Alarm event root cause analysis method, device and equipment based on large language model and service topology

Abstract

The invention relates to an alarm event root cause analysis method, device and equipment based on a large language model and business topology, and the method comprises the steps: based on an analysis engine, according to an alarm event sent by an alarm system, obtaining an association node set, collecting multi-source data, generating a preliminary context packet, carrying out the extraction of abnormal information according to the preliminary context packet, and carrying out the analysis of the abnormal information. And generating a refined context package by removing irrelevant node information, and generating an interpretable root cause analysis report through large language model constraint and reasoning based on the constructed large language cue word template. According to the method, the initial context packet covering the fault propagation link is constructed based on the service topological graph, rapid modeling of the context is achieved, the high-frequency error mode template is generated through clustering, irrelevant nodes are dynamically pruned to generate the refined context packet, accurate focusing and data filtering are achieved, and the fault propagation efficiency is improved. And embedding the refined evidence chain through a structured cue word template, and driving the large language model to output an interpretable root cause report.

Description

Technical Field

[0001] This application relates to the field of event root cause analysis technology, and in particular to a method, apparatus and equipment for alarm event root cause analysis based on a large language model and business topology. Background Technology

[0002] As enterprises deepen their digital transformation, business system architectures are becoming increasingly complex and distributed. The widespread adoption of microservices and cloud-native technologies has brought severe challenges to root cause analysis. Current mainstream solutions mainly rely on two types of technologies: static analysis based on rule engines and traditional machine learning algorithm analysis. Rule engine solutions (such as threshold alarm correlation) match abnormal indicators (such as CPU over-limit triggering alarms) through predefined policies. Although simple to implement, they have significant limitations: their rule base is difficult to cover multi-node cascading failure scenarios, and changes in business topology (such as service link adjustments) require manual reconfiguration of rules, leading to rigid operations and maintenance. Traditional algorithms (such as Apriori-based association analysis or PageRank-based graph propagation algorithms) can partially identify node influence relationships, but they reveal three major flaws in practical implementation: First, a lack of semantic understanding; the algorithms cannot parse business semantics in log text (such as "database connection pool exhausted" or "service call timeout"), and can only process structured indicators, leading to the omission of key fault clues. Second, fragmented multi-source heterogeneous data; indicator data (time-series values), logs (unstructured text), and configuration information (key-value pairs) need to be modeled separately, lacking a unified representation method, resulting in low efficiency for manual correlation. Third, black-box decision-making and maintenance burden; the algorithm model relies on experts to construct feature engineering, and the output is only a probabilistic list of root cause nodes, lacking traceable reasoning logic, and topology adjustments require model retraining, resulting in high operation and maintenance costs. Although some improved solutions attempt to introduce business topology graphs to locate anomaly propagation paths (such as calculating node influence based on service dependency graphs), they are still limited to structured indicator analysis, only performing simple keyword filtering on unstructured data such as logs, failing to achieve semantic-level information fusion. More fundamentally, existing technologies all belong to the static analysis paradigm—relying on preset rules or historical training data, which cannot adapt to the real-time reasoning needs in dynamic business environments, ultimately leading to insufficient fault location accuracy and an unexplainable analysis process.

[0003] In summary, existing root cause analysis technologies suffer from the following systemic bottlenecks: First, the silo effect of multi-source data: metrics, logs, and configuration data belong to independent systems, requiring operations personnel to manually correlate evidence across multiple platforms, which is time-consuming and error-prone, especially in distributed systems where it's difficult to quickly construct a global fault context. Second, the inability to process unstructured data: traditional algorithms cannot understand the semantic information in logs (such as service call chains in error stacks), and analysis relying solely on numerical metrics is prone to misjudgment (e.g., log errors but metrics not exceeding thresholds). Third, insufficient dynamic adaptability: rules and models are strongly coupled to specific topology states; when business architecture is adjusted (e.g., service splitting or adding middleware), rules must be manually reconfigured or data labeled for retraining, resulting in poor agility. Fourth, a lack of interpretability: existing AI models (such as random forests and neural networks) cannot provide logical reasoning chains and supporting evidence when outputting root cause nodes, making it difficult for operations personnel to verify the credibility of results and hindering rapid decision-making. These problems collectively lead to a persistently high Mean Time To Repair (MTTR), severely restricting enterprises' business continuity assurance capabilities. Summary of the Invention

[0004] This application provides a root cause analysis method for alarm events based on a large language model and business topology, characterized by including: Based on the analysis engine, the associated node set is obtained and multi-source data is collected according to the alarm events sent by the alarm system to generate a preliminary context packet; Anomaly information is extracted from the initial context packet, and a refined context packet is generated by removing irrelevant node information. Based on the constructed large language cue word template, an interpretable root cause analysis report is generated through constraints and reasoning of the large language model.

[0005] Optionally, the step of using the analysis engine to obtain a set of associated nodes and collect multi-source data based on alarm events sent by the alarm system, and generating a preliminary context packet, includes: Based on the alarm event information, identify the directly associated initial fault node; Starting from the initial fault node, the process expands along the dependency relationship based on the preset business topology map to obtain all nodes that may be affected and cause problems, and generates a set of related nodes. By collecting multi-source data from the associated node set, the indicator data, log data and configuration information of each node in the set are obtained, and a preliminary context package is generated after aggregation.

[0006] Optionally, the step of extracting abnormal information based on the preliminary context packet and generating a refined context packet by removing irrelevant node information includes: Based on the metric data of each node in the preliminary context packet, detect abnormal data fluctuations during the alarm period and extract abnormal data features; Aggregate the error logs and warning logs of each node during the alarm period, process the data using a clustering algorithm, and generate high-frequency error pattern templates. Remove nodes whose metrics are normal and do not exhibit high-frequency error patterns during abnormal periods to form a set of key nodes and generate a refined context package.

[0007] Optionally, the constructed large language cue word template, through constraints and reasoning of a large language model, generates an explainable root cause analysis report, including: Based on the constructed large language prompt word template, the refined context package is embedded in a structured manner and output in a structured manner according to the template constraints; Generate a visual analysis report based on the structured output content.

[0008] Optionally, the aggregation of error logs and warning logs of each node during the alarm period, and the data processing through a clustering algorithm to generate a high-frequency error pattern template, includes: For error and warning logs within the alarm period, remove dynamic parameters from the logs and retain the fixed semantic template in the log text; Similar logs are grouped using a clustering algorithm. The most frequently occurring static text skeleton prefixes and suffixes are obtained from the clusters to generate high-frequency error pattern templates.

[0009] Optionally, the removal of nodes whose metrics were normal and did not exhibit high-frequency error patterns during the abnormal period, forming a key node set, and generating a refined context package includes: Based on the summary of abnormal indicators and high-frequency error patterns of each node in the associated node set, anomaly scores for each node are generated by weighting, with weights dynamically allocated according to the indicator type and log pattern severity. If the anomaly score of a node is lower than the preset anomaly judgment threshold, these nodes are removed, and a set of key nodes is formed based on the retained nodes. A refined context package is generated based on the set of key nodes, the summary of abnormal indicators, and the template of high-frequency error patterns.

[0010] Optionally, the step of structurally embedding the refined context package according to the constructed large language prompt word template and outputting it in a structured manner according to the template constraints includes: The refined context package is read through the large language model to obtain compressed and refined semantic evidence, and a preset large language prompt word template is input. Content constraints are applied based on the large language prompt word template to form structured output.

[0011] This application also provides a root cause analysis device for alarm events based on a large language model and business topology, characterized in that the device includes: The dynamic topology sensing module, based on the analysis engine, obtains the set of associated nodes and collects multi-source data according to the alarm events sent by the alarm system, and generates a preliminary context packet; The multi-source evidence refinement module extracts abnormal information from the preliminary context packet and generates a refined context packet by removing irrelevant node information. The Explainable Root Cause Generation Module generates an Explainable Root Cause Analysis Report based on the constructed large language cue word template and through constraints and reasoning of the large language model.

[0012] Optionally, the multi-source evidence refinement module includes: The indicator summary module is used to extract statistical values ​​for abnormal periods and replace the original time series. The log aggregation module is used to cluster error logs and retain high-frequency error pattern templates; The topology pruning module is used to retain only the critical nodes in the fault propagation path and remove irrelevant branches.

[0013] This application also provides an electronic device, characterized in that it is used to implement any of the aforementioned alarm event root cause analysis methods based on large language models and business topologies, comprising: The processor is used to execute all computationally intensive tasks and implement a root cause analysis method for alarm events based on a large language model and business topology. Memory is used to store processor-executable instructions and statically stored data.

[0014] The beneficial effects of this application are as follows: This application constructs a preliminary context package covering the fault propagation link by dynamically diffusing the associated node set based on the business topology graph and integrating multi-source data collection, thereby realizing rapid modeling of fault context in complex systems; it generates high-frequency error pattern templates and a multi-source weighted anomaly scoring mechanism by aggregating log semantic clustering, dynamically pruning irrelevant nodes to generate a refined context package, thereby achieving precise focus of analysis scope and filtering of noisy data; and it drives the output of interpretable root cause reports by embedding a refined evidence chain with a structured prompt word template, thereby achieving transparency in the fault diagnosis process and improving decision-making efficiency. Attached Figure Description

[0015] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the accompanying drawings required in the description of the embodiments or the prior art are briefly introduced below. Obviously, the accompanying drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0016] Figure 1 A flowchart illustrating a specific embodiment of the alarm event root cause analysis method based on a large language model and business topology according to this application is shown. Figure 2 This paper illustrates a system architecture diagram of an alarm event root cause analysis method based on a large language model and business topology according to a specific embodiment of this application. Figure 3 This diagram illustrates the information interaction of an alarm event root cause analysis method based on a large language model and business topology according to a specific embodiment of this application. Figure 4 This diagram illustrates the structural block diagram of an alarm event root cause analysis method based on a large language model and business topology according to a specific embodiment of this application. Detailed Implementation

[0017] Various exemplary embodiments, features, and aspects of this application will now be described in detail with reference to the accompanying drawings. The same reference numerals in the drawings denote elements that have the same or similar functions. Although various aspects of the embodiments are shown in the drawings, they are not necessarily drawn to scale unless specifically indicated otherwise.

[0018] The terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this application, "multiple" means two or more, unless otherwise explicitly specified.

[0019] The term “exemplary” as used herein means “serving as an example, embodiment, or illustration.” Any embodiment illustrated herein as “exemplary” is not necessarily to be construed as superior to or better than other embodiments.

[0020] Furthermore, to better illustrate this application, numerous specific details are provided in the following detailed embodiments. Those skilled in the art should understand that this application can be implemented without certain specific details. In some instances, methods, means, components, and circuits well-known to those skilled in the art have not been described in detail in order to highlight the main points of this application.

[0021] This application proposes a root cause analysis method for alarm events based on a large language model and business topology to address the challenges of low efficiency and uninterpretable results in fault location within complex business systems. This application improves the inference accuracy and interpretability of the large language model through semantic-level fusion and compression of multi-source heterogeneous data (metrics / logs / configurations). First, a root sound analysis engine locates the initial node based on the alarm event, expands along the business dependency graph to construct a set of related nodes, and collects multi-source data in real time to generate a preliminary context package. Second, through a multi-source data aggregation mechanism, high-frequency error templates and abnormal fluctuation features of metrics are extracted through unsupervised log clustering, and irrelevant nodes are dynamically pruned using weighted scoring to generate a refined context package with a high compression ratio. Finally, through a large language analysis platform, refined evidence is embedded into segmented prompt word templates to constrain the large model to output a visual report.

[0022] Example 1 like Figure 1 The diagram shown is a flowchart of an alarm event root cause analysis method based on a large language model and business topology according to an embodiment of this application, which specifically includes the following: The S100, based on the analysis engine, obtains the set of associated nodes and collects multi-source data according to the alarm events sent by the alarm system, and generates a preliminary context packet.

[0023] Specifically, the initial fault node directly associated with the alarm event is used as the starting point for root cause analysis. Using a pre-defined business topology map, bidirectional diffusion occurs along node dependencies, traversing the service call chain downstream and tracing the caller upstream, while also covering shared resource nodes, thus forming a set of associated nodes, the scope of which is dynamically defined by topological connectivity. Subsequently, multi-source data collection is performed on each member within the node set: time-series indicator data is obtained from the monitoring system, raw log streams are extracted from the log system, and service versions and deployment parameters are retrieved from the configuration management library. These three types of heterogeneous data are aggregated along the node dimension to form a preliminary context package, which is essentially a set of original evidence covering potential fault propagation paths.

[0024] S200: Extract anomaly information based on the preliminary context packet, and generate a refined context packet by removing irrelevant node information.

[0025] Specifically, the process begins by parsing the indicator data in the initial context package. Abnormal fluctuation patterns are detected within the alarm time window, and quantitative features deviating from the baseline range are extracted. Simultaneously, node logs are processed, cleaning dynamic variables such as timestamps and unique IDs while retaining the static semantic skeleton. Unsupervised clustering is then used to group similar logs, extracting frequently occurring common text patterns as error pattern templates. Based on these results, multi-source evidence fusion decision-making is implemented. For each member in the node set, its abnormal indicator status and error pattern occurrence are considered to determine whether it belongs to a key influencing node. Nodes with normal indicators and no high-frequency error patterns are removed, generating a key node set. The final refined context package contains the key node topology, anomaly indicator summaries, and error pattern templates, completing the transformation from raw data to a semantic evidence chain.

[0026] S300, based on the constructed large language cue word template, generates an interpretable root cause analysis report through large language model constraints and reasoning.

[0027] Specifically, the semantic evidence in the refined context package—namely, key node topology, anomaly indicator features, and error pattern templates—is embedded with pre-built structured cue word templates. These templates include some instructional constraints, such as role definitions, task objectives, contextual structured embedding rules, and output format specifications. The large language model performs inference based on these template constraints, parses topological dependencies to derive propagation paths, associates anomalies with error patterns to construct causal chains, and ultimately outputs a natural language report that conforms to human cognitive logic. The report is required to cite input evidence to ensure the traceability of conclusions.

[0028] In summary, this solution overcomes the limitations of data silos and static models in traditional root cause analysis, constructing an intelligent diagnostic system that integrates dynamic topology awareness, multi-source evidence refinement, and interpretable reasoning. First, addressing the inefficiency of manually correlating fault context, a dynamic diffusion mechanism based on business topology is designed. By locating the initial node through alarm events, it traverses upstream and downstream nodes and shared resources bidirectionally along service dependencies, automatically constructing a set of associated nodes. Simultaneously, it collects three types of heterogeneous data—indicators, logs, and configurations—to generate a preliminary context package, fully covering the original evidence of the fault propagation path and providing a panoramic input foundation for analysis. Second, addressing the challenge of inaccurate analysis scope due to noise interference, a multi-source fusion refinement decision-making mechanism is established. By extracting abnormal fluctuation features of indicators and log semantic templates (generated through dynamic variable cleaning and unsupervised clustering), it comprehensively determines the abnormal state of nodes. Based on multi-source evidence weighted scoring, it dynamically prunes irrelevant nodes, generating a refined context package containing only key nodes and semantic evidence, achieving precise focus on the analysis target and information entropy compression. Finally, addressing the uninterpretable output of black-box models, a structured constraint-based reasoning pipeline is developed. Refined evidence is embedded into predefined prompt word templates, and the large language model is driven by triple constraints of role instructions, task objectives, and format specifications. It is required to deduce the propagation path based on topological dependencies, construct causal chains with related indicators and log features, and generate human-readable segmented reports by referencing input evidence, so as to achieve traceability of the fault diagnosis process and transparency of decision-making.

[0029] As one possible implementation, in step S100, based on the analysis engine, according to the alarm events sent by the alarm system, the associated node set is obtained and multi-source data is collected to generate a preliminary context packet, including: S101, Based on the alarm event information, determine the directly associated initial fault node.

[0030] Specifically, such as Figure 2 As shown, based on the metadata (alarm type, resource ID, timestamp, etc.) carried by the alarm event, the topology mapping service locates the directly associated initial fault node in the preset business topology map. This process relies on the topology node identification system: each node is identified by a unique service ID, and a bidirectional index is established with the resource entity in the monitoring system. The resource ID in the alarm event is converted into a topology node ID by the identifier resolution engine to ensure accurate mapping. If the alarm is associated with multiple nodes, the core node is selected according to the alarm propagation weight model, prioritizing the node with the highest alarm level or the node that has recently undergone configuration changes as the initial point.

[0031] S102: Using the initial fault node, the system expands along the dependency relationship based on the preset business topology map to obtain all nodes that may be affected and cause problems, and generates a set of associated nodes.

[0032] Specifically, such as Figure 3 As shown, starting from the initial node, a bidirectional breadth-first search is performed based on the directed business topology graph. Downstream propagation involves traversing the child nodes directly called by the node along the service call edges (such as HTTP / gRPC dependencies), with a depth not exceeding a preset level (default ≤ 3 levels). Upstream tracing involves locating the parent node that called the node in the reverse call direction and covering shared resource nodes (such as databases and message queues shared by multiple services). Dynamic pruning is also performed, and a loop detection algorithm is used to terminate the propagation of circular dependency paths to avoid including redundant nodes.

[0033] The diffusion process follows the principle of real-time topology snapshots, directly reading the latest version of the business topology library to ensure that node relationships are consistent with the production environment. Ultimately, a set of associated nodes is generated, the scope of which is dynamically defined by topology connectivity, covering all nodes along potential fault propagation paths.

[0034] S103: By collecting multi-source data from the associated node set, the system obtains the indicator data, log data, and configuration information of each node in the set, and then generates a preliminary context package after summarizing the data.

[0035] Specifically, such as Figure 2 As shown, for each member within the associated node set, three types of data collection are performed concurrently. First, metric data: raw time-series points of key performance indicators (CPU utilization, error rate, latency, etc.) within the alarm time window are retrieved from the time-series database and packaged into metric snapshots by node dimension. Second, log data: error / warning level logs are filtered based on the log platform's streaming interface, and duplicate entries are compressed using a log line fingerprint algorithm (such as TLSH-based approximate matching) to generate a deduplicated set of key lines. Finally, configuration information: structured metadata such as node version number, deployment parameters, and dependency library list are extracted from the configuration center. These three types of data are aggregated into node context units by node ID, and all units are combined to form a preliminary context package.

[0036] The initial context package uses standardized encapsulation and includes topology node relationship metadata and time alignment identifiers.

[0037] As one possible implementation, in step S200, anomaly information is extracted based on the preliminary context packet, and a refined context packet is generated by removing irrelevant node information, including: S201, based on the indicator data of each node in the preliminary context packet, detect abnormal data fluctuations during the alarm period and extract abnormal data features.

[0038] Specifically, such as Figure 3As shown, by parsing the time-series data of indicators of each node in the preliminary context packet, dynamic baseline detection is performed within the alarm time window. First, based on the sliding window, the statistical characteristics of the indicators (mean, standard deviation, quantiles) are calculated to identify the fluctuation range that deviates significantly from the baseline. Then, quantifiable feature vectors are extracted from the abnormal intervals, including fluctuation amplitude (peak-baseline), duration, and slope of change. Finally, for multi-indicator correlation scenarios (such as CPU increase accompanied by error rate increase), the cross-indicator correlation coefficient is calculated.

[0039] The output is a summary of indicator anomalies, which replaces the original time-series data for subsequent analysis, achieving data compression and feature focusing.

[0040] S202 aggregates the error logs and warning logs of each node during the alarm period, processes the data through a clustering algorithm, and generates a high-frequency error pattern template.

[0041] Specifically, such as Figure 3 As shown, for error and warning logs within the alarm period, dynamic parameters are removed from the logs, while fixed semantic templates in the log text are retained. Similar logs are grouped using a clustering algorithm, and the most frequently occurring static text skeleton prefixes and suffixes are obtained from the clusters to generate high-frequency error pattern templates.

[0042] The semantic compression process for each node's error / warning logs includes: dynamic parameter stripping, which removes variable fields such as timestamps, UUIDs, and IP addresses using predefined regular expression rules, while retaining the static text skeleton (e.g., "Timeoutconnecting to {service}"); unsupervised log clustering, which uses density clustering algorithms (e.g., HDBSCAN) to group similar logs and calculates similarity based on text edit distance and word frequency vectors; and template distillation, which extracts the longest common subsequence (LCS) from each cluster as a high-frequency error pattern template, retaining the semantic core, such as the prefix "Failed to call" and the suffix "retry exhausted".

[0043] S203: Remove nodes whose metrics are normal and do not exhibit high-frequency error patterns during the abnormal period, forming a set of key nodes and generating a refined context package.

[0044] Specifically, such as Figure 3 As shown, based on the abnormal summary of indicators and high-frequency error patterns of each node in the associated node set, anomaly scores of each node are generated by weighting, with weights dynamically allocated according to the indicator type and log pattern severity. When the abnormal score of a node is lower than the preset anomaly judgment threshold, these nodes are removed, and a key node set is formed based on the retained nodes. A refined context package is generated based on the key node set, the abnormal summary of indicators, and the high-frequency error pattern template.

[0045] The system implements node-level anomaly detection based on anomaly summaries and error pattern templates. First, in multi-source evidence fusion, the anomaly intensity and weight of the indicator, as well as the product of the log pattern frequency and the weighted log, are obtained and summed to generate a node anomaly score. Then, dynamic threshold pruning is performed, removing nodes with scores below a preset anomaly detection threshold, which can be adaptively adjusted according to system scale. Finally, a key node set is generated by retaining nodes that meet the conditions of exceeding the anomaly intensity limit and exhibiting high-frequency error patterns. The final refined context package includes: a key node topology subgraph, an anomaly summary dictionary, and an error pattern template library.

[0046] As one possible implementation, in step S300, based on the constructed large language cue word template, an explainable root cause analysis report is generated through large language model constraints and reasoning, including: S301: Based on the constructed large language prompt word template, the refined context package is embedded in a structured manner and output in a structured manner according to the template constraints.

[0047] Specifically, such as Figure 3 As shown, the refined context package is read through the large language model to obtain the compressed and refined semantic evidence. The preset large language prompt word template is input, and the content is constrained according to the large language prompt word template to form a structured output.

[0048] Among them, the preset large language prompt word template, for example: "You are an operations and maintenance expert. Analyze the root cause of the failure based on the following information:" [Topology] Node A → Node B (Alarm Point) → Node C [Node B Metrics] CPU: Peak 98%, Error Rate: 40%↑ [Node B Log] "DB connection timeout: 10 occurrences" [Node A Log] "Request volume surge: +300%" [Node C Configuration] Version: v2.1 (Known memory leak defect) Problem: Analyze the root cause of the alarm at node B and output it in the following format: Analysis process: <Reasoning steps> Root cause node: <node name> Evidence: <Key Data Index>.

[0049] S302, Generate a visual analysis report based on the structured output content.

[0050] Specifically, through structured transformation, the triple data output by the LLM is parsed and converted into a segmented reporting framework, including phenomenon description (reproducing alarm events), reasoning process (topology propagation path + causal chain), root cause conclusion (core fault nodes and types), and supporting evidence (referenced metrics / log features). Then, the fault propagation path is rendered by automatically associating the topology graph, highlighting the root cause node, and converting abnormal metric features into time-series curves embedded in the report for enhanced visualization. Finally, a final report is generated according to a standardized template (HTML / PDF) and pushed to the alarm system and operations management platform.

[0051] Example 2 Based on the same principles as the aforementioned methods, a root cause analysis method for alarm events based on a large language model and business topology is also proposed. (See [link to relevant documentation]). Figure 4 An alarm event root cause analysis device 100 based on a large language model and business topology according to an embodiment of this disclosure includes: The dynamic topology sensing module 110, based on the analysis engine, obtains the set of associated nodes and collects multi-source data according to the alarm events sent by the alarm system, and generates a preliminary context packet; The multi-source evidence refinement module 120 extracts abnormal information based on the preliminary context packet and generates a refined context packet by removing irrelevant node information. The explanatory root cause generation module 130 generates an explanatory root cause analysis report based on the constructed large language cue word template and through constraints and reasoning of the large language model.

[0052] As an optional implementation of this application, the multi-source evidence refinement module 120 may include: The indicator summary module 121 is used to extract statistical values ​​for abnormal periods and replace the original time series. Log aggregation module 122 is used to cluster error logs and retain high-frequency error pattern templates; Topology pruning module 123 is used to retain only the critical nodes of the fault propagation path and remove irrelevant branches.

[0053] Obviously, those skilled in the art should understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the control methods described above. The modules or steps of the present invention described above can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. Optionally, they can be implemented using computer-executable program code, thereby storing them in a storage device for execution by a computing device, or fabricating them separately as individual integrated circuit modules, or fabricating multiple modules or steps into a single integrated circuit module. Thus, the present invention is not limited to any specific hardware and software combination.

[0054] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the control methods described above. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), random access memory (RAM), flash memory, hard disk drive (HDD), or solid-state drive (SSD), etc.; the storage medium can also include combinations of the above types of memory.

[0055] Example 3 Furthermore, this application proposes an electronic device characterized in that it is used to implement any of the aforementioned alarm event root cause analysis methods based on large language models and business topologies, comprising: The processor is used to execute all computationally intensive tasks and implement a root cause analysis method for alarm events based on a large language model and business topology. Memory is used to store processor-executable instructions and statically stored data.

[0056] The electronic device of this disclosure includes a processor and a memory for storing processor-executable instructions. The processor is configured to implement, when executing the executable instructions, any of the aforementioned alarm event root cause analysis methods based on a large language model and service topology.

[0057] It should be noted that the number of processors can be one or more. Furthermore, the electronic device in this embodiment may also include input devices and output devices. The processor, memory, input devices, and output devices can be connected via a bus or other means, without specific limitations herein.

[0058] The memory, as a computer-readable storage medium for a data-driven large language model performance prediction system, can be used to store software programs, computer-executable programs, and various modules, such as the alarm event root cause analysis method based on a large language model and business topology according to embodiments of this disclosure. The processor executes various functional applications and data processing of the electronic device by running software programs or modules stored in the memory.

[0059] The various embodiments of this application have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principles, practical application, or improvement of the technology in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A method for root cause analysis of alarm events based on a large language model and business topology, characterized in that, include: Based on the analysis engine, the associated node set is obtained and multi-source data is collected according to the alarm events sent by the alarm system to generate a preliminary context packet; Anomaly information is extracted from the initial context packet, and a refined context packet is generated by removing irrelevant node information. Based on the constructed large language cue word template, an interpretable root cause analysis report is generated through constraints and reasoning of the large language model.

2. The alarm event root cause analysis method based on large language model and business topology as described in claim 1, characterized in that, The analysis engine, based on alarm events sent by the alarm system, obtains a set of associated nodes and collects multi-source data to generate a preliminary context packet, including: Based on the alarm event information, identify the directly associated initial fault node; Starting from the initial fault node, the process expands along the dependency relationship based on the preset business topology map to obtain all nodes that may be affected and cause problems, and generates a set of related nodes. By collecting multi-source data from the associated node set, the indicator data, log data and configuration information of each node in the set are obtained, and a preliminary context package is generated after aggregation.

3. The alarm event root cause analysis method based on large language model and business topology as described in claim 1, characterized in that, The step of extracting abnormal information based on the preliminary context packet, and generating a refined context packet by removing irrelevant node information, includes: Based on the metric data of each node in the preliminary context packet, detect abnormal data fluctuations during the alarm period and extract abnormal data features; Aggregate the error logs and warning logs of each node during the alarm period, process the data using a clustering algorithm, and generate high-frequency error pattern templates. Remove nodes whose metrics are normal and do not exhibit high-frequency error patterns during abnormal periods to form a set of key nodes and generate a refined context package.

4. The alarm event root cause analysis method based on large language model and business topology as described in claim 1, characterized in that, The constructed large language cue word template, through constraints and reasoning of a large language model, generates an explainable root cause analysis report, including: Based on the constructed large language prompt word template, the refined context package is embedded in a structured manner and output in a structured manner according to the template constraints; Generate a visual analysis report based on the structured output content.

5. The alarm event root cause analysis method based on large language model and business topology as described in claim 3, characterized in that, The process aggregates error logs and warning logs from each node during the alarm period, processes the data using a clustering algorithm, and generates high-frequency error pattern templates, including: For error and warning logs within the alarm period, remove dynamic parameters from the logs while retaining the fixed semantic template in the log text; Similar logs are grouped using a clustering algorithm. The most frequently occurring static text skeleton prefixes and suffixes are obtained from the clusters to generate high-frequency error pattern templates.

6. The alarm event root cause analysis method based on large language model and business topology as described in claim 3, characterized in that, The process of removing nodes whose metrics were normal and who did not exhibit high-frequency error patterns during the abnormal period forms a key node set, which generates a refined context package, including: Based on the summary of abnormal indicators and high-frequency error patterns of each node in the associated node set, anomaly scores for each node are generated by weighting, with weights dynamically allocated according to the indicator type and log pattern severity. If the anomaly score of a node is lower than the preset anomaly judgment threshold, these nodes are removed, and a set of key nodes is formed based on the retained nodes. A refined context package is generated based on the set of key nodes, the summary of indicator anomalies, and the template of high-frequency error patterns.

7. The alarm event root cause analysis method based on large language model and business topology as described in claim 4, characterized in that, The process of embedding the refined context package in a structured manner according to the constructed large language prompt word template, and outputting it in a structured manner according to the template constraints, includes: The refined context package is read through the large language model to obtain compressed and refined semantic evidence, and the preset large language prompt word template is input. Content constraints are applied based on the large language prompt word template to form structured output.

8. A root cause analysis device for alarm events based on a large language model and business topology, characterized in that, The device includes: The dynamic topology sensing module, based on the analysis engine, obtains the set of associated nodes and collects multi-source data according to the alarm events sent by the alarm system, and generates a preliminary context packet; The multi-source evidence refinement module extracts abnormal information from the preliminary context packet and generates a refined context packet by removing irrelevant node information. The Explainable Root Cause Generation Module generates an Explainable Root Cause Analysis Report based on the constructed large language cue word template and through constraints and reasoning of the large language model.

9. The alarm event root cause analysis device based on a large language model and business topology according to claim 8, wherein the multi-source evidence refinement module comprises: The indicator summary module is used to extract statistical values ​​for abnormal periods and replace the original time series. The log aggregation module is used to cluster error logs and retain high-frequency error pattern templates; The topology pruning module is used to retain only the critical nodes in the fault propagation path and remove irrelevant branches.

10. An electronic device, characterized in that, The method for implementing the alarm event root cause analysis method based on a large language model and business topology as described in any one of claims 1 to 7 includes: The processor is used to execute all computationally intensive tasks and implement a root cause analysis method for alarm events based on a large language model and business topology. Memory is used to store processor-executable instructions and statically stored data.

Images