Method and system for intelligently analyzing and processing device logs

Abstract

The invention relates to a method and a system for intelligently analyzing and processing equipment logs. The method comprises the following steps: acquiring and preprocessing the equipment logs; performing multi-stage dynamic classification on the preprocessed equipment log, and determining classification tags including equipment tags, event tags and scene tags; determining an intersection association relationship among the equipment tag, the event tag and the scene tag, and performing semantic analysis on the classification tag by using a large language model according to the intersection association relationship to generate a diagnosis report; and matching the diagnosis report according to the fault knowledge base, and automatically archiving and reusing the diagnosis report according to a matching result. Therefore, deep understanding and intelligent analysis of the natural language log are realized, the problem of multi-dimensional association deficiency is solved, the semantic understanding bottleneck is broken through, the fault recognition accuracy is improved to 95%, the fault response time is shortened to 3 minutes, and the minute-level response urgent need of a family scene is met.

Description

TECHNICAL FIELD

[0001] The present application mainly relates to the technical field of intelligent home and artificial intelligence cross, and particularly relates to a device log intelligent analysis and processing method and system. BACKGROUND

[0002] The number of intelligent home devices is growing rapidly, according to industry reports, the number of intelligent home devices grows at an annual rate of 25%, and the daily log generation of a single household has exceeded 10,000. However, there are significant pain points in log storage and analysis of intelligent home, and the related problems depend on the technical personnel to manually check the business log according to their business experience, which is low in troubleshooting efficiency and slow in response time; the false positive rate of traditional rule engine (such as regular matching) in processing unstructured log is more than 30%. The existing technology has obvious limitations, for example, only the storage classification of lock-end log is realized, and the semantic analysis ability is lacked; the storage efficiency of embedded device is optimized, but the bottleneck of text semantic understanding is not broken through; the correlation analysis accuracy of multi-dimensional log is less than 70% by using traditional SVM classification algorithm.

[0003] There are three major problems in the current technology: first, the dimensions are fragmented, and the existing scheme cannot associate multi-dimensional information such as device type (such as air conditioner), user behavior (such as timing switch), and environmental data (such as temperature fluctuation); second, there is a semantic blind area, and traditional machine learning (such as SVM) has weak context understanding ability for log text, which cannot analyze the cross-device fault root cause of “frequent compressor start-stop + voltage fluctuation”; third, the real-time performance is insufficient, and the batch processing mode causes a delay of more than 30 minutes in fault response, which cannot meet the urgent need of minute-level response in home scenarios. SUMMARY

[0004] An object of the present application is to provide a device log intelligent analysis and processing method and system to solve the problems of multi-dimensional correlation missing, semantic understanding blind area, and long fault response time in the prior art.

[0005] According to one aspect of the present application, a device log intelligent analysis and processing method is provided, comprising:

[0006] Obtaining device logs and preprocessing them;

[0007] Performing multi-level dynamic classification on the preprocessed device logs to determine classification labels, wherein the classification labels include device labels, event labels, and scene labels;

[0008] Determining the intersection association relationship between the device labels, event labels, and scene labels, using a large language model to perform semantic analysis of the classification labels according to the intersection association relationship, and generating a diagnosis report;

[0009] According to the fault knowledge base, the diagnostic report is matched, and the diagnostic report is automatically archived and reused according to the matching result.

[0010] Optionally, the multi-level dynamic classification of the preprocessed device log is performed to determine the classification label, including:

[0011] According to the device type, the preprocessed device log is classified at a first level to determine a device label;

[0012] According to the event feature, the device label is classified at a second level to determine an event label;

[0013] According to the environment data and user behavior data, the preprocessed device log is classified at a third level to determine a scene label.

[0014] Optionally, the device log is acquired and preprocessed, including:

[0015] The device log is collected in real time;

[0016] The collected device log is sorted based on a dynamic priority queue;

[0017] The sorted device log is timestamp corrected;

[0018] The corrected device log is converted into a spatiotemporal correlation feature vector.

[0019] Optionally, the semantic analysis of the classification label is performed using a large language model according to the intersection correlation to generate a diagnostic report, including:

[0020] According to the intersection correlation, a construction process of a target large language model is started to perform semantic analysis of the classification label using the target large language model to generate a diagnostic report, wherein the construction process of the target large language model includes:

[0021] Based on domain fine-tuning, a domain knowledge injection template library corresponding to the device is constructed;

[0022] A prompt template of a fault knowledge base is injected into the template library, wherein the fault knowledge base includes a device manual and historical faults;

[0023] According to the constructed domain knowledge template library, the large language model is fine-tuned to obtain a target large language model injected with domain knowledge, so as to complete the construction of the target large language model.

[0024] Optionally, the diagnostic report is matched according to the fault knowledge base, and the diagnostic report is automatically archived and reused according to the matching result, including:

[0025] determine a query vector according to the diagnosis report, and calculate a similarity between the query vector and a historical fault case in the fault knowledge base;

[0026] if the similarity is greater than a set value, the matching is successful, and reuse of the historical fault case is performed;

[0027] if the similarity is less than the set value, the matching fails, the current diagnosis report is a first-occurrence fault case, and the current fault case is stored in the fault knowledge base.

[0028] Optionally, the method further comprises:

[0029] determining a user feedback label according to a user evaluation, wherein the user feedback label comprises a satisfaction degree and an execution result;

[0030] updating the fault knowledge base according to the user feedback label;

[0031] using the user feedback label as incremental training data to perform incremental training on the large language model to automatically optimize the large language model.

[0032] Optionally, the method further comprises:

[0033] determining whether a behavior pattern in a device log is normal, and if not, using a large language model to perform analysis and reasoning, and outputting a handling step according to an analysis and reasoning result, wherein the handling step comprises starting a backup plan for the device and issuing an alarm.

[0034] Optionally, the method further comprises:

[0035] performing lightweight processing on a constructed target large language model to reduce model size and speed up reasoning, wherein the lightweight processing comprises:

[0036] compressing model parameter quantity through knowledge distillation;

[0037] performing dynamic quantization on a fully connected layer of the distilled model.

[0038] According to still another aspect of the present application, a system for intelligent analysis and processing of device logs is also provided, comprising:

[0039] a log collection module, a preprocessing module, an analysis module, and an output and feedback module;

[0040] the log collection module is configured to obtain a device log;

[0041] the preprocessing module is configured to preprocess the obtained device log;

[0042] the analysis module is configured to perform multi-level dynamic classification on the preprocessed device log, and determine a classification label;

[0043] The analysis module is further configured to perform semantic analysis on the classification label using a large language model to generate a diagnosis report.

[0044] The output and feedback module is configured to match the diagnosis report with a fault knowledge base, and automatically archive and reuse the diagnosis report according to the matching result.

[0045] The output and feedback module is further configured to collect user feedback data and update the fault knowledge base.

[0046] The analysis module is further configured to automatically optimize the large language model according to the user feedback data.

[0047] According to another aspect of the present application, a computer readable medium is provided, which stores a computer program. When the computer program is executed by a processor, the steps of any of the above methods are implemented.

[0048] Compared with the prior art, the present application realizes joint analysis of cross-device logs by constructing a three-level dynamic classification engine of device-behavior-environment, solves the problem of multi-dimensional association missing, and breaks through the semantic understanding bottleneck by using a large language model fine-tuned in the field to analyze the deep semantics of unstructured logs, thereby improving the fault recognition accuracy to 95%. In combination with edge computing and real-time sorting channels, the present application realizes a minute-level closed-loop operation and maintenance, and shortens the fault response time to 3 minutes. BRIEF DESCRIPTION OF DRAWINGS

[0049] In order to make the above objectives, characteristics and advantages of the present application more apparent and easy to understand, the specific embodiments of the present application are described in detail below with reference to the accompanying drawings.

[0050] Figure 1 Fig. 1 shows a flowchart of a method for intelligent analysis and processing of device logs according to an aspect of the present application;

[0051] Figure 2 Fig. 2 shows a system block diagram of a device log intelligent analysis and processing system according to another aspect of the present application.

[0052] The same or similar reference numerals in the drawings represent the same or similar components. DETAILED DESCRIPTION

[0053] In order to make the above objectives, characteristics and advantages of the present application more apparent and easy to understand, the specific embodiments of the present application are described in detail below with reference to the accompanying drawings.

[0054] In the following description, many specific details are set forth in order to provide a thorough understanding of the present application. However, the present application can be practiced in other ways different from those described herein, and therefore the present application is not limited to the specific embodiments disclosed below.

[0055] As shown in the present application and claims, unless the context clearly indicates otherwise, the words "a", "an", "the", and / or "this" do not necessarily refer to the singular, but can also include the plural, unless the context clearly indicates otherwise. Generally, the terms "comprising" and "including" merely indicate the inclusion of the elements explicitly identified, and do not constitute an exclusive list of elements that can be included.

[0056] The method proposed in the present application applies the cutting-edge artificial intelligence technology of large language model (LLM) to the log management in the field of smart home, and is suitable for various types of smart home devices, realizing deep understanding and intelligent analysis of natural language logs. The large language model is a deep learning model trained on hundreds of billions of data, which realizes the understanding and generation of natural language based on the Transformer architecture. In the analysis of smart home logs, after field fine-tuning, it can analyze the semantic association of unstructured logs. Through the construction of a three-level dynamic classification engine of device-behavior-environment, joint analysis of cross-device logs is realized, and the problem of multi-dimensional association missing is solved; through the large language model fine-tuned in the field to analyze the deep semantics of unstructured logs, the semantic understanding bottleneck is broken, and the fault identification accuracy is improved to 95%; combined with edge computing and real-time sorting channel, minute-level closed-loop operation and maintenance is realized, and the fault response time is shortened to 3 minutes.

[0057] Figure 1 A flowchart of a method for intelligent analysis and processing of device logs according to one aspect of the present application is shown, which comprises steps S11-S14.

[0058] Step S11, obtaining device logs and preprocessing.

[0059] The device log data on the edge end is collected, and the collected data is prioritized, time-stamped, and feature vector transformed, etc. preprocessing steps, so as to facilitate further classification of different types of device logs.

[0060] Step S12, multi-level dynamic classification is performed on the preprocessed device logs to determine the classification labels, wherein the classification labels include device labels, event labels and scene labels.

[0061] The preprocessed device log is classified by multi-level dynamic classification to determine classification labels of different dimensions. The device label is classified according to the device type, such as air conditioner, washing machine, refrigerator, door lock and different types of home devices. The event label is classified from the event dimension, such as hardware error, network timeout. The scene label is classified from the scene dimension, that is, user behavior and environment. For example, the "away mode" scene needs to meet the user behavior of "leaving the room" and the environmental feature of "environmental temperature rising". Thus, the correlation analysis across devices, behaviors and environments is realized, and the coverage rate of the device log is improved to 90%.

[0062] In step S13, the intersection correlation relationship between the device label, the event label and the scene label is determined, the semantic analysis of the classification label is performed according to the intersection correlation relationship by using a large language model, and a diagnosis report is generated.

[0063] By analyzing the combination matching relationship between the multi-dimensional labels such as devices, events and environments, the intelligent recognition of the home scene state is realized, and the large language model is used to deeply analyze the associated semantics, and finally the accurate diagnosis report is automatically generated. For example, the "away mode" needs to meet the multiple condition correlations of the user behavior of "leaving the room" and the environmental feature of "environmental temperature rising", and the model understands the complex scene and outputs the corresponding diagnosis report accordingly.

[0064] In step S14, the diagnosis report is matched according to the fault knowledge base, and the diagnosis report is automatically archived and reused according to the matching result.

[0065] The diagnosis report is matched with the historical fault cases in the fault knowledge base. If the matching is successful, the historical fault case is reused. If the matching fails, the current diagnosis report is the first fault case, and the current fault case is automatically archived and stored in the fault knowledge base.

[0066] In an embodiment of the present application, device logs are collected in real time; the collected device logs are sorted based on a dynamic priority queue; the sorted device logs are time-stamped; and the corrected device logs are converted into a spatiotemporal correlation feature vector.

[0067] The multi-protocol dynamic adaptation technology is adopted in the device log collection link, and multiple protocols such as MQTT, CoAP and HTTP are compatible, realizing the edge real-time collection of more than 90% of mainstream smart home devices, breaking through the limitation of traditional solutions that only support a single protocol. The collected logs are managed by a dynamic priority queue, and the fault logs are preferentially transmitted, ensuring that the key data is timely reported, while the overall compression rate is not less than 35%, effectively reducing the data transmission bandwidth occupation. Through the spatiotemporal alignment technology, the time-stamped and data-completed device logs are sorted, the clock synchronization between devices is realized, and the missing data is completed.

[0068] Specifically, clock synchronization can calibrate the clocks of each device through the NTP protocol, control the maximum clock deviation within ±50 ms, and ensure the comparability of the timestamps of multi-source logs; clock synchronization can also use a sliding window algorithm (window size Δt=5s) to compensate for the time drift of device logs, align the logs of different devices to the same time reference, and solve the timing deviation caused by inconsistent local clocks of devices. For the missing problem of device data caused by network jitter or sampling loss, a cubic spline interpolation algorithm can be used for data interpolation to complete the missing data points; Lagrange interpolation method can also be used to complete the missing period based on the known values of adjacent time points. Lagrange interpolation is based on the following formula:

[0069]

[0070] wherein, is the sensor sampling time, is the timestamp, is the sensor value (such as temperature, humidity, etc.). On the basis of completing clock synchronization and data completion, the corrected logs are converted into vectorization, which are uniformly mapped into spatiotemporal related feature vectors. This process is realized through BERT embedding and DTW time alignment algorithm, which uses BERT model to generate embedded vectors, and then aligns the log sequences between different devices through DTW algorithm, unifies the unstructured device logs into spatiotemporal related feature vectors, eliminates the log disorder problem caused by different device clocks, and solves the timing heterogeneity that the traditional regular matching method cannot handle, thereby realizing the standardized spatiotemporal feature expression of unstructured logs.

[0071] For example, in the scenario of air conditioner abnormal stop failure, first, the edge device log is collected, including all home devices in the user's home that can collect device logs, such as air conditioners, washing machines, refrigerators, door locks, temperature and humidity sensors, smart meters and various types of device logs. Among them, the "compressor abnormal stop" log of the air conditioner and the "current drop" log of the electric meter are identified as high-priority fault events, while the "washing program end" log of the washing machine and the "constant temperature running" log of the refrigerator are classified as low-priority normal state events. The device logs of various types are sorted in order of priority. Then, the high-priority device logs are processed according to the following process. First, time and space alignment is performed, and the clocks of key devices such as air conditioners, temperature and humidity sensors, and smart meters are synchronized through the NTP protocol to control the maximum clock deviation within ±50ms, ensuring the comparability of multi-source log timestamps. To address the mismatch between the environmental sensor sampling interval (5 minutes) and the device log frequency (1 minute), a cubic spline interpolation algorithm is used to complete the missing data such as temperature and humidity. Subsequently, semantic vectorization is performed, and a BERT model fine-tuned in the smart home field is used to convert text logs and data into 768-dimensional semantic vectors. For example, "compressor repeated start-stop (E04)" in the original fault log is converted to the vector [0.12, -0.45,..., 0.78], and "32℃ / 70% humidity" in the environmental data log is converted to the vector [-0.33, 0.21,..., 0.05]. Unstructured heterogeneous data is converted into computable numerical features, making it easier to associate across device logs by calculating the cosine similarity in subsequent steps.

[0072] In an embodiment of the present application, the pre-processed device logs are classified according to device type to determine device labels; the device labels are classified according to event features to determine event labels; and the pre-processed device logs are classified according to environmental data and user behavior data to determine scene labels.

[0073] The first-level classification is a classification of device logs according to device type, which can be performed by a decision tree model to identify the device type and output a device label set D = {d1, d2,..., d n}, such as D = {air conditioner, washing machine, refrigerator, door lock}; then, the device log of each type of device in the device label set D is classified according to event features in the second-level classification, which can be performed by a convolutional neural network (CNN) model to extract features and generate an event label set E = {e1, e2,..., e nevent labels E = {sensor abnormal, compressor frequent start-stop, refrigeration efficiency drop} in the device log of an air conditioner; the three-level classification is based on environmental data and user behavior, and the user behavior and environmental data can be associated through a long short-term memory (LSTM, Long Short-Term Memory) model, and a scene label set S = {s1, s2,..., s n} is output.

[0074] In the three-level classification based on environmental and user behavior data, specifically, first, the original data of user behavior and environment are structured to extract effective features. Discrete user behavior sequences (such as "turn on the air conditioner" and "close the curtain") are converted into time series labels (such as "1" indicating that the operation occurs, and "0" indicating that the operation does not occur), and statistical features such as behavior interval time (such as the time difference between two curtain opening times) and operation frequency (such as the number of curtain opening times per hour) are calculated; the numerical features (such as temperature and humidity) of the sensors in the environmental data are normalized (scaled to the 0-1 interval), and activity window statistics (such as the average temperature and humidity range in the past 10 minutes) are extracted, so as to retain the time trend of the data. Next, the user behavior sequence and environmental sensor data are integrated into a multi-channel time sequence input according to the format [time step, user behavior feature dimension, environmental feature dimension], for example, for a 10-minute time window, the input layer receives a tensor with a shape of (10, 5, 3), that is, 10 time steps, each time step contains 5-dimensional user behavior features (such as operation type, interval time), and 3-dimensional environmental features (temperature, humidity, illumination), retaining the spatio-temporal correlation of the two types of data. The fused time sequence data is processed through the loop unit (including the forget gate, the input gate, and the output gate) of the LSTM network, wherein the forget gate selectively retains important information of the past time step (such as the long-term influence of the user "leaving home" behavior), the input gate updates the environmental and behavior features of the current time step (such as the current temperature rise and the user's operation of turning on the air conditioner), and the output gate generates the hidden state of the current time step, capturing the long-term dependence relationship between user behavior and environmental data (such as the association between "temperature rising for 30 minutes after leaving home" and "air conditioner not turned off"). Finally, the scene label is generated and the user behavior and environmental data are intelligently associated, and the output layer (fully connected layer + Softmax activation function) of the LSTM model maps the hidden state to the scene label (such as "leaving home mode", "home mode", and "sleep mode"). By setting the intersection association relationship (such as "leaving home mode" needing to simultaneously satisfy the "user leaving the room" behavior feature and the "environmental temperature rising" environmental feature), the intelligent association of user behavior and environmental data is realized, and the scene context is provided for the subsequent semantic analysis of the large language model.

[0075] In an embodiment of the present application, the construction process of the target large language model is started according to the intersection association relationship to use the target large language model to perform semantic analysis on the classification tags and generate a diagnosis report. The construction process of the target large language model includes: based on domain fine-tuning, constructing a device corresponding domain knowledge injection template library; injecting prompt templates of a fault knowledge base into the template library, wherein the fault knowledge base includes device manuals and historical faults; fine-tuning the large language model according to the constructed domain knowledge template library to obtain a target large language model injected with domain knowledge, so as to complete the construction of the target large language model.

[0076] In the above embodiment, in the scene of air conditioner abnormal shutdown failure, an intelligent home domain knowledge injection template library is constructed, and prompt templates including device manuals and historical faults are injected into the template library. The templates integrate device types, error codes, real-time environmental data (such as temperature and humidity), and recent similar fault records, etc. information, forming a structured input prompt, so that the large language model can more accurately understand and diagnose the failure of home devices. The following is an example of a prompt template for air conditioner fault analysis:

[0077] [Device Type] {device_type}

[0078] [Error Code] {error_code}

[0079] [Environmental Data] Temperature {temp} ℃, Humidity {humidity}%

[0080] [History Record] Recent 3 times of the same type of fault: {history_faults}

[0081] Please output according to the {model} maintenance manual chapter {chapter} as follows:

[0082] 1. Root cause analysis (not more than 50 words).

[0083] 2. Optimization suggestions (list 3).

[0084] 3. Associated device check list.

[0085] During actual usage, real data will be entered. For example, `history_faults` can be filled with: "July 10th E04 (compressor overload protection), July 15th E07 (filter blockage)"; `chapter` can be specified as: 12 (i.e., the chapter where the air conditioner fault code table is located). Then, using a fault knowledge base containing device manuals and historical fault cases, the basic large language model is fine-tuned for the domain, ultimately resulting in a dedicated model for deeply understanding smart home device faults, namely the target large language model. This model performs semantic parsing of the device log classification tags and generates a JSON format diagnostic report, including root cause analysis, user-operable repair suggestions, and related devices of the fault.

[0086] Furthermore, the constructed target large language model is subjected to lightweight processing to reduce the model size and accelerate inference. The lightweight processing includes: compressing the number of model parameters through knowledge distillation; and dynamically quantizing the fully connected layers of the distilled model.

[0087] To reduce model size and thus accelerate the inference process, the target large language model, after domain fine-tuning, can be lightweighted. For example, standardized templates can be used to store domain knowledge first:

[0088] [Device type]${device_type}

[0089] [Error Code]${error_code} → [Standard Semantics]${manual_definition}

[0090] [Related Factors] ${env_factor1}, ${env_factor2}

[0091] Knowledge distillation compresses the original large model with hundreds of billions of parameters into a small model with only 6 billion parameters, ensuring that the model maintains high accuracy while shrinking. This meets the requirement that the response time on edge devices is no more than 3 seconds when processing inputs of up to 512 tokens, and the model accuracy decreases by no more than 5% compared to the original large model. Further optimization of the distilled small model employs dynamic quantization technology, adjusting the weights of the most computationally dense fully connected layers in the model according to the following formula (…). Converting a 32-bit floating-point number to an 8-bit integer:

[0092]

[0093] Where max(| The |) operator finds the maximum absolute value in the weight matrix. Dividing 127 by this maximum value calculates a scaling factor, reducing the original floating-point range. The model is linearly mapped to the range that can be represented by 8-bit integers, and finally, the scaled floating-point number is rounded to the nearest integer. This significantly reduces the model's memory footprint and computational cost, further improving inference speed.

[0094] In one embodiment of this application, a query vector is determined based on the diagnostic report, and the similarity between the query vector and historical fault cases in the fault knowledge base is calculated. If the similarity is greater than a set value, the match is successful, and the historical fault cases are reused. If the similarity is less than the set value, the match fails, the current diagnostic report is a fault case that has occurred for the first time, and the current fault case is stored in the fault knowledge base.

[0095] For example, in a scenario of an overheating fault in a smart curtain motor, the E12 error log of the curtain motor is collected. The Large Language Model (LLM) generates a diagnostic report (root cause: motor heat dissipation vents are blocked + continuous running time exceeds the design threshold) and converts it into a standardized JSON structure. Key fields include:

[0096] "case_id": "CURTAIN-E12-202X0610-001",

[0097] "device_info": {"type": "intelligent curtain motor", "model": "CX-200", "firmware": "v3.2"},

[0098] "error_code": "E12"

[0099] "root_cause": "Physical obstruction (dust accumulation in the curtain track) + continuous operation exceeding limits (maximum 3 hours without sleep mode)",

[0100] "environment_data": {"room temperature": "36℃", "humidity": "75%", "obstruction detection": "track dust coverage 80%"},

[0101] "timestamp": "202X-06-10T14:30:00Z",

[0102] "diag_report": {

[0103] Summary: Main causes of motor overheating: obstructed external heat dissipation + inappropriate operating strategies.

[0104] "solutions": ["Clean up dust on the track", "Upgrade firmware to optimize sleep logic (intermittent operation)"],

[0105] "associated_devices": ["environmental temperature and humidity sensor (living room)", "gas alarm (same area)"]

[0106] }

[0107] According to the classification label in the diagnostic report, the label "similarity_tags": ["motor overheating", "sunshade blocking", "high temperature environment"] is generated for retrieval, and the query vector is determined, the cosine similarity between the query vector and the different diagnostic reports in the fault knowledge base is calculated, and the time decay factor (the case weight is higher in the last 3 months) is used to match the historical fault cases. However, the similarity is lower than the set value 0.85, so the current diagnostic report is the first occurrence of the fault case, the diagnostic report is converted into a standardized JSON structure and stored in the fault knowledge base (MongoDB cluster), and the user behavior of the fault occurrence, such as "automatic opening of the curtain sunshade every day from 10:00 to 16:00 in summer", and the environmental conditions such as "high temperature + continuous operation + no blocking, fault probability <5%" are stored in the case metadata as scene features to enhance the accuracy of subsequent similarity matching, thereby completing the archiving process of the first occurrence of the fault case.

[0108] When the same type of fault occurs again, intelligent reuse of historical cases can be performed, for example, on xx month xx day, 20XX, the same curtain motor triggers E12 error (room temperature 38℃ on that day, user did not manually intervene). First, the new fault log is analyzed by LLM to extract key features: device type = intelligent curtain motor, error code = E12, environmental temperature = 38℃, continuous operation time = 2.5 hours. Based on the three-level classification label, the query vector of the current fault (device + event + scene combination features) is generated, and the similar cases are retrieved in the case knowledge base by calculating the cosine similarity and the time decay factor. The top 3 most similar cases are returned, with a similarity greater than the set value 0.85, and sorted in descending order of similarity: case 1 (similarity 0.93) is the E12 fault on 20XX-06-10 (same device model, same error code, room temperature 36℃ / continuous operation 3 hours), the root cause is exactly the same as the current one (blocking + overload operation); case 2 (similarity 0.88) is the E12 fault on 20XX-06-20 (same type of curtain in the same area, caused by deformation of the curtain track leading to friction heat); case 3 (similarity 0.86) is the E10 fault of the curtain motor of another brand on 20XX-07-01 (insufficient heat dissipation of the motor in high temperature environment). Case 1 is recommended first (highest similarity and user feedback "effective execution"), and the diagnostic report of case 1 is reused, for example:

[0109] [Historical case reuse prompt]

[0110] 1. Current fault is highly similar to case [CURTAIN-E12-202X0610-001] (similarity 0.93).

[0111] 2. Verified solutions: ① Clean the track dust (key operation). ② Upgrade firmware to optimize sleep logic (optional).

[0112] 3. Original execution result: User cleans up and the fault disappears (satisfaction 4.2 / 5).

[0113] 4. Recommended priority execution steps: ① Check and clean the curtain track (key area: under the motor support). ② If the problem still exists, contact the manufacturer to upgrade the firmware to v3.3.

[0114] By introducing the reuse of historical fault cases, the diagnosis efficiency is significantly improved. The analysis time of LLM for similar faults is greatly shortened from 45 seconds (requires complete semantic analysis) to 12 seconds (directly calls the verified conclusion in the historical case). In terms of resolution rate, taking the E12 fault as an example, the first resolution rate is improved from 70% without case reuse to 92% after reusing the historical verified solution. In addition, the system continuously accumulates related fault knowledge within 3 months, accumulates 23 curtain-related fault cases, covers 6 types of root causes such as occlusion, overload, and firmware defects, and gradually builds a "fault atlas" exclusive to brand X devices.

[0115] In an embodiment of the present application, a user feedback label is determined according to a user evaluation, wherein the user feedback label includes satisfaction and execution result; the fault knowledge base is updated according to the user feedback label; the user feedback label is used as incremental training data to incrementally train the large language model to automatically optimize the large language model.

[0116] In the above embodiment, in the scenario of overheating fault of the intelligent curtain motor, the user solves the fault problem according to the operation suggestion "clean the track dust" in the diagnosis report and performs feedback evaluation. According to the feedback content of the user, a feedback label is determined, for example, "user_feedback": {"satisfaction": 4.2 / 5, "execution result": "fault disappears after cleaning"}, which includes satisfaction and execution result. The feedback label is stored in the fault knowledge base, which facilitates the reuse of historical fault cases, for example, the execution result label "cleaning the track is effective 100% (verified this time)" is added, and the weight of the similar case (case 1) is adjusted (recommended priority +5%).

[0117] Meanwhile, the feedback label of the user is taken as the incremental training data of the target large language model, and the target large language model is incrementally trained, so as to automatically optimize the target large language model used. According to the incremental training data set constructed, the loss function is optimized according to the following formula to incrementally train the model:

[0118]

[0119] wherein a = 0.3 is a historical weight coefficient; CrossEntropy is a standard cross-entropy loss function, which measures the gap between the prediction result of the model on new data ( ) and the true label ( ); and represents the performance of the model on old data. Thus, the model quickly adapts to the new scene on the basis of retaining the original knowledge. In the case of air conditioner abnormal shutdown failure, based on user feedback, the fault knowledge base is updated and the large language model is optimized, and the analysis speed of the same type of fault (E04+ high temperature) is shortened from 3 minutes to 82 seconds; the user complaint rate is reduced by 62% (from 15 times per month to 5.7 times).

[0120] When the user feedback is a negative evaluation, for example, the keywords "fault not solved" and "slow response" are extracted in the smart home application (APP), the negative evaluation is output as a negative label, and the negative label is associated with the related log label through root cause tracing, so as to generate an error sample set. For example, when the user complaint contains "not cooling", all air conditioner device labels in the device log are retrieved ( ), and the log whose event label E under contains {‘E04’, ‘E07’} is screened, and whether the environmental temperature in the corresponding period is greater than 30℃ is checked, and if so, it is marked as "compressor protection under high temperature working condition" optimization scenario. According to the constructed sample set, the loss function is calculated according to the following formula:

[0121]

[0122] wherein LCE is the cross-entropy loss, and LKD is the knowledge distillation loss, and the parameter update of the LLM model is performed to complete the incremental training.

[0123] In an embodiment of the present application, it is judged whether the behavior mode in the device log is normal, and if not, the large language model is used for analysis and reasoning, and a disposal step is output according to the analysis and reasoning result, wherein the disposal step includes starting a backup scheme about the device and alarming.

[0124] For example, in the scenario of a smart door lock security event, abnormal detection and dynamic handling are achieved through multi-modal fusion analysis. First, the behavior patterns in the device log are analyzed. In the normal mode, the door lock should enter the armed state after the user leaves home (typical log features are GPS signal leaving and Wi-Fi disconnecting). In this detection, an abnormal pattern is found, the log shows that the GPS has left but the Wi-Fi is still connected, and then the large language model is triggered for adversarial analysis. The LLM generates multiple hypotheses and verifies them one by one. Hypothesis 1 is that the user's phone has not been taken away, but after checking the phone's location, it is confirmed that it has been taken away. Hypothesis 2 is that a hacker relay attack, at this time the camera's face recognition function is automatically activated, and a stranger is identified, this hypothesis is established.

[0125] Next, a dynamic handling strategy is generated. The LLM analyzes and reasons based on real-time device status and network environment, input including device status (battery power left only 15%, lower than 20% maintenance threshold), network log (Wi-Fi MAC address changed, original address 00:1A:3B, new address 00:4F:2D). Based on the above information, the LLM generates a structured handling step, output as follows:

[0126] "Risk level": "high risk",

[0127] "Handling steps": [

[0128] "Switch to 4G network immediately and report to the cloud",

[0129] "Start the backup power supply and lock the keyboard",

[0130] "Push alarm code #112 to the property system" ]

[0132] Thus, the whole process of automatic intelligent response from abnormal detection, root cause analysis to handling strategy generation is realized.

[0133] Figure 2A system block diagram of device log intelligent analysis and processing is shown according to another aspect of the application, the system comprising: a log collection module 100, a preprocessing module 200, an analysis module 300, and an output and feedback module 400; the log collection module 100 is used to obtain device logs; the preprocessing module 200 is used to preprocess the obtained device logs; the analysis module 300 is used to perform multi-level dynamic classification on the preprocessed device logs and determine classification labels; the analysis module 300 is also used to use a large language model to perform semantic analysis on the classification labels and generate a diagnostic report; the output and feedback module 400 is used to match the diagnostic report according to a fault knowledge base, and automatically archive and reuse the diagnostic report according to the matching result; the output and feedback module 400 is also used to collect user feedback data and update the fault knowledge base; the analysis module 300 is also used to automatically optimize the large language model according to the user feedback data.

[0134] The log collection module 100 collects various types of device logs at the edge, the preprocessing module 200 preprocesses the collected device logs of various types, including priority queue sorting, timestamp correction, feature vector conversion, etc., and then inputs the preprocessed device logs into the analysis module 300. The analysis module 300 first performs multi-level dynamic classification on the preprocessed logs and determines classification labels including device labels, event labels and scene labels, and then uses a large language model to perform semantic analysis according to the relationship between the classification labels to generate a diagnostic report. The output and feedback module 400 is used to match the diagnostic report with the fault knowledge base, query whether there are reusable historical fault cases, and automatically archive. After the user troubleshoots and solves the problem according to the diagnostic report, feedback evaluation is generated, and the output and feedback module 400 is also used to collect the user's feedback evaluation, thereby dynamically updating the fault knowledge base, and returning the feedback data to the analysis module 300, and the analysis module 300 uses the feedback data as incremental training data to automatically optimize the large language model.

[0135] The method described in the present application has wide application prospects, can improve user experience, discover and solve potential problems in smart home devices in a timely manner, improve the stability and reliability of the devices, and reduce the probability of failure. The intelligent analysis and feedback mechanism can provide more personalized service suggestions and optimization schemes for users, and improve user satisfaction. Secondly, the method can optimize device performance, identify performance bottlenecks and potential optimization points by analyzing device running information in log data, and provide data support for device performance optimization. Operation and maintenance personnel can adjust device parameters, optimize system configuration, etc. according to the analysis results, so as to improve the overall performance and efficiency of the device. In addition, the method can enhance system security, and log data contains a large amount of sensitive information such as user behavior records and device status information. Through encryption and permission control, etc., the security and privacy of log data are ensured. Potential security threats and vulnerabilities are discovered and handled in a timely manner, improving the overall security of the smart home system. The method described in the present application not only solves the current log management problem in the field of smart home, but also provides strong support for subsequent technological innovation. By continuously optimizing and improving system algorithms and models, the development of smart home technology towards more intelligent, automated and efficient direction is promoted.

[0136] The present application also provides a computer readable medium having computer instructions stored thereon, wherein the computer readable instructions can be executed by a processor to implement a device log intelligent analysis and processing method as described above.

[0137] When the device log intelligent analysis and processing method is implemented as a computer program, it can also be stored in a computer readable storage medium as an article. For example, the computer readable storage medium can include but is not limited to magnetic storage devices (such as hard disks, floppy disks, magnetic strips), optical discs (such as compact discs (CD), digital versatile discs (DVD)), smart cards and flash memory devices (such as electrically erasable programmable read-only memory (EPROM), cards, sticks, key drives). In addition, the various storage media described herein can represent one or more devices and / or other machine-readable media for storing information. The term "machine-readable medium" can include but is not limited to wireless channels and various other media (and / or storage media) that can store, include and / or carry code and / or instructions and / or data.

[0138] It should be understood that the above-described embodiments are only illustrative. The embodiments described herein can be implemented in hardware, software, firmware, middleware, microcode, or any combination thereof. For a hardware implementation, the processing units can be implemented within one or more application specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), processors, controllers, micro-controllers, microprocessors, and / or other electronic units designed to perform the functions described herein and / or combinations thereof.

[0139] Some aspects of the application can be performed entirely in hardware, entirely in software (including firmware, resident software, micro-code, etc.), or in a combination of hardware and software. The above hardware or software can be referred to as a "block," "module," "engine," "unit," "component," or "system." The processor can be one or more application specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processor devices (DAPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), processors, controllers, micro-controllers, microprocessors, or combinations thereof. Furthermore, aspects of the application can be presented in a computer product that is tangibly embodied in an information carrier, such as one or more computer readable media. The computer readable media can include, but is not limited to, magnetic storage devices (e.g., hard disk; floppy disk), optical disks (e.g., compact disk (CD); digital versatile disk (DVD)), smart cards, and flash memory devices (e.g., card; stick; key drive...).

[0140] The computer readable media can include a propagated data signal with computer program code embodied therein, for example, in baseband or as part of a carrier wave. Such a propagated signal can take any of a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof. Computer readable media can be any media that can be accessed by a computer. Such computer-readable media can be any available media that can be accessed by a general purpose or special purpose computer. By way of example, and not limitation, such computer-readable media can comprise RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other storage device, including one or more storage devices that are located in different locations, inside or outside of a computer program product that can be moved from one place to another. The computer program product can comprise a propagated data signal with computer program code embodied therein, for example, in baseband or as part of a carrier wave. The computer program code can be transmitted as a carrier wave, by any suitable medium of transmission, including, but not limited to, wireless, wire line, optical fiber cable, RF, etc.

[0141] Having described basic concepts above, it is obvious that the above-described disclosure of the invention is merely an example and does not limit the present application. Those skilled in the art can make various modifications, improvements, and corrections to the present application, although they are not explicitly described herein. Such modifications, improvements, and corrections are suggested in the present application, so they still belong to the spirit and scope of the exemplary embodiments of the present application.

[0142] Also, the use of "a" or "an" or "the" are intended to include "one or more" and any singular form "a" or "an" or "the" is intended to include the plural forms as well, unless the context clearly indicates otherwise. Also, the term "comprising" is intended to include the terms "including", "including but not limited to", "including one or more of", and "constituting of", but not excluding other non-specified elements or steps.

[0143] In some embodiments, numbers describing quantities of components, attributes, etc. are used. It should be understood that such numbers used in the description of the embodiments are intended to be modified by the modifier "about" or "approximately" in some examples. Unless otherwise specified, "about" or "approximately" means ±20% of the value of the measured quantity that the term is used with. Accordingly, the numerical parameters used in the illustrative examples have a practical purpose to establish the limits of a range for one or more of the characteristics that are intended to be measured. In some embodiments, numerical parameters in the specification and claims are approximations that can vary depending upon the requirements of the particular embodiment. In some embodiments, numerical parameters should be considered in the context of the number of significant digits in which they are recited. Although the numerical ranges and parameters setting forth the broad scope of the embodiments of the application are approximations, the numerical values set forth in the specific examples are reported as precisely as practicable.

Claims

1. A method for intelligent analysis and processing of device logs, characterized in that, The method includes: Acquire device logs and preprocess them; The preprocessed device logs are dynamically classified at multiple levels to determine classification tags, which include device tags, event tags, and scene tags. Determine the intersection and association relationships among the device tags, event tags, and scene tags, and use a large language model to perform semantic parsing of the classification tags based on the intersection and association relationships to generate a diagnostic report; The diagnostic report is matched against the fault knowledge base, and the diagnostic report is automatically archived and reused based on the matching results.

2. The method according to claim 1, characterized in that, The process of performing multi-level dynamic classification on the preprocessed device logs and determining classification labels includes: The preprocessed equipment logs are classified into primary categories based on equipment type, and equipment tags are determined accordingly. The device tags are classified into two levels based on event characteristics to determine the event tags; Based on environmental data and user behavior data, the preprocessed device logs are classified into three levels to determine scene labels.

3. The method according to claim 1, characterized in that, The process of acquiring and preprocessing device logs includes: Real-time collection of device logs; The collected device logs are sorted based on a dynamic priority queue; Perform timestamp correction on the sorted device logs; The corrected device logs are converted into spatiotemporally correlated feature vectors.

4. The method according to claim 1, characterized in that, The step of using a large language model to perform semantic parsing of the classification labels based on the intersection and association relationships, and generating a diagnostic report, includes: The construction process of the target large language model is initiated based on the intersection and association relationship, so as to use the target large language model to perform semantic parsing on the classification label and generate a diagnostic report. The construction process of the target large language model includes: Based on domain fine-tuning, a domain knowledge injection template library corresponding to the device is constructed. Inject prompt templates from the fault knowledge base into the template library, wherein the fault knowledge base includes equipment manuals and historical faults; The large language model is fine-tuned based on the constructed domain knowledge template library to obtain the target large language model injected with domain knowledge, thereby completing the construction of the target large language model.

5. The method according to claim 4, characterized in that, The step of matching the diagnostic report with the fault knowledge base and automatically archiving and reusing the diagnostic report based on the matching results includes: Based on the diagnostic report, a query vector is determined, and the similarity between the query vector and historical fault cases in the fault knowledge base is calculated. If the similarity is greater than the set value, the match is successful and the historical fault cases are reused. If the similarity is less than the set value, the match fails, the current diagnostic report is the first occurrence of the fault case, and the current fault case is stored in the fault knowledge base.

6. The method according to claim 1, characterized in that, The method further includes: User feedback tags are determined based on user evaluations, wherein the user feedback tags include satisfaction and performance results; The fault knowledge base is updated based on the user feedback tags. The user feedback tags are used as incremental training data to incrementally train the large language model, thereby automatically optimizing the large language model.

7. The method according to claim 1, characterized in that, The method further includes: Determine whether the behavior pattern in the device log is normal. If not, use a large language model for analysis and reasoning, and output handling steps based on the analysis and reasoning results. The handling steps include activating the backup plan for the device and issuing an alarm.

8. The method according to claim 4, characterized in that, The method further includes: The constructed target large language model undergoes lightweight processing to reduce model size and accelerate inference, wherein the lightweight processing includes: Compress the number of model parameters through knowledge distillation; Dynamic quantization is performed on the fully connected layers of the model after distillation.

9. A system for intelligent analysis and processing of equipment logs, characterized in that, The system includes: The system includes a log collection module, a preprocessing module, an analysis module, and an output and feedback module. The log acquisition module is used to acquire device logs; The preprocessing module is used to preprocess the acquired device logs; The analysis module is used to perform multi-level dynamic classification on the preprocessed device logs and determine the classification labels; The analysis module is also used to perform semantic parsing of the classification labels using a large language model to generate a diagnostic report; The output and feedback module is used to match the diagnostic report with the fault knowledge base, and automatically archive and reuse the diagnostic report based on the matching results; The output and feedback module is also used to collect user feedback data and update the fault knowledge base; The analysis module is also used to automatically optimize the large language model based on user feedback data.

10. A computer-readable medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method as described in any one of claims 1 to 8.

Images