Fault diagnosis agent data preprocessing method and system based on multi-modal alignment

Abstract

The present application belongs to the field of software fault diagnosis, and provides a fault diagnosis intelligent agent data preprocessing method and system based on multi-modal alignment to solve the problems of information mismatch and low reasoning accuracy. The fault diagnosis intelligent agent data preprocessing method based on multi-modal alignment includes dynamic resampling of log event sequence; time-aligned index sequence and log event sequence; matching and calling tracking data of a set time period from cache data; constructing an entity relationship graph; real-time updating the entity relationship graph; processing the real-time updated entity relationship graph to obtain a spatio-temporal aligned index sequence, log event sequence and tracking data sequence; corresponding extracting index features, log features and tracking features and fusing them to obtain fused features; and converting the fused features into natural language descriptions as inputs of the fault diagnosis intelligent agent. The method can perform spatio-temporal alignment preprocessing on multi-modal data, and improve the accuracy and efficiency of fault diagnosis.

Description

Technical Field

[0001] This invention belongs to the field of software fault diagnosis, and in particular relates to a data preprocessing method and system for fault diagnosis intelligent agents based on multimodal alignment. Background Technology

[0002] The statements in this section are merely background information related to the present invention and do not necessarily constitute prior art.

[0003] For distributed architecture systems, the surge in the number of components and the complexity of their interactions highlight the high technical barriers and heavy workload involved in fault diagnosis and root cause localization. Current observability system tools can collect vast amounts of various observable data, such as metrics, log events, and traces. This multimodal data contains rich information about system operation and is crucial for fault diagnosis. However, the problem of data silos is significant, often exhibiting inconsistencies in time and space. This spatiotemporal inconsistency and low data integration mean that directly using this data for reasoning and diagnosis based on large language models can lead to information mismatch and low inference accuracy. Summary of the Invention

[0004] To address the aforementioned technical problems, this invention provides a data preprocessing method and system for fault diagnosis intelligent agents based on multimodal alignment. This method can perform spatiotemporal alignment preprocessing on multimodal data, thereby improving the accuracy and efficiency of subsequent fault diagnosis intelligent agent output results.

[0005] To achieve the above objectives, the present invention adopts the following technical solution:

[0006] The first aspect of the present invention provides a data preprocessing method for fault diagnosis intelligent agents based on multimodal alignment.

[0007] In one or more embodiments, a data preprocessing method for fault diagnosis intelligent agents based on multimodal alignment is provided, including:

[0008] The initial log events are mapped to a continuous time axis based on Gaussian kernel density estimation to construct a log event probability density field. The log event probability density field within a set time period is aggregated at the index sampling time point to achieve dynamic resampling of the log event sequence.

[0009] Time warping optimization is performed on the initial indicator sequence and the dynamically resampled log event sequence to obtain time-aligned indicator sequence and log event sequence, and tracking data for a set time period is retrieved from the cached data.

[0010] Entity identifiers and attributes are extracted from time-aligned metric sequences, log event sequences and their corresponding tracking data to serve as vertices, and the relationships between entities are used as edges to construct an entity relationship graph.

[0011] Continuously monitor the metric stream, log event stream, and tracking data stream to update the entity relationship graph in real time;

[0012] The trained graph neural network is used to process the real-time updated entity relationship graph to obtain spatiotemporally aligned indicator sequences, log event sequences, and tracking data sequences.

[0013] The indicator features, log features, and tracking features are extracted from the spatiotemporally aligned indicator sequence, log event sequence, and tracking data sequence, respectively, and then fused to obtain the fused features.

[0014] The fused features are converted into natural language descriptions and used as input to the fault diagnosis agent.

[0015] As one implementation method, a gating attention mechanism is used to dynamically weight and fuse indicator features, log features, and tracking features; the process is as follows:

[0016] Based on the indicator features, log features, and tracing features, the information entropy, error log density, and call chain depth of the indicator features are calculated respectively, and used as gating inputs;

[0017] The gating input is weighted using gating coefficients, and then the dynamic weights are calculated using the Sigmoid function.

[0018] The initial fused features are obtained by using an attention mechanism to initially fuse indicator features, log features, and tracking features;

[0019] The initial fusion features and the indicator features are summed with their corresponding weights to obtain the final fusion features. The weights of the initial fusion features are dynamic weights, and the weights of the indicator features are the difference between 1 and the dynamic weights.

[0020] As one implementation method, the lifespan of vertices and edges in the entity relationship graph is preset during the real-time updating process.

[0021] As one implementation method, if no data is received from an entity within a set lifespan, the entity is either softly deleted from the entity relationship graph or marked as invalid.

[0022] As one implementation method, the set time period for the aggregation of log event probability density field at the index sampling time point is: a set multiple of the perceived bandwidth of log event duration before and after the index sampling time point as the center time point.

[0023] As one implementation method, the expression for time warping optimization of the initial index sequence and the dynamically resampled log event sequence is as follows:

[0024] ;

[0025] in, To align the path, To control path smoothness; for Indicators at the sampling time point; for Log events at resampling time points; express Ranked in the index sampling time series indivual; express In the log event sequence of dynamic resampling, it ranks as the... indivual; Indicates the minimum value; It represents the 2-norm.

[0026] As one implementation method, the expression for aggregating the probability density field of log events within a set time period at the index sampling time point is:

[0027] ;

[0028] in, for Log events at resampling time points; The sampling time point for the initial index; This refers to the sampling time point of the initial log event; To estimate log events based on Gaussian kernel density The probability density field mapped to a continuous time axis; This represents a truth-valued logical function, when... The value is 1 if true; otherwise, the value is 0; parameter ; Bandwidth is sensed for the duration of log events; n represents the number of log events.

[0029] As one implementation method, log events are estimated based on Gaussian kernel density. probability density field mapped to continuous time axis The expression is:

[0030] ;

[0031] in, A floating-point vector for BERT-based multidimensional text embedding; It is represented by a multidimensional floating-point vector.

[0032] A second aspect of the present invention provides a fault diagnosis intelligent agent data preprocessing system based on multimodal alignment.

[0033] In one or more embodiments, a fault diagnosis intelligent agent data preprocessing system based on multimodal alignment includes:

[0034] The dynamic resampling module is used to map the initial log events to a continuous time axis based on Gaussian kernel density estimation, construct a log event probability density field, and aggregate the log event probability density field within a set time period at the index sampling time point to achieve dynamic resampling of the log event sequence.

[0035] The time alignment module is used to perform time warping optimization on the initial indicator sequence and the dynamically resampled log event sequence to obtain the time-aligned indicator sequence and log event sequence, and to retrieve the tracking data for a set time period from the cached data.

[0036] The graph construction module is used to extract entity identifiers and attributes from time-aligned indicator sequences, log event sequences and their corresponding matching tracking data as vertices, and use the relationships between entities as edges to construct an entity relationship graph.

[0037] The graph update module is used to continuously monitor the indicator stream, log event stream, and tracking data stream to update the entity relationship graph in real time.

[0038] The spatial alignment module is used to process the real-time updated entity relationship graph using a trained graph neural network to obtain spatiotemporally aligned indicator sequences, log event sequences, and tracking data sequences.

[0039] The feature fusion module is used to extract indicator features, log features, and tracking features from the spatiotemporally aligned indicator sequence, log event sequence, and tracking data sequence, respectively, and then fuse them to obtain fused features.

[0040] The feature transformation module is used to convert fused features into natural language descriptions and use them as input to the fault diagnosis agent.

[0041] A third aspect of the present invention provides an electronic device.

[0042] An electronic device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it implements the steps in the above-described method for data preprocessing of a fault diagnosis intelligent agent based on multimodal alignment.

[0043] Compared with the prior art, the beneficial effects of the present invention are:

[0044] The present invention provides a data preprocessing method and system for fault diagnosis intelligent agents based on multimodal alignment. This method dynamically resamples log event sequences, then performs time warping optimization on the initial indicator sequences and the dynamically resampled log event sequences. Next, it performs spatial alignment based on the time-aligned indicator sequences, log event sequences, and the constructed and real-time updated entity relationship graph. Finally, it fuses and transforms the spatiotemporally aligned features. This solves the problem of multimodal data silos during software system operation, which leads to spatiotemporal inconsistencies and low data fusion, ultimately resulting in information mismatch and low inference accuracy. The method enables spatiotemporal alignment preprocessing of multimodal data, improving the accuracy and efficiency of subsequent fault diagnosis intelligent agent output results. Attached Figure Description

[0045] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0046] Figure 1 This is a flowchart illustrating the data preprocessing method for fault diagnosis intelligent agents based on multimodal alignment according to an embodiment of the present invention.

[0047] Figure 2 This is a schematic diagram of the data preprocessing system for fault diagnosis intelligent agents based on multimodal alignment according to an embodiment of the present invention;

[0048] Figure 3 This is a schematic diagram of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0049] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0050] It should be noted that the following detailed description is illustrative and intended to provide further explanation of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0051] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of exemplary embodiments according to the invention. As used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise. Furthermore, it should be understood that when the terms "comprising" and / or "including" are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.

[0052] In the background technology, multimodal data exhibits inconsistencies in time and space. For example, metric data is typically collected at fixed time intervals, exhibiting relatively regular temporal characteristics; log data is generated when specific events occur in the system, with irregular timestamps and potentially large spans; trace data records the flow path of requests in a distributed system, and its temporal and spatial distribution is closely related to specific business processes, with the time deviation of the same fault event reaching the second level in different modalities. Numerical metrics, text logs, and graph-structured call chains cannot be directly integrated.

[0053] Figure 1 This is a flowchart illustrating a data preprocessing method for a fault diagnosis intelligent agent based on multimodal alignment, according to an embodiment of the present invention. Figure 1 The fault diagnosis agent data preprocessing method based on multimodal alignment shown in this embodiment may include the following steps S101 to S107.

[0054] The specific implementation process of steps S101 to S107 is as follows:

[0055] Step S101: Map the initial log events to a continuous time axis based on Gaussian kernel density estimation, construct a log event probability density field, and aggregate the log event probability density field within a set time period at the index sampling time point to achieve dynamic resampling of the log event sequence.

[0056] Assuming the initial index is sampled from a time series Initial log event time series ,satisfy Much larger than the sampling interval.

[0057] Specifically, log events are estimated based on Gaussian kernel density. probability density field mapped to continuous time axis The expression is:

[0058] ;

[0059] in, A floating-point vector of BERT-based multidimensional (e.g., dimension d=768) text embeddings; It is represented by a multidimensional floating-point vector. The sampling time point for the initial index; This refers to the sampling time point of the initial log event; To estimate log events based on Gaussian kernel density The probability density field mapped to a continuous time axis; Bandwidth is sensed for the duration of log events. ; A function to detect the duration of log events. It is a constant coefficient. The value is the scalar weight calculated by the Gaussian kernel function and the log event semantic embedding vector. The product of.

[0060] Specifically, at a certain point in time The set time period for the probability density field of aggregated log events is: taking the metric sampling time point as the center time point, and the interval before and after it is a multiple of the perceived bandwidth of the log event duration, for example, 3 times. Here, the set time period is... .

[0061] In the specific implementation process, the expression for aggregating the probability density field of log events within a set time period at the indicator sampling time point is:

[0062] ;

[0063] in, for Log events at resampling time points; The sampling time point for the initial index; This refers to the sampling time point of the initial log event; To estimate log events based on Gaussian kernel density The probability density field mapped to a continuous time axis; This represents a truth-valued logical function, when... The value is 1 if true; otherwise, the value is 0; parameter This covers a 99.7% probability range; Bandwidth is sensed for the duration of log events; n represents the number of log events.

[0064] Step S102: Perform time warping optimization on the initial indicator sequence and the dynamically resampled log event sequence to obtain a time-aligned indicator sequence and log event sequence, and retrieve the tracking data for the set time period from the cached data.

[0065] In the specific implementation process, the expression for time warping optimization of the initial indicator sequence and the dynamically resampled log event sequence is as follows:

[0066] ;

[0067] in, To align the path, To control path smoothness; for Indicators at the sampling time point; for Log events at resampling time points; express Ranked in the index sampling time series indivual; express In the log event sequence of dynamic resampling, it ranks as the... indivual; Indicates the minimum value; It represents the 2-norm.

[0068] Step S103: Extract entity identifiers and attributes from the time-aligned indicator sequence, log event sequence and their corresponding matching tracking data to use as vertices, and use the relationships between entities as edges to construct an entity relationship graph.

[0069] The vertices include metric vertices, log event vertices, and trace data vertices. The attributes of metric vertices include mean or variance; the attributes of log event vertices include semantic feature vectors obtained by embedding log templates or keywords; and the attributes of trace data vertices include throughput, P99 latency, error rate, etc.

[0070] In the specific implementation of step S103, a mapping dictionary can be established using a rule engine or by querying the cluster metadata API. Entity identifiers and attributes are extracted from the raw data and normalized, as shown in Table 1.

[0071] Table 1. Entity extraction from multimodal data;

[0072]

[0073] Static and dynamic relationships between entities are extracted from entity attributes and system metadata, and edges are constructed as shown in Table 2.

[0074] Table 2. Relationship extraction between entities;

[0075]

[0076] Choose a graph database (such as Neo4j, JanusGraph, NebulaGraph) to support complex queries and real-time topology updates.

[0077] Step S104: Continuously monitor the metric stream, log event stream, and tracking data stream to update the entity relationship graph in real time.

[0078] Specifically, during the real-time updating of the entity relationship graph, the time-to-live (TTL) of the vertices and edges of the entity relationship graph is preset. If no data for an entity is received within the preset TTL, it is either softly deleted from the entity relationship graph or marked as invalid.

[0079] Step S105: Use the trained graph neural network to process the real-time updated entity relationship graph to obtain spatiotemporally aligned indicator sequences, log event sequences, and tracking data sequences.

[0080] The graph neural network here can be implemented using either a graph convolutional network (GCN) or a graph attention network (GAT). The expression for a graph neural network can be:

[0081] ;

[0082] in:

[0083] , It is an adjacency matrix (obtained from the entity relationship graph). It is an identity matrix (with self-joins added); yes The degree matrix is ​​used for normalization; It is the first Vertex representation of the layer; It is a trainable weight matrix; It is a non-linear activation function (such as ReLU).

[0084] Step S106: Extract indicator features, log features, and tracking features from the spatiotemporally aligned indicator sequence, log event sequence, and tracking data sequence respectively, and fuse them to obtain fused features.

[0085] Specifically, 1D convolutional networks can be used to extract indicator features from spatiotemporally aligned indicator sequences. ;

[0086] Extracting log features from log event sequences using Bi-LSTM (Bidirectional Long Short-Term Memory) network It is a high-order semantic temporal feature vector. This vector encodes the semantic evolution sequence of log events within a time window (e.g., the fault evolution process from "Warning" to "Error" and then to "Timeout").

[0087] Extracting tracking features from tracking data sequences using graph convolutional networks It is a high-order topological feature vector that represents the topological structure and performance status of the call chain related to the current entity within the time window.

[0088] In the specific implementation process, a gating attention mechanism is used to dynamically weight and fuse indicator features, log features, and tracking features; the process is as follows:

[0089] Step S1061: Based on indicator characteristics Log characteristics and tracking features The information entropy of the corresponding indicator features is calculated respectively. Error log density and call chain depth and as a gating input ;

[0090] Step S1062: Utilize the gating coefficient The gated inputs are weighted, and then the dynamic weights are calculated using the Sigmoid function.

[0091] Step S1063: Initial fused features are obtained by initially fusing indicator features, log features, and tracking features through an attention mechanism;

[0092] ;

[0093] Where: Q represents the generated query (Query), Project onto a new vector space to generate a representation that is more suitable for querying. Layer normalization operation. Normalizes the projected vectors to stabilize the training process and accelerate convergence.

[0094] K is the generation key. These are the feature vectors extracted from the Log and Trace modalities, respectively. For the concatenation operation, the feature vectors of Log and Trace are simply concatenated together to form a longer joint feature vector.

[0095] Attn is used to calculate attention weights. To calculate similarity, the dot product of the query vector and the key vector is calculated to obtain a similarity score (the higher the score, the more relevant the corresponding key is to the current query, i.e., the metric state). This is a scaling factor used to scale the similarity scores before Softmax to prevent gradient vanishing. The Softmax function normalizes the scaled similarity scores into a probability distribution (attention weights), where the sum of all weights is 1; the larger the weight value, the more important the corresponding Log / Trace information.

[0096] V stands for Value, which is the Log / Trace information filtered and focused through an attention mechanism. It can be understood as the context information most relevant to the current metric state. It is the i-th component of the attention weight vector. It is the i-th component of the Key vector. It is a weighted summation, which sums the key vectors according to the attention weights.

[0097] Z represents the initial fusion feature, which includes the original metric information and the most relevant Log / Trace context information.

[0098] Step S1064: Sum the initial fusion features and index features with their corresponding weights to obtain the final fusion features. Among them, the initial fusion features The weights are dynamic weights. Indicator characteristics The difference between the weight of 1 and the dynamic weight ; .

[0099] Step S107: Convert the fused features into a natural language description and use it as input to the fault diagnosis agent.

[0100] like Figure 2 As shown, the fault diagnosis intelligent agent data preprocessing system based on multimodal alignment provided in this embodiment of the invention can be implemented in software. The fault diagnosis intelligent agent data preprocessing system based on multimodal alignment includes the following software modules: dynamic resampling module 201, time alignment module 202, map construction module 203, map update module 204, spatial alignment module 205, feature fusion module 206, and feature transformation module 207.

[0101] The functions of each software module in the fault diagnosis intelligent agent data preprocessing system based on multimodal alignment are described below:

[0102] The dynamic resampling module 201 is used to map the initial log events to a continuous time axis based on Gaussian kernel density estimation, construct a log event probability density field, and aggregate the log event probability density field within a set time period at the index sampling time point to realize dynamic resampling of the log event sequence.

[0103] The time alignment module 202 is used to perform time warping optimization on the initial indicator sequence and the dynamically resampled log event sequence to obtain a time-aligned indicator sequence and log event sequence, and to retrieve tracking data for a set time period from the cached data.

[0104] The graph construction module 203 is used to extract entity identifiers and attributes from time-aligned indicator sequences, log event sequences and their corresponding matching tracking data as vertices, and use the relationships between entities as edges to construct an entity relationship graph.

[0105] The graph update module 204 is used to continuously monitor the indicator stream, log event stream and tracking data stream to update the entity relationship graph in real time.

[0106] The spatial alignment module 205 is used to process the real-time updated entity relationship graph using a trained graph neural network to obtain a spatiotemporally aligned index sequence, log event sequence, and tracking data sequence.

[0107] The feature fusion module 206 is used to extract indicator features, log features and tracking features from the spatiotemporally aligned indicator sequence, log event sequence and tracking data sequence respectively and fuse them to obtain fused features;

[0108] Feature conversion module 207 is used to convert fused features into natural language descriptions and use them as input to the fault diagnosis agent.

[0109] It should be noted that each module in the fault diagnosis intelligent agent data preprocessing system based on multimodal alignment in this embodiment corresponds one-to-one with each step in the fault diagnosis intelligent agent data preprocessing method based on multimodal alignment in the above embodiment, and their specific implementation processes are the same, so they will not be repeated here.

[0110] The structure of the electronic device according to an embodiment of the present invention will be described in detail below. Figure 3 This is a schematic diagram of the composition structure of an electronic device provided in an embodiment of the present invention. It can be understood that... Figure 3 The diagram shows only an exemplary structure of the electronic device, not the entire structure. Some or all of the structures shown may be implemented as needed.

[0111] The electronic device provided in this embodiment of the invention includes: at least one processor 301, a memory 302, a user interface 303, and at least one network interface 304. The various components in the multimodal alignment-based fault diagnosis intelligent agent data preprocessing system are coupled together via a bus system 305. It can be understood that the bus system 305 is used to realize the connection and communication between these components. In addition to a data bus, the bus system 305 also includes a power bus, a control bus, and a status signal bus. However, for clarity, in... Figure 3 The general designated all buses as Bus System 305.

[0112] The user interface 303 may include a monitor, keyboard, mouse, trackball, click wheel, buttons, touchpad, or touch screen.

[0113] It is understood that memory 302 can be volatile memory or non-volatile memory, or both. In this embodiment of the invention, memory 302 is capable of storing data to support the operation of the terminal. Examples of this data include any computer programs used to operate on the terminal, such as operating systems and applications. The operating system includes various system programs, such as framework layers, core library layers, driver layers, etc., used to implement various basic services and handle hardware-based tasks. Applications can include various applications.

[0114] In some embodiments, the fault diagnosis intelligent agent data preprocessing system based on multimodal alignment provided in this invention can be implemented using a combination of hardware and software. For example, the fault diagnosis intelligent agent data preprocessing system based on multimodal alignment provided in this invention can be a processor in the form of a hardware decoding processor, programmed to execute the fault diagnosis intelligent agent data preprocessing method based on multimodal alignment provided in this invention. For instance, the processor in the form of a hardware decoding processor can employ one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field-programmable gate arrays (FPGAs), or other electronic components.

[0115] As an example, processor 301 can be an integrated circuit chip with signal processing capabilities, such as a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc., wherein the general-purpose processor can be a microprocessor or any conventional processor, etc.

[0116] As an example of the hardware implementation of the fault diagnosis intelligent agent data preprocessing system based on multimodal alignment provided in this embodiment of the invention, the device provided in this embodiment of the invention can be directly executed by a processor 301 in the form of a hardware decoding processor. For example, it can be executed by one or more application specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field-programmable gate arrays (FPGAs), or other electronic components to implement the fault diagnosis intelligent agent data preprocessing method based on multimodal alignment provided in this embodiment of the invention.

[0117] The memory 302 in this embodiment of the invention is used to store various types of data to support the operation of a fault diagnosis intelligent agent data preprocessing system based on multimodal alignment, or to store data for execution. Figure 1 The program code for the method shown. Examples of this data include: any executable instructions for operation on a multimodal alignment-based fault diagnosis agent data preprocessing system, such as executable instructions that can be included in the executable instructions to implement the multimodal alignment-based fault diagnosis agent data preprocessing method of the embodiments of the present invention.

[0118] Specifically, according to embodiments of this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program including functions for executing... Figure 1 The program code for the method shown. In such an embodiment, the computer program can be downloaded and installed from a network via a communication component, and / or installed from a removable medium. When the computer program is executed by the central processing unit, it performs the various functions defined in the apparatus of this application.

[0119] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, as well as combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart. Figure 1One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0120] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A data preprocessing method for fault diagnosis intelligent agents based on multimodal alignment, characterized in that, include: The initial log events are mapped to a continuous time axis based on Gaussian kernel density estimation, constructing a log event probability density field. This probability density field is then aggregated at the index sampling time point for a set time period to achieve dynamic resampling of the log event sequence. The expression for aggregating the log event probability density field for a set time period at the index sampling time point is as follows: ;in, for Log events at resampling time points; The sampling time point for the initial index; This refers to the sampling time point of the initial log event; To estimate log events based on Gaussian kernel density The probability density field mapped to a continuous time axis; This represents a truth-valued logical function, when... The value is 1 if true; otherwise, the value is 0; parameter ; Bandwidth is sensed for the duration of log events; n represents the number of log events; The initial indicator sequence and the dynamically resampled log event sequence are time-warped to obtain a time-aligned indicator sequence and log event sequence. Tracking data for a specified time period is then retrieved from the cached data. The expression for the time-warping optimization of the initial indicator sequence and the dynamically resampled log event sequence is as follows: ;in, To align the path, To control path smoothness; for Indicators at the sampling time point; for Log events at resampling time points; express Ranked in the index sampling time series indivual; express In the log event sequence of dynamic resampling, it ranks as the... indivual; Indicates the minimum value; Represents the 2-norm; Entity identifiers and attributes are extracted from time-aligned metric sequences, log event sequences and their corresponding tracking data to serve as vertices, and the relationships between entities are used as edges to construct an entity relationship graph. Continuously monitor the metric stream, log event stream, and tracking data stream to update the entity relationship graph in real time; The trained graph neural network is used to process the real-time updated entity relationship graph to obtain spatiotemporally aligned indicator sequences, log event sequences, and tracking data sequences. The system extracts and fuses indicator features, log features, and tracking features from spatiotemporally aligned indicator sequences, log event sequences, and tracking data sequences to obtain fused features. Specifically, it dynamically weights and fuses these features using a gating attention mechanism. The process is as follows: Based on the indicator features, log features, and tracking features, the information entropy, error log density, and call chain depth of each feature are calculated and used as gating inputs. The gating inputs are weighted using gating coefficients, and dynamic weights are calculated using the Sigmoid function. The initial fused features are obtained by initially fusing the indicator features, log features, and tracking features using the attention mechanism. The initial fused features and indicator features are summed with their corresponding weights to obtain the final fused features. The weights of the initial fused features are dynamic weights, and the weights of the indicator features are the difference between 1 and the dynamic weights. The fused features are converted into natural language descriptions and used as input to the fault diagnosis agent.

2. The data preprocessing method for fault diagnosis intelligent agents based on multimodal alignment as described in claim 1, characterized in that, During the real-time updating of the entity relationship graph, the lifespan of the vertices and edges of the entity relationship graph is preset.

3. The data preprocessing method for fault diagnosis intelligent agents based on multimodal alignment as described in claim 2, characterized in that, If no data is received from an entity within the set lifetime, it is either softly deleted from the entity relationship graph or marked as invalid.

4. The data preprocessing method for fault diagnosis intelligent agents based on multimodal alignment as described in claim 1, characterized in that, The set time period for the probability density field of aggregated log events at the indicator sampling time point is: a multiple of the perceived bandwidth of the log event duration before and after the indicator sampling time point as the center time point.

5. The data preprocessing method for fault diagnosis intelligent agents based on multimodal alignment as described in claim 1, characterized in that, Log events are estimated using Gaussian kernel density. probability density field mapped to continuous time axis The expression is: ； in, A floating-point vector for BERT-based multidimensional text embedding; It is represented by a multidimensional floating-point vector.

6. A data preprocessing system for fault diagnosis intelligent agents based on multimodal alignment, characterized in that, include: The dynamic resampling module maps initial log events to a continuous time axis based on Gaussian kernel density estimation, constructs a log event probability density field, and aggregates the log event probability density field within a set time period at the index sampling time point to achieve dynamic resampling of the log event sequence; wherein, the expression for aggregating the log event probability density field within a set time period at the index sampling time point is: ;in, for Log events at resampling time points; The sampling time point for the initial index; This refers to the sampling time point of the initial log event; To estimate log events based on Gaussian kernel density The probability density field mapped to a continuous time axis; This represents a truth-valued logical function, when... The value is 1 if true; otherwise, the value is 0; parameter ; Bandwidth is sensed for the duration of log events; n represents the number of log events; The time alignment module is used to perform time warping optimization on the initial indicator sequence and the dynamically resampled log event sequence to obtain a time-aligned indicator sequence and log event sequence, and to retrieve tracking data for a set time period from the cached data; wherein, the expression for performing time warping optimization on the initial indicator sequence and the dynamically resampled log event sequence is: ;in, To align the path, To control path smoothness; for Indicators at the sampling time point; for Log events at resampling time points; express Ranked in the index sampling time series indivual; express In the log event sequence of dynamic resampling, it ranks as the... indivual; Indicates the minimum value; Represents the 2-norm; The graph construction module is used to extract entity identifiers and attributes from time-aligned indicator sequences, log event sequences and their corresponding matching tracking data as vertices, and use the relationships between entities as edges to construct an entity relationship graph. The graph update module is used to continuously monitor the indicator stream, log event stream, and tracking data stream to update the entity relationship graph in real time. The spatial alignment module is used to process the real-time updated entity relationship graph using a trained graph neural network to obtain spatiotemporally aligned indicator sequences, log event sequences, and tracking data sequences. The feature fusion module extracts and fuses indicator features, log features, and tracking features from spatiotemporally aligned indicator sequences, log event sequences, and tracking data sequences to obtain fused features. Specifically, it dynamically weights and fuses indicator features, log features, and tracking features using a gating attention mechanism. The process is as follows: based on the indicator features, log features, and tracking features, the information entropy, error log density, and call chain depth of the indicator features are calculated respectively, and used as gating inputs; the gating inputs are weighted using gating coefficients, and then dynamic weights are calculated using the Sigmoid function; the initial fused features are obtained by initially fusing the indicator features, log features, and tracking features through the attention mechanism; the initial fused features and indicator features are summed with their corresponding weights to obtain the final fused features; where the weights of the initial fused features are dynamic weights, and the weights of the indicator features are the difference between 1 and the dynamic weights. The feature transformation module is used to convert fused features into natural language descriptions and use them as input to the fault diagnosis agent.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps in the fault diagnosis agent data preprocessing method based on multimodal alignment as described in any one of claims 1-5.

Images