Fault diagnosis agent data preprocessing method and system based on multi-modal alignment

Abstract

The invention belongs to the field of software fault diagnosis, and provides a fault diagnosis agent data preprocessing method and system based on multi-modal alignment in order to solve the problems of information mismatching and low reasoning accuracy. The fault diagnosis agent data preprocessing method based on multi-modal alignment comprises the following steps: dynamically resampling a log event sequence; according to the index sequence and the log event sequence which are aligned in time, tracking data in a set time period are matched and called from the cache data; constructing an entity relationship graph; updating the entity relation graph in real time; processing the entity relation graph updated in real time to obtain an index sequence, a log event sequence and a tracking data sequence which are aligned in time and space; the index features, the log features and the tracking features are correspondingly extracted and fused, and fused features are obtained; and converting the fusion features into natural language description as input of a fault diagnosis agent. Space-time alignment preprocessing can be carried out on multi-modal data, and the accuracy and efficiency of fault diagnosis are improved.

Description

TECHNICAL FIELD

[0001] The present application belongs to the field of software fault diagnosis, and particularly relates to a fault diagnosis intelligent agent data preprocessing method and system based on multi-modal alignment. BACKGROUND

[0002] The statements in this section merely provide background information related to the present application and do not necessarily constitute prior art.

[0003] For a distributed architecture system, the number of components is increasing and the interaction relationship is complex, resulting in the problems of high threshold and heavy workload of fault diagnosis and root cause positioning technology. Current observability system tools can collect a large amount of various types of observability data, such as Metric (indicator), Log (log event), Trace (trace) and other modal data. These multi-modal data contain rich information of system operation and are an important basis for fault diagnosis. However, the multi-modal data island problem is prominent, and there is usually inconsistency in the time and space dimensions. This inconsistency in time and space and low data fusion degree, if these data are directly used for inference diagnosis based on large language models, will cause information mismatch, low inference accuracy and other problems. SUMMARY

[0004] In order to solve the above technical problems, the present application provides a fault diagnosis intelligent agent data preprocessing method and system based on multi-modal alignment, which can perform time and space alignment preprocessing on multi-modal data, and improve the accuracy and efficiency of the output results of the subsequent fault diagnosis intelligent agent.

[0005] In order to achieve the above purpose, the present application adopts the following technical solutions: The first aspect of the present application provides a fault diagnosis intelligent agent data preprocessing method based on multi-modal alignment.

[0006] In one or more embodiments, a fault diagnosis intelligent agent data preprocessing method based on multi-modal alignment is provided, comprising: mapping the initial log events to a continuous time axis according to Gaussian kernel density estimation, constructing a log event probability density field, and aggregating the log event probability density field within a set time period at the indicator sampling time point to realize dynamic resampling of the log event sequence; performing time normalization optimization on the initial indicator sequence and the dynamically resampled log event sequence to obtain a time-aligned indicator sequence and a log event sequence, and matching and calling trace data of a set time period from the cache data; extracting entity identifiers and attributes from the time-aligned indicator sequence, the log event sequence and the matching corresponding trace data as vertices, and constructing an entity relationship graph by taking the relationship between entities as edges; Continuously monitor the index stream, log event stream and tracking data stream to update the entity relationship graph in real time; Use the trained graph neural network to process the real-time updated entity relationship graph to obtain the spatio-temporal aligned index sequence, log event sequence and tracking data sequence; From the spatio-temporal aligned index sequence, log event sequence and tracking data sequence, respectively, extract the index feature, log feature and tracking feature and fuse them to obtain the fused feature; Convert the fused feature into natural language description and use it as the input of the fault diagnosis intelligent agent.

[0007] As an implementation, dynamically weight the index feature, log feature and tracking feature through the gated attention mechanism; the process is as follows: According to the index feature, log feature and tracking feature, respectively, calculate the information entropy of the index feature, error log density and call chain depth, and use them as the gated input; Use the gating coefficient to weight the gated input, and then use the Sigmoid function to calculate the dynamic weight; Preliminarily fuse the index feature, log feature and tracking feature through the attention mechanism to obtain the initial fused feature; Sum the initial fused feature and the index feature with the corresponding weights to obtain the final fused feature; wherein the weight of the initial fused feature is the dynamic weight, and the weight of the index feature is the difference between 1 and the dynamic weight.

[0008] As an implementation, in the process of updating the entity relationship graph in real time, the survival time of the vertices and edges of the entity relationship graph is set in advance.

[0009] As an implementation, when no data of a certain entity is received within the set survival time, it is soft deleted or marked as invalid from the entity relationship graph.

[0010] As an implementation, the set time period of the log event probability density field at the index sampling time point is: the set multiple of the log event duration sensing bandwidth is centered on the index sampling time point.

[0011] As an implementation, the expression for time normalization optimization of the initial index sequence and the dynamically resampled log event sequence is: ; Wherein, is the alignment path, is the control path smoothness; is the index at the sampling time point; is log events at the resampling time point; denotes the first in the sequence of log events at the dynamic resampling time point; denotes the first in the sequence of log events at the dynamic resampling time point; denotes the minimum value; denotes the 2-norm.

[0012] As an implementation, the expression of the log event probability density field in a set time period at the index sampling time point is: ; wherein, is log events at the resampling time point; is the sampling time point of the initial index; is the sampling time point of the initial log event; is the probability density field of mapping the log events to the continuous time axis according to the Gaussian kernel density estimation; denotes the true value logic judgment function, and the value is 1 when it is true; otherwise, the value is 0; the parameter ; is the log event duration-aware bandwidth; n denotes the number of log events. As an implementation, the expression of the probability density field of mapping the log events to the continuous time axis according to the Gaussian kernel density estimation

[0013] is: ; ; wherein, is a floating-point number vector based on BERT multi-dimensional text embedding; characterized by a multi-dimensional floating-point number vector.

[0014] The second aspect of the present application provides a multi-modal alignment-based fault diagnosis agent data preprocessing system.

[0015] In one or more embodiments, a multi-modal alignment-based fault diagnosis agent data preprocessing system comprises: a dynamic resampling module configured to map the initial log events to the continuous time axis according to the Gaussian kernel density estimation, construct the log event probability density field, and aggregate the log event probability density field in a set time period at the index sampling time point to realize the dynamic resampling of the sequence of log events; ​​a time alignment module for time alignment optimization of the initial indicator sequence and the dynamically resampled log event sequence, to obtain a time-aligned indicator sequence and a log event sequence, and to match and call tracking data of a set time period from the cache data; a graph construction module for extracting entity identifiers and attributes from the time-aligned indicator sequence, the log event sequence and the corresponding matching tracking data as vertices, and constructing an entity relationship graph from the relationships between entities as edges; a graph update module for continuously monitoring the indicator stream, the log event stream and the tracking data stream to update the entity relationship graph in real time; a space alignment module for processing the real-time updated entity relationship graph using a trained graph neural network to obtain a spatio-temporally aligned indicator sequence, log event sequence and tracking data sequence; a feature fusion module for extracting and fusing indicator features, log features and tracking features from the spatio-temporally aligned indicator sequence, log event sequence and tracking data sequence, respectively, to obtain fused features; a feature conversion module for converting the fused features into natural language descriptions and taking them as inputs of the fault diagnosis intelligent agent.

[0016] The third aspect of the application provides an electronic device.

[0017] An electronic device includes a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor implements the steps of the multi-modal alignment-based fault diagnosis intelligent agent data preprocessing method as described above when executing the program.

[0018] Compared with the prior art, the application has the following advantages: The multi-modal alignment-based fault diagnosis intelligent agent data preprocessing method and system provided by the application can dynamically resample the log event sequence, then perform time alignment optimization on the initial indicator sequence and the dynamically resampled log event sequence, and then perform space alignment according to the time-aligned indicator sequence, log event sequence, constructed entity relationship graph and real-time updated entity relationship graph, and finally fuse and convert the spatio-temporally aligned features, thereby solving the problem of multi-modal data islands in the running process of a software system, the inconsistency of multi-modal data in time and space, and the low data fusion degree, which ultimately leads to information mismatch and low reasoning accuracy. The application can perform spatio-temporal alignment preprocessing on multi-modal data, and improve the accuracy and efficiency of the output results of the subsequent fault diagnosis intelligent agent. BRIEF DESCRIPTION OF DRAWINGS

[0019] The accompanying drawings, which form a part of this specification, are included to provide a further understanding of the application and are incorporated in and constitute a part of this specification. The embodiments of the application, together with its

[0020] Figure 1 is a flowchart of a multi-modal alignment-based fault diagnosis agent data preprocessing method according to an embodiment of the application; Figure 2 is a structural diagram of a multi-modal alignment-based fault diagnosis agent data preprocessing system according to an embodiment of the application; Figure 3 is a schematic diagram of an electronic device according to an embodiment of the application. DETAILED DESCRIPTION

[0021] The application will be further described below in conjunction with the drawings and embodiments.

[0022] It should be noted that the following detailed description is illustrative only and is not intended to limit the application as described herein. Other embodiments of the application will readily occur to those skilled in the art. The application is not limited in its application to the details set forth in the description below and / or illustrated in the drawings. The application will be described in conjunction with the attached drawings and embodiments.

[0023] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the example embodiments of the application. As used herein, the singular forms "a", "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms "comprises" and / or "comprising," when used in this specification, specify the presence of stated features, steps, operations, elements, and / or components, but do not preclude the presence or addition of one or more other features, steps, operations, elements, components, and / or groups thereof.

[0024] In the background art, the inconsistency of multi-modal data in time and space dimensions, for example, Metric data is usually collected at fixed time intervals, with relatively regular time characteristics; Log data is generated by the system when a specific event occurs, with irregular timestamps and possibly large spans; Trace data records the flow path of requests in a distributed system, with time and space distribution closely related to specific business processes, and the time deviation of the same fault event in different modalities can reach seconds. Numerical indicators, text logs, and graph structure call chains cannot be directly fused.

[0025] Figure 1 is a flowchart of a multi-modal alignment-based fault diagnosis agent data preprocessing method according to an embodiment of the application, as shown in Figure 1 The multi-modal alignment-based fault diagnosis agent data preprocessing method according to the embodiment can include the following steps S101-S107.

[0026] The specific implementation process of steps S101 to S107 is as follows: Step S101: Map the initial log events to a continuous time axis based on Gaussian kernel density estimation, construct a log event probability density field, and aggregate the log event probability density field within a set time period at the index sampling time point to achieve dynamic resampling of the log event sequence.

[0027] Assuming the initial index is sampled from a time series Initial log event time series ,satisfy Much larger than the sampling interval.

[0028] Specifically, log events are estimated based on Gaussian kernel density. probability density field mapped to continuous time axis The expression is: ; in, A floating-point vector of BERT-based multidimensional (e.g., dimension d=768) text embeddings; It is represented by a multidimensional floating-point vector. The sampling time point for the initial index; This refers to the sampling time point of the initial log event; To estimate log events based on Gaussian kernel density The probability density field mapped to a continuous time axis; Bandwidth is sensed for the duration of log events. ; A function to detect the duration of log events. It is a constant coefficient. The value is the scalar weight calculated by the Gaussian kernel function and the log event semantic embedding vector. The product of.

[0029] Specifically, at a certain point in time The set time period for the probability density field of aggregated log events is: taking the metric sampling time point as the center time point, and the interval before and after it is a multiple of the perceived bandwidth of the log event duration, for example, 3 times. Here, the set time period is... .

[0030] In the specific implementation process, the expression for aggregating the probability density field of log events within a set time period at the indicator sampling time point is: ; in, for Log events at resampling time points; The sampling time point for the initial index; This refers to the sampling time point of the initial log event; To estimate log events based on Gaussian kernel density The probability density field mapped to a continuous time axis; This represents a truth-valued logical function, when... The value is 1 if true; otherwise, the value is 0; parameter This covers a 99.7% probability range; Bandwidth is sensed for the duration of log events; n represents the number of log events.

[0031] Step S102: Perform time warping optimization on the initial indicator sequence and the dynamically resampled log event sequence to obtain a time-aligned indicator sequence and log event sequence, and retrieve the tracking data for the set time period from the cached data.

[0032] In the specific implementation process, the expression for time warping optimization of the initial indicator sequence and the dynamically resampled log event sequence is as follows: ; in, To align the path, To control path smoothness; for Indicators at the sampling time point; for Log events at resampling time points; express Ranked in the index sampling time series indivual; express In the log event sequence of dynamic resampling, it ranks as the... indivual; Indicates the minimum value; It represents the 2-norm.

[0033] Step S103: Extract entity identifiers and attributes from the time-aligned indicator sequence, log event sequence and their corresponding matching tracking data to use as vertices, and use the relationships between entities as edges to construct an entity relationship graph.

[0034] The vertices include metric vertices, log event vertices, and trace data vertices. The attributes of metric vertices include mean or variance; the attributes of log event vertices include semantic feature vectors obtained by embedding log templates or keywords; and the attributes of trace data vertices include throughput, P99 latency, error rate, etc.

[0035] In the implementation of step S103, a mapping dictionary can be established using a rule engine or a query cluster metadata API. Entity identifiers and attributes are extracted from the raw data and normalized, as shown in Table 1.

[0036] Table 1. Multi-modal data entity extraction

[0037] Static and dynamic relationships between entities are extracted from entity attributes and system metadata to construct edges, as shown in Table 2.

[0038] Table 2. Relationship extraction between entities

[0039] A graph database (such as Neo4j, JanusGraph, or Nebula Graph) is selected to support complex queries and real-time topology updates.

[0040] Step S104: Continuously monitor the indicator stream, log event stream, and tracking data stream to update the entity relationship graph in real time.

[0041] Specifically, in the process of updating the entity relationship graph in real time, the survival time (such as TTL, Time To Live) of the vertices and edges of the entity relationship graph is set in advance. When no data of a certain entity is received within the set survival time, it is soft-deleted or marked as invalid from the entity relationship graph.

[0042] Step S105: Use the trained graph neural network to process the real-time updated entity relationship graph to obtain the spatio-temporal aligned indicator sequence, log event sequence, and tracking data sequence.

[0043] The graph neural network can be implemented using a graph convolutional network (GCN) or a graph attention network (GAT). The expression of the graph neural network can be: where: is the adjacency matrix (obtained from the entity relationship graph), is the identity matrix (adding self-connection); is the degree matrix of for normalization; is the vertex representation of the layer; is the trainable weight matrix; is a nonlinear activation function (such as ReLU).

[0044] ​​Step S106: Extracting index features, log features and trace features from the spatio-temporally aligned index sequence, log event sequence and trace data sequence respectively and fusing them to obtain fused features.

[0045] Specifically, index features can be extracted from the spatio-temporally aligned index sequence by using a 1D convolutional network ; Log features are extracted from the log event sequence by using a Bi-LSTM (Bidirectional Long Short-Term Memory network) , which is a high-order semantic time sequence feature vector. The vector encodes the semantic evolution sequence of the log event within a time window (for example: a fault evolution process from "Warning" to "Error" to "Timeout").

[0046] Trace features are extracted from the trace data sequence by using a graph convolutional network , which is a high-order topological feature vector representing the topological structure and performance state of the call chain related to the current entity within a time window.

[0047] In the specific implementation process, the index features, log features and trace features are dynamically weighted and fused by a gated attention mechanism; the process is as follows: Step S1061: According to the index features , log features and trace features , the information entropy of the index features, error log density and call chain depth are calculated respectively and used as gated inputs ; Step S1062: The gated inputs are weighted by using a gating coefficient , and the dynamic weight is calculated by using a Sigmoid function; Step S1063: The initial fused features obtained by preliminarily fusing the index features, log features and trace features by using an attention mechanism; ; Wherein: Q is a generated query (Query), which projects into a new vector space to generate a more suitable representation for query (Query). Layer normalization operation. The projected vector is normalized to stabilize the training process and accelerate convergence.

[0048] K is a generated key Key, which are feature vectors extracted from Log and Trace modalities respectively. For the concatenation operation, the feature vectors of Log and Trace are simply concatenated together to form a longer joint feature vector.

[0049] Attn is the attention weight, For the similarity calculation, the dot product of Query vector and Key vector is calculated to get a similarity score (the higher the score, the more relevant the corresponding Key is to the current Query, i.e. Metric state). For the scaling factor, it is used to scale the similarity score before Softmax to prevent gradient vanishing. The Softmax function is used to normalize the scaled similarity score into a probability distribution (attention weight), and the sum of all weights is 1; the greater the weight value, the more important the corresponding Log / Trace information.

[0050] V is the generated value, which is the Log / Trace information filtered and focused by the attention mechanism, and can be understood as the most relevant context information to the current Metric state. is the i-th component of the attention weight vector. is the i-th component of the Key vector. is the weighted sum, which is the weighted sum of the Key vector according to the attention weight.

[0051] Z is the initial fusion feature, which contains the original Metric information and the most relevant Log / Trace context information.

[0052] Step S1064: The initial fusion feature and the indicator feature are respectively added to the corresponding weight to get the final fusion feature ; wherein the weight of the initial fusion feature is the dynamic weight , and the weight of the indicator feature is the difference between 1 and the dynamic weight ; .

[0053] Step S107: The fusion feature is converted into a natural language description and used as the input of the fault diagnosis intelligent agent.

[0054] As shown in Figure 2 , the multi-modal alignment-based fault diagnosis intelligent agent data preprocessing system provided by the embodiment of the application can be implemented in a software manner, and the multi-modal alignment-based fault diagnosis intelligent agent data preprocessing system includes the following software modules: a dynamic resampling module 201, a time alignment module 202, a graph construction module 203, a graph update module 204, a spatial alignment module 205, a feature fusion module 206, and a feature conversion module 207.

[0055] The functions of each software module in the multi-modal alignment-based fault diagnosis agent data preprocessing system are introduced as follows: The dynamic resampling module 201 is configured to map the initial log events to a continuous time axis according to Gaussian kernel density estimation, construct a log event probability density field, aggregate the log event probability density field in a set time period at an index sampling time point, and realize dynamic resampling of the log event sequence. The time alignment module 202 is configured to perform time normalization optimization on the initial index sequence and the dynamically resampled log event sequence to obtain a time-aligned index sequence and a time-aligned log event sequence, and match and call tracking data in a set time period from the cache data. The graph construction module 203 is configured to extract entity identifiers and attributes from the time-aligned index sequence, the time-aligned log event sequence, and the matching corresponding tracking data as vertices, and extract the relationship between entities as edges to construct an entity relationship graph. The graph update module 204 is configured to continuously monitor the index stream, the log event stream, and the tracking data stream to update the entity relationship graph in real time. The space alignment module 205 is configured to process the real-time updated entity relationship graph using a trained graph neural network to obtain a time-space aligned index sequence, a time-space aligned log event sequence, and a time-space aligned tracking data sequence. The feature fusion module 206 is configured to extract index features, log features, and tracking features from the time-space aligned index sequence, the time-space aligned log event sequence, and the time-space aligned tracking data sequence, respectively, and fuse them to obtain fused features. The feature conversion module 207 is configured to convert the fused features into natural language descriptions and use them as inputs of the fault diagnosis agent.

[0056] It should be noted that each module in the multi-modal alignment-based fault diagnosis agent data preprocessing system of the embodiment of the present application corresponds to each step in the multi-modal alignment-based fault diagnosis agent data preprocessing method of the above embodiment one by one, and the specific implementation process is the same, which will not be repeated here.

[0057] The structure of the electronic device of the embodiment of the present application is described in detail as follows, Figure 3 The composition structure diagram of the electronic device provided by the embodiment of the present application can be understood, Figure 3 Only exemplary structures of the electronic device are shown, not all structures, and part or all of the structures shown can be implemented as needed.

[0058] The electronic device provided by the embodiment of the present application comprises at least one processor 301, a memory 302, a user interface 303 and at least one network interface 304. The various components in the multi-modal alignment-based fault diagnosis intelligent agent data preprocessing system are coupled together through a bus system 305. It can be understood that the bus system 305 is used to realize the connection communication between the components. In addition to the data bus, the bus system 305 also includes a power bus, a control bus and a state signal bus. However, for the purpose of clear illustration, all the buses are marked as the bus system 305 in the Figure 3

[0059] The user interface 303 can include a display, a keyboard, a mouse, a trackball, a click wheel, a key, a button, a touchpad or a touch screen, etc.

[0060] It can be understood that the memory 302 can be a volatile memory or a non-volatile memory, and can also include both volatile and non-volatile memories. The memory 302 in the embodiment of the present application can store data to support the operation of the terminal. Examples of these data include any computer programs used for operation on the terminal, such as an operating system and an application program. The operating system contains various system programs, such as a framework layer, a core library layer, a driver layer, etc., for realizing various basic services and processing hardware-based tasks. The application program can include various application programs.

[0061] In some embodiments, the multi-modal alignment-based fault diagnosis intelligent agent data preprocessing system provided by the embodiment of the present application can be realized in a combination of software and hardware. As an example, the multi-modal alignment-based fault diagnosis intelligent agent data preprocessing system provided by the embodiment of the present application can be a processor in the form of a hardware decoding processor, which is programmed to execute the multi-modal alignment-based fault diagnosis intelligent agent data preprocessing method provided by the embodiment of the present application. For example, the processor in the form of a hardware decoding processor can use one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field-programmable gate arrays (FPGAs) or other electronic elements.

[0062] ​As an example, the processor 301 can be an integrated circuit chip having a processing capability of signals, such as a general-purpose processor, a digital signal processor (DSP), or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, etc., wherein the general-purpose processor can be a microprocessor or any conventional processor.

[0063] As an example of the hardware implementation of the multi-modal alignment-based fault diagnosis agent data preprocessing system provided by the embodiments of the present application, the apparatus provided by the embodiments of the present application can be directly implemented by a hardware decoding processor form of the processor 301, for example, by one or more application specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field programmable gate arrays (FPGAs), or other electronic components to implement the multi-modal alignment-based fault diagnosis agent data preprocessing method provided by the embodiments of the present application.

[0064] The memory 302 in the embodiments of the present application is used to store various types of data to support the operation of the multi-modal alignment-based fault diagnosis agent data preprocessing system, or to store program codes for executing the methods shown in the embodiments of the present application. Figure 1 Examples of these data include any executable instructions for operating on the multi-modal alignment-based fault diagnosis agent data preprocessing system, such as executable instructions, and the program implementing the multi-modal alignment-based fault diagnosis agent data preprocessing method of the embodiments of the present application can be included in the executable instructions.

[0065] In particular, according to the embodiments of the present application, the processes described above with reference to the flowcharts can be implemented as a computer software program. For example, the embodiments of the present application include a computer program product including a computer program carried on a computer readable medium, and the computer program includes program codes for executing the methods shown in the embodiments of the present application. Figure 1 In such embodiments, the computer program can be downloaded and installed from a network by a communication part, and / or installed from a detachable medium. When the computer program is executed by the central processing unit, various functions defined in the apparatus of the present application are executed.

[0066] The computer program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other processing device to cause a series of operational steps to be performed on the computer, other programmable apparatus or other processing device to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide processes for implementing the functions specified in the flowchart block or blocks. Figure 1 The flowchart and / or block diagram in the variation of the present application can be implemented by computer program instructions. These program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processing apparatus, or other programmable data processing apparatus to produce a machine, so that the instructions, which are executed via the processor of the computer or other programmable data processing apparatus, generate a means for implementing the functions specified in the flowchart and / or block diagram block or blocks. Figure 1 Figure 1 The flowchart and / or block diagram in the variation of the present application can be implemented by computer program instructions. These program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processing apparatus, or other programmable data processing apparatus to produce a machine, so that the instructions, which are executed via the processor of the computer or other programmable data processing apparatus, generate a means for implementing the functions specified in the flowchart and / or block diagram block or blocks.

[0067] The above merely provides the preferred embodiment of the present application, but should not be used to limit the present application. The present application can be variously changed and modified by those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall fall within the scope of the present application.

Claims

1. A data preprocessing method for fault diagnosis intelligent agents based on multimodal alignment, characterized in that, include: The initial log events are mapped to a continuous time axis based on Gaussian kernel density estimation to construct a log event probability density field. The log event probability density field within a set time period is aggregated at the index sampling time point to achieve dynamic resampling of the log event sequence. Time warping optimization is performed on the initial indicator sequence and the dynamically resampled log event sequence to obtain time-aligned indicator sequence and log event sequence, and tracking data for a set time period is retrieved from the cached data. Entity identifiers and attributes are extracted from time-aligned metric sequences, log event sequences and their corresponding tracking data to serve as vertices, and the relationships between entities are used as edges to construct an entity relationship graph. Continuously monitor the metric stream, log event stream, and tracking data stream to update the entity relationship graph in real time; The trained graph neural network is used to process the real-time updated entity relationship graph to obtain spatiotemporally aligned indicator sequences, log event sequences, and tracking data sequences. The indicator features, log features, and tracking features are extracted from the spatiotemporally aligned indicator sequence, log event sequence, and tracking data sequence, respectively, and then fused to obtain the fused features. The fused features are converted into natural language descriptions and used as input to the fault diagnosis agent.

2. The data preprocessing method for fault diagnosis intelligent agents based on multimodal alignment as described in claim 1, characterized in that, Dynamically weighted and fused indicator features, log features, and tracking features through a gating attention mechanism; The process is as follows: Based on the indicator features, log features, and tracing features, the information entropy, error log density, and call chain depth of the indicator features are calculated respectively, and used as gating inputs; The gating input is weighted using gating coefficients, and then the dynamic weights are calculated using the Sigmoid function. The initial fused features are obtained by using an attention mechanism to initially fuse indicator features, log features, and tracking features; The initial fusion features and the indicator features are summed with their corresponding weights to obtain the final fusion features. The weights of the initial fusion features are dynamic weights, and the weights of the indicator features are the difference between 1 and the dynamic weights.

3. The data preprocessing method for fault diagnosis intelligent agents based on multimodal alignment as described in claim 1, characterized in that, During the real-time updating of the entity relationship graph, the lifespan of the vertices and edges of the entity relationship graph is preset.

4. The data preprocessing method for fault diagnosis intelligent agents based on multimodal alignment as described in claim 3, characterized in that, If no data is received from an entity within the set lifetime, it is either softly deleted from the entity relationship graph or marked as invalid.

5. The data preprocessing method for fault diagnosis intelligent agents based on multimodal alignment as described in claim 1, characterized in that, The set time period for the probability density field of aggregated log events at the indicator sampling time point is: a multiple of the perceived bandwidth of the log event duration before and after the indicator sampling time point as the center time point.

6. The data preprocessing method for fault diagnosis intelligent agents based on multimodal alignment as described in claim 1, characterized in that, The expression for time warping optimization of the initial indicator sequence and the dynamically resampled log event sequence is as follows: ； in, To align the path, To control path smoothness; for Indicators at the sampling time point; for Log events at resampling time points; express Ranked in the index sampling time series indivual; express In the log event sequence of dynamic resampling, it ranks as the... indivual; Indicates the minimum value; It represents the 2-norm.

7. The data preprocessing method for fault diagnosis intelligent agents based on multimodal alignment as described in claim 1, characterized in that, The expression for aggregating the probability density field of log events within a set time period at the metric sampling time point is: ； in, for Log events at resampling time points; The sampling time point for the initial indicators; This refers to the sampling time point of the initial log event; To estimate log events based on Gaussian kernel density The probability density field mapped to a continuous time axis; This represents a truth-valued logical function, when... The value is 1 if true; otherwise, the value is 0; parameter ; Bandwidth is sensed for the duration of log events; n represents the number of log events.

8. The data preprocessing method for fault diagnosis intelligent agents based on multimodal alignment as described in claim 7, characterized in that, Log events are estimated using Gaussian kernel density. probability density field mapped to continuous time axis The expression is: ； in, A floating-point vector for BERT-based multidimensional text embedding; It is represented by a multidimensional floating-point vector.

9. A data preprocessing system for fault diagnosis intelligent agents based on multimodal alignment, characterized in that, include: The dynamic resampling module is used to map the initial log events to a continuous time axis based on Gaussian kernel density estimation, construct a log event probability density field, and aggregate the log event probability density field within a set time period at the index sampling time point to achieve dynamic resampling of the log event sequence. The time alignment module is used to perform time warping optimization on the initial indicator sequence and the dynamically resampled log event sequence to obtain the time-aligned indicator sequence and log event sequence, and to retrieve the tracking data for a set time period from the cached data. The graph construction module is used to extract entity identifiers and attributes from time-aligned indicator sequences, log event sequences and their corresponding matching tracking data as vertices, and use the relationships between entities as edges to construct an entity relationship graph. The graph update module is used to continuously monitor the indicator stream, log event stream, and tracking data stream to update the entity relationship graph in real time. The spatial alignment module is used to process the real-time updated entity relationship graph using a trained graph neural network to obtain spatiotemporally aligned indicator sequences, log event sequences, and tracking data sequences. The feature fusion module is used to extract indicator features, log features, and tracking features from the spatiotemporally aligned indicator sequence, log event sequence, and tracking data sequence, respectively, and then fuse them to obtain fused features. The feature transformation module is used to convert fused features into natural language descriptions and use them as input to the fault diagnosis agent.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps in the fault diagnosis agent data preprocessing method based on multimodal alignment as described in any one of claims 1-8.

Images