjustment factor, the change rate being a difference between a current timestamp attribute value and a previous timestamp attribute value divided by a time interval; The preliminary relationship weight is added with a dynamic adjustment factor to obtain a dynamic relationship weight, a value range of the dynamic relationship weight is limited in a preset interval through normalization processing, and the normalization processing adopts a maximum minimum normalization method to map the weight value to a range of 0 to 1. 6.The method of claim 1, wherein, The pre-trained large language model is called to perform root cause inference analysis on the semantic association network to generate a candidate root cause set sorted by confidence, including: Network topology structure data of a current time is extracted from the semantic association network, the network topology structure data includes a node set, a directed edge set, a dynamic relationship weight and a current value of a node attribute feature, and the current value is a node state parameter corresponding to a latest time stamp; The network topology structure data is converted into a graph structure description text that can be parsed by the large language model, the graph structure description text includes a node identifier-component type corresponding table, a directed edge relationship type list and a natural language description of a dynamic relationship weight matrix, and the natural language description adopts a preset template to convert structured data into a text paragraph; The large language model is called to perform multiple rounds of inference processing on the graph structure description text, and an initial root cause hypothesis set is generated in the first round of inference, the initial root cause hypothesis set includes a potential abnormal node and a corresponding abnormal propagation path description; Based on multi-period semantic association network snapshots of the semantic association network, time sequence consistency verification is performed on the abnormal propagation paths in the initial root cause hypothesis set, a matching degree of attribute feature change trend of each node in the abnormal period and the propagation path is calculated, and the matching degree is a consistency score of the change direction of the node state parameter and the propagation direction of the path; According to the matching degree, a confidence score adjustment is performed on each hypothesis in the initial root cause hypothesis set, hypotheses with a matching degree higher than a preset matching degree threshold are retained, an intermediate root cause hypothesis set is generated, and the confidence score adjustment is a weighted sum of the original score and the matching degree; The large language model is called to perform conflict detection processing on the intermediate root cause hypothesis set, and hypotheses with logical contradictions are identified and removed, the logical contradiction refers to mutually exclusive propagation path descriptions of the same abnormal node, and the mutual exclusion refers to opposite propagation directions or relationship type conflicts; The intermediate root cause hypothesis set after conflict removal is sorted in descending order of confidence score, and a preset number of hypothesis entries in the sorted order are extracted as a candidate root cause set, the candidate root cause set includes a root cause entity identifier, an abnormal propagation path sequence and a confidence score, and the abnormal propagation path sequence is a node identifier list arranged in propagation order.

7. The large language model-based fault reasoning analysis method according to claim 6, characterized in that, Based on the multi-period semantic association network snapshots of the semantic association network, time sequence consistency verification is performed on the abnormal propagation paths in the initial root cause hypothesis set, a matching degree of attribute feature change trend of each node in the abnormal period and the propagation path is calculated, including: Multi-period semantic association network snapshots of an abnormal occurrence period are extracted from the semantic association network, the abnormal occurrence period is a preset time window before and after a system alarm triggering time stamp; For each abnormal propagation path sequence of each initial root cause hypothesis, the node identifiers in the abnormal propagation path are extracted in the propagation order to generate a node sequence list, the first node of the node sequence list being the root cause entity and the last node being the abnormal manifestation entity; For each node in the node sequence list, the attribute feature time sequence of the corresponding node in the abnormal occurrence period is extracted from the multi-period semantic association network snapshot, the attribute feature time sequence being a state parameter value set sorted by timestamp; The change trend slope of the attribute feature time sequence is calculated, the change trend slope being a slope value obtained by linear regression fitting, a positive value indicating an increase in the state parameter and a negative value indicating a decrease; According to the propagation direction of the abnormal propagation path, it is judged whether the change trend slope of the adjacent nodes meets the expected causal relationship; The proportion of the number of adjacent node pairs that meet the expected causal relationship in the total number of node pairs in the abnormal propagation path is counted as the matching degree, and the higher the matching degree, the stronger the time sequence consistency of the abnormal propagation path. 8.The method of claim 6, wherein, The large language model is called to perform conflict detection processing on the intermediate root cause hypothesis set, and hypothesis entries with logical contradictions are identified and removed, including: Each hypothesis entry in the intermediate root cause hypothesis set is converted into a logical expression, and the logical expression contains a root cause entity, a propagation path condition, and an abnormal phenomenon description; A conflict detection prompt template is constructed, and the conflict detection prompt template contains a task description, a conflict definition, and a hypothesis entry list; The logical expression and the conflict detection prompt template are spliced into a model input text, and the large language model is called to perform conflict judgment on the model input text to generate a conflict matrix between hypothesis entries, the conflict matrix being a two-dimensional matrix, and the matrix elements indicating whether there is a conflict between the corresponding two hypothesis entries; A conflict graph is constructed based on the conflict matrix, the nodes of the conflict graph being hypothesis entries, and the directed edges representing the conflict relationship between entries; A maximum conflict-free subset is selected for the conflict graph, and a subset containing the most hypothesis entries without mutual conflict is selected; Hypothesis entries not selected into the maximum conflict-free subset are removed from the intermediate root cause hypothesis set after conflict removal to generate a post-conflict intermediate root cause hypothesis set; The confidence score of the hypothesis entry after conflict removal is recalculated, and a hypothesis entry verified to have no conflict in the conflict detection process is scored with a preset reward value to improve its ranking priority. 9.The large language model-based fault reasoning analysis method of claim 1, wherein, The operation and maintenance decision instruction containing the entity operation sequence and priority sorting is generated according to the candidate root cause set, including: The root cause entity identifier and abnormal propagation path sequence corresponding to each candidate root cause in the candidate root cause set are analyzed to determine the target entity set requiring intervention operation and the dependency order between entities, and the dependency order being the reverse order of the abnormal propagation path sequence; The target entity set is queried based on the preset operation and maintenance manual to obtain the standard operation process corresponding to each target entity, and the standard operation process contains an operation step sequence, a precondition constraint, and an expected effect description, and the precondition constraint being an entity state parameter range that needs to be met before the operation is performed; The large language model is called to perform adaptability analysis on the standard operation process and the abnormal propagation path sequence, and the execution order of the operation steps is adjusted to match the reverse path of the abnormal propagation, so that the operation is performed in the order from the root cause entity to the end entity; According to the confidence score of the candidate root cause set, the priority weight of each target entity operation is determined, and the higher the confidence score, the greater the priority weight. The priority weight is used to determine the execution order of the operations corresponding to different candidate root causes; Based on the priority weight and the adjusted operation step sequence, a preliminary operation sequence is generated, which includes operation object identifiers, operation types, execution time windows, and expected state parameters. The execution time window is determined according to the entity dependency order; The preliminary operation sequence is subjected to conflict detection to identify operation steps with the same operation object or resource competition. The execution order of the conflicting operations is adjusted based on the priority weight; The operation sequence after conflict processing and the priority weight are fused to generate an operation decision instruction containing operation sequence number, target entity identifier, operation instruction content, priority sorting, and expected completion time. The priority sorting of the operation decision instruction is positively correlated with the confidence score of the candidate root cause set, and the expected completion time is calculated by accumulating the estimated execution time of the operation steps. 10.A system for failure reasoning analysis based on a large language model, characterized in that, The device comprises a processor and a memory. The memory and the processor are connected. The memory is used to store programs, instructions or codes. The processor is used to execute the programs, instructions or codes in the memory to realize the fault reasoning analysis method based on the large language model according to any one of claims 1-9.

Images