An AI large model-based operation and maintenance method and system

Abstract

An operation and maintenance method and system based on an AI large model relate to the technical field of artificial intelligence operation and maintenance. The method comprises: acquiring monitoring data, analyzing the monitoring data, and decomposing the analyzed monitoring data into a plurality of domain feature sets; determining knowledge vectors corresponding to the domain feature sets; acquiring historical normal operation data of the knowledge vectors, calculating deviation values according to the historical normal operation data, and determining an abnormal symptom vector according to the deviation values; determining a potential root cause vector in each knowledge vector according to the knowledge vectors and the abnormal symptom vector; searching for all paths and calculating comprehensive weight values of the paths, taking a path with the highest comprehensive weight value as a root cause reasoning chain of a complex problem; extracting a processing strategy corresponding to each knowledge vector, optimizing the processing strategy according to a logical order of the root cause reasoning chain, and generating a solution. The technical solution provided by the application can improve system operation and maintenance efficiency.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of artificial intelligence operation and maintenance, and particularly relates to an operation and maintenance method and system based on an AI large model. BACKGROUND

[0002] With the wide application of cloud computing, microservice architecture and distributed systems, the complexity of modern IT systems grows exponentially. A typical enterprise-level system often involves multiple technical fields such as network layer, application layer, database layer, storage layer, and there are complex dependencies between each field. In this context, system operation and maintenance has become a key link to ensure business continuity.

[0003] At present, AI large model technology has been preliminarily applied in the field of system operation and maintenance. The existing operation and maintenance method based on AI large model usually adopts the following technical route: first, collect the monitoring data of the system (such as CPU usage, memory occupation, network traffic, application logs, etc.), then use AI large model to detect the abnormality of these monitoring data, and identify the indicators deviating from the normal state; then locate the fault root cause through rule engine or simple statistical analysis method, and finally match the corresponding solution from the preset fault handling manual. This method has certain effect in dealing with independent faults in a single field.

[0004] However, in actual production environment, system failure often manifests as a composite problem, that is, a bottom root cause may trigger a chain reaction in multiple fields, resulting in the simultaneous occurrence of multiple surface symptoms. For example, a bandwidth bottleneck in the network layer may simultaneously cause response timeout in the application layer, connection pool depletion in the database layer, and IO delay rise in the storage layer. The existing operation and maintenance method based on AI large model lacks deep mining of the correlation between abnormal symptoms in different fields when dealing with such composite problems, and often treats the abnormalities in each field independently, giving processing suggestions for each field symptom. This processing method may cause the operation and maintenance personnel to need to execute multiple unrelated or even conflicting processing strategies at the same time, resulting in low system operation and maintenance efficiency. SUMMARY

[0005] The present application provides an operation and maintenance method and system based on AI large model, which can improve the operation and maintenance efficiency.

[0006] In a first aspect of the present application, an operation and maintenance method based on AI large model is provided, which specifically comprises:

[0007] Obtaining real-time monitoring data of a target system, analyzing the monitoring data through an AI large model, and decomposing the analyzed monitoring data into multiple domain feature sets according to a preset domain classification standard;

[0008] determine a knowledge vector corresponding to each of the domain feature sets through a pre-constructed domain knowledge vector space;

[0009] obtain historical normal operation data of each of the knowledge vectors, calculate a normal benchmark vector according to the historical normal operation data, calculate deviation values of each of the knowledge vectors from the normal benchmark vector, and determine an abnormal symptom vector according to each of the deviation values;

[0010] determine a potential root cause vector in each of the knowledge vectors according to each of the knowledge vectors and the abnormal symptom vector;

[0011] search all paths between the abnormal symptom vector and the potential root cause vector, and calculate a comprehensive weight value of each of the paths, and take the path with the highest comprehensive weight value as a root cause reasoning chain of a complex problem;

[0012] extract a processing strategy corresponding to each of the knowledge vectors from a pre-constructed solution knowledge base, and optimize the solution strategy according to the logic sequence of the root cause reasoning chain and the processing strategy through the AI large model, to generate a solution to the complex problem.

[0013] By adopting the above technical solution, first, the AI large model is used to analyze the monitoring data and classify them according to the domain, and the feature data of different technical domains are mapped to a unified knowledge vector space, realizing the standardized expression of multi-domain monitoring data; second, the abnormal symptoms are determined by calculating the deviation of the knowledge vector from the historical normal operation benchmark, and the potential root causes are identified based on the association between the knowledge vectors, avoiding the limitations of the traditional method of treating each domain exception independently; by calculating the comprehensive weight values of all paths between the abnormal symptom vector and the potential root cause vector, the path with the highest weight is selected as the root cause reasoning chain, which not only accurately identifies the underlying root cause of the multi-domain chain reaction, but also clearly shows the propagation path of the fault between different domains; finally, the AI large model integrates and optimizes the processing strategies of each domain based on the logic sequence of the root cause reasoning chain, to generate a solution with strong pertinence and coherent steps, effectively improving the operation and maintenance efficiency of the system complex problem.

[0014] Optionally, the calculation of the normal benchmark vector according to the historical normal operation data, the calculation of the deviation values of each of the knowledge vectors from the normal benchmark vector, and the determination of the abnormal symptom vector according to each of the deviation values, comprises:

[0015] convert the historical normal operation data into historical knowledge vectors, and calculate the statistical mean of each of the historical knowledge vectors to obtain the normal benchmark vector;

[0016] calculate the confidence interval of the normal fluctuation range according to the standard deviation of each of the historical knowledge vectors;

[0017] Calculate the deviation value between each of the knowledge vectors and the normal reference vector, and determine the knowledge vector whose deviation value exceeds the confidence interval as the abnormal symptom vector.

[0018] By adopting the technical solution, the historical normal operation data is uniformly converted into a representation form in the knowledge vector space, a stable normal reference vector is established through statistical mean calculation, and a confidence interval is constructed based on the standard deviation to quantify the normal fluctuation range, so that the abnormal detection is established on a reliable statistical basis. By calculating the deviation between the knowledge vector obtained through real-time monitoring and the normal reference vector and combining the confidence interval for judgment, the sensitivity of abnormal detection is ensured, the false positive rate is effectively controlled, accurate abnormal symptom vector input is provided for subsequent root cause positioning, and the reliability of the entire operation scheme is improved.

[0019] Optionally, the determining of the potential root cause vector in each of the knowledge vectors according to each of the knowledge vectors and the abnormal symptom vector comprises:

[0020] Calculate the semantic correlation degree between the knowledge vectors of any two different domain feature sets, and filter out a cross-domain vector pair set associated across domains according to each of the semantic correlation degrees;

[0021] Take the cross-domain vector pair set as an edge and each of the knowledge vectors as a node to construct a dynamic fusion knowledge graph, and assign a corresponding semantic correlation degree to each of the edges as a weight value;

[0022] Calculate the connection degree of each of the nodes in the dynamic fusion knowledge graph and the total weight value of each of the edges;

[0023] Calculate the comprehensive influence index of each of the nodes according to the connection degree and the total weight value of the edges;

[0024] Calculate the shortest propagation distance of each of the nodes to the node corresponding to the abnormal symptom vector;

[0025] Determine the knowledge vector corresponding to the node whose comprehensive influence index is higher than a preset influence threshold and whose shortest propagation distance is within a preset hop number as the potential root cause vector.

[0026] By adopting the technical scheme, firstly, the semantic correlation degrees between different field knowledge vectors are calculated to construct a cross-field vector pair set, and a dynamic graph structure integrating multi-field knowledge is constructed based on the vector pair set, so that the correlation between the cross fields in the complex system is completely modeled; secondly, the influence index is calculated by comprehensively considering the connection degree and the sum of edge weights, and the double threshold filtering is performed in combination with the propagation distance of the abnormal symptom, so that the overall influence range of the potential root cause in the system is considered, and the correlation density with the specific abnormal symptom is ensured, thereby accurately identifying the root cause node most likely to trigger the chain reaction; the knowledge vector corresponding to the screened node is determined as the potential root cause vector, which provides a reliable candidate set for subsequent root cause reasoning chain construction, and effectively improves the accuracy and interpretability of the composite problem root cause positioning.

[0027] Optionally, the comprehensive influence index of each node is calculated according to the connection degree and the sum of the weight values of the edges, including:

[0028] The connection degree and the sum of the weight values of the edges are substituted into the comprehensive influence index formula to obtain the comprehensive influence index of each node.

[0029] The comprehensive influence index calculation formula is:

[0030] ;

[0031] Among them, the comprehensive influence index of node i is: The sum of the weight values of all edges of node i is: The connection degree of node i is: The number of edges within the preset hop distance of node i is: The number of nodes within the preset hop distance of node i is:

[0032] By adopting the above technical scheme, the weight value sum, connection degree, directly connected edge number and directly connected node number and other multi-dimensional features of the node are organically combined through mathematical formulas, not only comprehensively considering various topological features of the node in the knowledge graph, but also effectively amplifying the influence difference between different nodes in the form of index; by taking the ratio of the directly connected edge number and the node number as the base of the index term, and comprehensively considering the multi-dimensional features in the form of product, the nodes with high weight connection and wide association obtain higher influence index, thereby providing accurate quantitative basis for identification of the potential root cause, and effectively improving the accuracy and reliability of root cause positioning.

[0033] Optionally, the search is performed from all paths between the abnormal symptom vector and the potential root cause vector, and the comprehensive weight value of each path is calculated, including: ​

[0034] On the dynamic fusion knowledge graph, a weighted shortest path algorithm is used to search all paths from the abnormal symptom vector corresponding node to the potential root cause vector corresponding node;

[0035] The sum of the weight values of all edges on each path is calculated, and the comprehensive weight value of each path is calculated based on the length of each path and the sum of the weight values of each path.

[0036] By using the above technical solution, based on the constructed dynamic fusion knowledge graph, all possible propagation paths between abnormal symptom nodes and potential root cause nodes are comprehensively searched by using the weighted shortest path algorithm, ensuring that no potential causal link is missed; at the same time, the comprehensive weight value is calculated by comprehensively considering the path length and the sum of the weight values of each edge on the path, which not only reflects the closeness of the abnormal propagation link, but also embodies the reliability strength of the propagation path, providing a reliable quantitative basis for subsequent construction of accurate root cause reasoning chain, thereby improving the accuracy and reliability of the root cause analysis result.

[0037] Optionally, the comprehensive weight value of each path is calculated based on the length of each path and the sum of the weight values of each path, comprising:

[0038] The length of each path and the sum of the weight values of each path are substituted into a preset comprehensive weight value calculation formula to calculate the comprehensive weight value of each path;

[0039] The comprehensive weight value calculation formula is:

[0040] ;

[0041] wherein, the comprehensive weight value of the kth path, the number of edges on the kth path, the weight value of the jth edge on the kth path, the length of the kth path, and D is the number of edges contained in the shortest distance between the abnormal symptom vector corresponding node and the potential root cause vector corresponding node in the dynamic fusion knowledge graph.

[0042] By adopting the technical scheme, the cumulative effect of the edge weight values on the path and the attenuation effect of the path length are organically combined through a comprehensive weight value calculation formula: firstly, the cumulative influence of the edge weight is reflected through a continuous multiplication form, ensuring that high weight connections are fully valued; secondly, an exponential function is used to nonlinearly adjust the path length, so that the weight of a longer path is moderately attenuated, and is normalized through the shortest distance D; finally, a logarithmic function item is introduced for overall smoothing, effectively balancing the influence of path length on the maximum weight, so that a comprehensive evaluation index that can reflect both propagation strength and path complexity is obtained, providing a scientific and reasonable quantitative basis for the subsequent construction of a root cause reasoning chain.

[0043] Optionally, after the solution to the complex problem is generated, the method further includes:

[0044] arranging the processing strategies in the solution in reverse order of the root cause reasoning chain to generate a processing strategy execution sequence;

[0045] performing risk assessment on each processing strategy before executing the processing strategy, calculating the influence range and execution risk index of each processing strategy;

[0046] setting execution checkpoints according to the execution risk index of each processing strategy, collecting system state data at each execution checkpoint and converting the system state data into real-time knowledge vectors;

[0047] calculating the closeness of each real-time knowledge vector to the normal reference vector, and terminating the execution of subsequent processing strategies when the closeness reaches a preset recovery threshold;

[0048] storing the current system state, the root cause reasoning chain and the execution result to the solution knowledge base as historical case data for optimizing subsequent root cause analysis when the closeness does not reach the preset recovery threshold and all processing strategies are executed.

[0049] By adopting the technical scheme, firstly, the execution order of the processing strategies is ensured to be opposite to the problem occurrence link through reverse arrangement, realizing system recovery from the root cause to the manifestation; secondly, the execution process is finely controlled through risk assessment and checkpoint setting, effectively preventing negative effects that may be caused by the processing strategies; thirdly, the system state is monitored in real time and compared with the normal reference, realizing dynamic adjustment of the processing process and avoiding resource waste caused by excessive processing; finally, the execution result is stored in the solution knowledge base to form experience accumulation, continuously optimizing the accuracy of root cause analysis and the effectiveness of processing strategies, thereby constructing a self-optimizing and sustainable problem diagnosis and processing system.

[0050] In a second aspect, the present application provides an AI large model-based operation and maintenance device, comprising one or more processors and a memory; the memory is coupled to the one or more processors, and the memory is configured to store computer program code, the computer program code comprising computer instructions, the one or more processors invoking the computer instructions to cause the AI large model-based operation and maintenance device to perform the method as described in the first aspect and any possible implementation manner of the first aspect.

[0051] In a third aspect, the present application provides a computer program product comprising instructions, which, when executed on an AI large model-based operation and maintenance device, cause the AI large model-based operation and maintenance device to perform the method as described in the first aspect and any possible implementation manner of the first aspect.

[0052] In a fourth aspect, the present application provides a computer-readable storage medium comprising instructions, which, when executed on an AI large model-based operation and maintenance device, cause the AI large model-based operation and maintenance device to perform the method as described in the first aspect and any possible implementation manner of the first aspect. BRIEF DESCRIPTION OF DRAWINGS

[0053] Figure 1 is a system architecture diagram of an AI large model-based operation and maintenance system provided by an embodiment of the present application;

[0054] Figure 2 is a flow diagram of an AI large model-based operation and maintenance method provided by an embodiment of the present application;

[0055] Figure 3 is a schematic diagram of root cause inference chain search provided by an embodiment of the present application;

[0056] Figure 4 is an exemplary root cause inference chain diagram provided by an embodiment of the present application;

[0057] Figure 5 is an exemplary hardware structure diagram of an AI large model-based operation and maintenance device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0058] In order for those skilled in the art to better understand the technical solutions in the specification, the technical solutions in the specification will be clearly and completely described below in conjunction with the drawings in the embodiments of the specification. Obviously, the described embodiments are only some of the embodiments of the present application, not all.

[0059] In the description of the embodiments of the present application, the words "for example" or "such as" are used to represent an example, an illustration, or an exposition. Any embodiment or design scheme described as "for example" or "such as" in the embodiments of the present application should not be interpreted as more preferred or more advantageous than other embodiments or design schemes. Rather, the words "for example" or "such as" are used in the specific manner to present the relevant concept.

[0060] In the description of the embodiments of the present application, the term "a plurality of" means two or more. For example, a plurality of systems means two or more systems, and a plurality of screen terminals means two or more screen terminals. In addition, the terms "first" and "second" are used only for the purpose of description, and should not be interpreted as indicating or implying relative importance or implicitly indicating the indicated technical features. Therefore, the features defined with "first" and "second" can explicitly or implicitly include one or more of the features. The terms "include", "contain", "have" and their variants mean "including but not limited to", unless otherwise specifically emphasized.

[0061] Figure 1 An AI large model-based operation and maintenance system architecture is shown. As shown in Figure 1 The system architecture can include a monitoring collection client 011, a network 012 and an electronic device 013. The network 012 is used to provide a data transmission link between the monitoring collection client 011 and the electronic device 013. The network 012 can include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0062] The monitoring collection client 011 can send monitoring data and abnormal diagnosis requests to the electronic device 013 through the network 012. The monitoring collection client 011 is mainly responsible for collecting real-time monitoring data of the target system, including performance indicators, log information, alarm events, etc., and converting these data into a standardized format before sending them to the electronic device 013 for analysis and processing.

[0063] The monitoring collection client 011 is hardware, which can be a monitoring device with data collection and transmission functions, including but not limited to operation and maintenance monitoring terminals, data collectors, sensor nodes, monitoring agent programs, and other basic components.

[0064] The electronic device 013 is responsible for receiving monitoring data and abnormal diagnosis requests and performing comprehensive analysis and processing, including vectorization conversion of monitoring data, abnormal symptom identification, dynamic fusion knowledge graph construction, root cause reasoning chain generation, and solution formulation, and other core functions. The electronic device 013 can realize dynamic updating of the knowledge graph according to the system running state and abnormal mode, calculate the optimal root cause analysis strategy using an AI large model, and finally realize intelligent diagnosis and processing of complex problems by combining historical case data and expert knowledge. These analysis and processing results can be used to guide the operation and maintenance personnel to quickly locate the problem root cause and formulate effective solutions.

[0065] It should be noted that the electronic device can be hardware or software. When the electronic device is hardware, it can be implemented as a distributed electronic device cluster composed of multiple electronic devices, or as a single electronic device. When the electronic device is software, it can be implemented as multiple software or software modules (such as multiple software or software modules used to provide distributed processing), or as a single software or software module. No specific limitation is made here.

[0066] It should be understood that Figure 1 The number of monitoring collection clients 011, networks 012, and electronic devices 013 in the above system architecture is only illustrative. According to the needs of implementation, there can be any number of monitoring collection clients 011, networks 012, and electronic devices 013. In particular, in the case where monitoring data does not need to be sent remotely, the above system architecture can not include the network 012, but only include the monitoring collection client 011 or the electronic device 013.

[0067] The present application provides an operation and maintenance method based on an AI large model, referring to Figure 2 , Figure 2 is a flowchart of an operation and maintenance method based on an AI large model provided by an embodiment of the present application, including steps S101 to S106, and the above steps are as follows:

[0068] S101: Obtain real-time monitoring data of a target system, analyze the monitoring data through an AI large model, and decompose the analyzed monitoring data into multiple domain feature sets according to a preset domain classification standard.

[0069] In the present embodiment, the domain feature set refers to a feature data set formed by classifying monitoring data according to different business domains or technical dimensions according to a preset domain classification standard, each set containing relevant monitoring indicators, state information, and performance parameters in a specific domain, for example, the network domain feature set contains network-related indicators such as bandwidth utilization, delay, and packet loss rate, and the database domain feature set contains database-related indicators such as connection number, query response time, and lock waiting time.

[0070] Specifically, first, raw monitoring data is collected from each monitoring node of the target system in real time, including system performance indicators, application logs, network traffic, database status, and other multi-dimensional data streams. Then the collected raw monitoring data is input into the AI large model, and the natural language processing technology is used to perform semantic analysis on the text type monitoring data, and feature extraction and pattern recognition are performed on the numerical type monitoring data to form a structured data representation. Then according to the preset domain classification standard, the parsed monitoring data is classified and mapped according to the domain attribute, and the specific execution process is as follows: each parsed data item is matched with each preset domain classification standard to calculate the matching degree, and the correlation score of the data item with each domain is calculated through a classification function, when the matching degree of a certain data item with a specific domain exceeds the classification threshold set for the domain, the data item is assigned to the feature set of the corresponding domain, and finally multiple feature sets divided according to different domains such as network, storage, calculation and application are formed.

[0071] S102: Determine the knowledge vector corresponding to each domain feature set through the pre-constructed domain knowledge vector space.

[0072] In the embodiments of the present application, the domain knowledge vector space refers to a pre-constructed multi-dimensional vector space, which models and represents the professional knowledge, historical experience and rule system of the operation and maintenance domain through vectorization technology, and each dimension corresponds to a specific knowledge attribute or semantic feature. For example, the network domain knowledge vector space includes network topology, protocol type, fault mode and other knowledge dimensions, and the database domain knowledge vector space includes index optimization, query plan, transaction processing and other knowledge dimensions.

[0073] Specifically, first, the knowledge domain mapping relationship corresponding to each domain feature set currently processed is extracted from the pre-constructed domain knowledge vector space. Then each domain feature set is subjected to feature vectorization processing, and the monitoring indicators, state information and performance parameters in the set are converted into standardized numerical vector representation. Then similarity matching calculation is performed in the corresponding domain knowledge vector space, and the most matched knowledge vector combination is identified by calculating the distance or correlation between the feature set vector and each knowledge vector in the knowledge space. Subsequently, a weighted fusion strategy is adopted, and according to the importance weight of each element in the feature set, the multiple matched knowledge vectors are linearly combined or nonlinearly fused to generate a comprehensive knowledge vector that can accurately represent the semantic information of the domain feature set. Finally, a corresponding knowledge vector is determined for each domain feature set.

[0074] S103: Obtain historical normal operation data of each knowledge vector, calculate a normal baseline vector according to the historical normal operation data, calculate the deviation value of each knowledge vector from the normal baseline vector, and determine an abnormal symptom vector according to each deviation value.

[0075] In the embodiments of the present application, the abnormal symptom vector refers to a knowledge vector that exceeds the normal fluctuation range by comparing the deviation degree of the current knowledge vector and the normal benchmark vector, and the vector carries the characteristic information and symptom performance of the system abnormal state.

[0076] Specifically, first, historical normal running data corresponding to each knowledge vector in the field is collected, including monitoring indicators, performance parameters and state information during stable system running. Then the historical normal running data is converted according to the same processing procedure as the current knowledge vector to generate a corresponding historical knowledge vector set. Then statistical analysis is performed on the historical knowledge vector of each field, and the arithmetic mean of each vector dimension is calculated to form a normal benchmark vector representing the normal running state of the field. At the same time, the standard deviation of each historical knowledge vector in each dimension is calculated, and the confidence interval boundary value of the normal fluctuation range is determined based on the standard deviation. Then the current knowledge vector and the corresponding normal benchmark vector are compared dimension by dimension, and the absolute deviation value or the relative deviation value between them is calculated. Finally, the calculated deviation value is compared with the preset confidence interval to determine whether the deviation value of any dimension or multiple dimensions in the knowledge vector exceeds the upper and lower boundaries of the corresponding confidence interval. If so, the knowledge vector is marked and converted into an abnormal symptom vector.

[0077] On the basis of the above embodiments, as an optional embodiment, S103: calculating the normal benchmark vector according to the historical normal running data, calculating the deviation value of each knowledge vector from the normal benchmark vector, and determining the abnormal symptom vector according to each deviation value, can specifically include the following steps:

[0078] S201: converting the historical normal running data into historical knowledge vectors, and performing statistical mean calculation on each historical knowledge vector to obtain a normal benchmark vector.

[0079] In the embodiments of the present application, the normal benchmark vector refers to a standard reference vector obtained by statistical analysis of the knowledge vector during the historical normal running, and each dimension value of the vector represents the typical level of each monitoring indicator and performance parameter of the system in the stable running state.

[0080] Specifically, first, the time period confirmed as a normal running state is filtered from the historical operation and maintenance records of the target system, and complete monitoring data and state information in these time periods are collected. Then the collected historical normal running data is preprocessed according to the same processing flow as the current knowledge vector, including data cleaning, format standardization and feature extraction operations. Then the historical normal running data is converted into a corresponding historical knowledge vector set by using the same AI large model and domain knowledge vector space mapping mechanism, ensuring that the historical vector and the current vector have the same dimension structure and semantic representation. Subsequently, statistical analysis is performed on the historical knowledge vector set of each domain, and the arithmetic mean of each vector dimension in all historical samples is calculated. The mean value of each dimension is obtained by summing and then dividing by the total number of samples. Finally, the statistical mean values of each dimension are recombined according to the original vector structure to form a normal baseline vector that can represent the normal running state characteristics of the domain.

[0081] S202: Calculate the confidence interval of the normal fluctuation range according to the standard deviation of each historical knowledge vector.

[0082] Specifically, first, the variance analysis is performed on the historical knowledge vector set of each domain dimension by dimension, and the dispersion degree of the numerical value of each vector dimension in all historical samples is calculated. Then the sum of squares of the difference between each dimension value and the corresponding mean value is calculated, and then divided by the sample number minus one to obtain the sample variance of each dimension, and the square root operation is performed on the sample variance to obtain the standard deviation value. Then according to the preset confidence level parameter, usually the confidence level of 95% or 99% is selected to determine the critical value coefficient of the corresponding statistical distribution. Then the standard deviation of each dimension is multiplied by the coefficient corresponding to the confidence level to calculate the positive and negative offset range of each dimension relative to the normal baseline vector. Then the numerical value of each dimension of the normal baseline vector is taken as the center point, and the corresponding offset value is added and subtracted to determine the upper and lower boundaries of each dimension. Finally, the upper and lower boundaries of all dimensions are combined to form a complete confidence interval.

[0083] S203: Calculate the deviation value between each knowledge vector and the normal baseline vector, and determine the abnormal symptom vector as the knowledge vector whose deviation value exceeds the confidence interval.

[0084] Specifically, first, the knowledge vectors of the current fields are dimensionally aligned with the corresponding normal baseline vectors to ensure that the two vectors have the same dimensional structure and semantic meaning. Then, the numerical difference between each knowledge vector and the normal baseline vector is calculated dimension by dimension. The original deviation value of each dimension is obtained by subtracting the corresponding dimension value of the normal baseline vector from the dimension value of the current vector. Then, the deviation value is taken as an absolute value to eliminate the influence of the positive and negative directions, and the standardized deviation value reflecting the deviation degree is obtained. Subsequently, the deviation values of each dimension are compared with the confidence interval boundaries one by one to determine whether the deviation values exceed the upper and lower boundary ranges of the corresponding dimensions. Then, the number of dimensions and the degree of deviation exceeding the confidence interval in each knowledge vector are counted, and whether the knowledge vector belongs to an abnormal state is determined according to a preset abnormality determination threshold. Finally, the knowledge vector determined as an abnormal state is marked as an abnormal symptom vector.

[0085] S104: Determine the potential root cause vector in each knowledge vector according to the knowledge vectors and the abnormal symptom vectors.

[0086] In the embodiments of the present application, the potential root cause vector refers to a knowledge vector that may be the root cause in a system abnormal event. The vector represents a field or component with strong influence propagation ability and a reasonable association path between the vector and the identified abnormal symptom vector. For example, in a network failure scenario, the knowledge vector of a core switch may be identified as a potential root cause vector due to its high connectivity and influence on multiple downstream services, which is used to guide the operation and maintenance personnel to focus on troubleshooting the possible fault source.

[0087] Specifically, first, the semantic similarity and functional association between the knowledge vectors of each field are analyzed to identify vector combinations with cross-field influence relationships and establish association mapping relationships between different fields. Then, a dynamic fusion knowledge graph is constructed based on the identified cross-field association relationships, each knowledge vector is taken as a graph node, the cross-field association relationship is taken as a connection edge, and a weight value reflecting the association strength is assigned to each edge. Then, the comprehensive influence level of each node in the entire system is calculated through graph topology analysis, considering multiple dimensional indicators such as the connection breadth and connection strength of the node. Subsequently, the propagation path and distance relationship between each node and the identified abnormal symptom vector node are analyzed to evaluate the potential causal propagation possibility. Finally, according to the dual screening conditions of the node comprehensive influence index and the propagation distance, the knowledge vector node that meets the requirements of high influence and reasonable propagation distance at the same time is selected, and the corresponding knowledge vector of the node is determined as the potential root cause vector.

[0088] As shown in FIG. 7, the abnormal symptom vector is determined according to the knowledge vectors of the current fields and the normal baseline vectors. Figure 3 Figure 3 ​is a schematic diagram of root cause reasoning chain search provided by an embodiment of the present application. The diagram takes a dynamic fusion knowledge graph as the background, and shows the process of searching and determining the optimal path to the potential root cause vector from an identified abnormal symptom vector.

[0089] Each circle in the diagram represents a knowledge vector, which is an abstract representation of a component or state in the system; the connection between nodes represents the semantic association between vectors, and the weight value (w) on the line quantifies the strength of the association.

[0090] In this scenario, the red application response timeout node is the starting point of the analysis (abnormal symptom vector). The system searches out three paths identified in red, orange and green, which are connected to three different blue nodes (potential root cause vectors). According to the technology of the present scheme, the system will calculate the comprehensive weight value of each path according to the path length, the weight value of all edges on the path, etc.

[0091] As Figure 4 shown, Figure 4 is an exemplary root cause reasoning chain schematic diagram provided by an embodiment of the present application.

[0092] Figure 4 In the above embodiment, the red path (path 1) has the highest weight value and the closest association of each edge, and the finally calculated comprehensive weight value is also the highest. Therefore, the path is determined as the root cause reasoning chain of the current complex problem, and the database connection pool depletion pointed by the path is identified as the most likely root cause.

[0093] On the basis of the above embodiment, as an optional embodiment, S104: determining the potential root cause vector in each knowledge vector according to each knowledge vector and the abnormal symptom vector, can specifically include the following steps:

[0094] S301: Calculate the semantic association degree between the knowledge vectors of any two different domain feature sets, and select the cross-domain vector pair set associated across domains according to each semantic association degree.

[0095] In the embodiment of the present application, the semantic association degree refers to the numerical representation of the degree of association between different domain knowledge vectors in the semantic space, which reflects the closeness of the system components or services represented by the two vectors in terms of function, dependency relationship or influence propagation.

[0096] Specifically, first, traverse all the knowledge vectors of different domain feature sets, and construct a list of vector combinations paired two by two, ensuring that the two vectors in each vector pair come from different domain feature sets. Then, using the vector cosine similarity calculation method, the dot product of the two vectors is divided by the product of the respective vector lengths to obtain a numerical result reflecting the angular similarity of the vectors in high-dimensional space. Then, combined with the semantic weight information of each dimension of the vector, the basic similarity is weighted and adjusted, focusing on the contribution of key dimensions with important significance in system operation to semantic correlation. Then, compare the calculated semantic correlation value with the preset correlation threshold, and select the vector pairs with correlation values exceeding the threshold as candidate cross-domain associated objects. Then, verify the domain attribution of the selected vector pairs to ensure that each vector pair indeed represents the cross-domain association between different domains, and excludes vector association within the same domain. Finally, the vector pairs that pass the semantic correlation and cross-domain attribute double verification are combined to form a cross-domain vector pair set.

[0097] S302: Construct a dynamic fusion knowledge graph with the cross-domain vector pair set as the edge and each knowledge vector as the node, and assign the corresponding semantic correlation degree as the weight value to each edge; calculate the connection degree of each node and the total weight value of each edge in the dynamic fusion knowledge graph.

[0098] In the embodiments of the present application, the dynamic fusion knowledge graph refers to a network topology structure constructed by taking the knowledge vectors of each domain as nodes and the cross-domain vector pair relationship as connection edges. This graph can dynamically reflect the association relationship and influence propagation path between different domains. For example, in the IT operation scenario, the database knowledge vector, the application service knowledge vector, and the network device knowledge vector are connected as different nodes through the cross-domain association edge to form a unified knowledge relationship network. The connection degree is the number of edges directly connected to each node in the dynamic fusion knowledge graph. This value reflects the connection breadth and potential influence range of the corresponding knowledge vector in the entire system. The higher the connection degree, the more extensive the association of the node with other domains.

[0099] Specifically, first, all obtained knowledge vectors are initialized as graph nodes, and each node is assigned a unique identifier and corresponding vector data information. Then each vector pair in the cross-domain vector pair set is converted into a connected edge in the graph, and an undirected connection relationship is established between the corresponding two nodes to form the basic topology of the graph. Then the calculated semantic correlation degree value is assigned as the weight value of the corresponding edge to ensure that each edge carries numerical information reflecting the correlation strength between the two nodes. Subsequently, each node in the graph is traversed, and the number of edges directly connected to the node is counted to calculate the connection degree number of each node and record and store it. Then all edges in the graph are traversed, and the weight values of each edge are summed to obtain the total weight value of all edges in the entire dynamic fusion knowledge graph.

[0100] S303: Calculate the comprehensive influence index of each node according to the connection degree number and the total weight value of the edge.

[0101] In the embodiments of the present application, the comprehensive influence index refers to a comprehensive numerical index for quantitatively evaluating the influence of each node in the dynamic fusion knowledge graph in the entire system. The index considers multiple dimensions such as the connection breadth, weight strength and network density of the node, and can comprehensively reflect the importance and influence propagation ability of the corresponding knowledge vector in the cross-domain knowledge fusion process.

[0102] Specifically, the comprehensive influence index calculation formula is The comprehensive influence index of each node is calculated, and the formula adopts a product-type index function structure of multi-level network analysis. By multiplying the direct connection weight, one-hop connection degree number and extended neighborhood density of three different network levels, the influence of the local to the global can be comprehensively evaluated, avoiding the limitation of only considering direct connection. Wherein represents the calculation result of the comprehensive influence index of node i, represents the total weight value of the direct connection of node i, which is obtained by accumulating the weight values of all edges directly connected to the current node, reflecting the overall correlation strength of the node in all cross-domain correlations. represents the connection degree number of node i, i.e. the number of edges directly connected to the current node, which adopts a square root form to achieve a moderate amplification effect. represents the number of edges within a preset hop number (such as two hops) from node i, which is obtained by counting all nodes within a preset hop number from node i as the center to extend outward, forming a neighborhood node set of all nodes with a distance of not more than the preset hop number from node i, and then counting the number of edges between all nodes in the neighborhood node set. represents the number of nodes within a preset hop number (such as two hops) from node i, i.e. the total number of all nodes with a distance of not more than the preset hop number from node i, including node i itself. The index term To extend the neighborhood density factor, the edge density in the extended neighborhood is calculated and amplified exponentially to highlight the promoting effect of local network tightness on influence propagation, where the 2 times coefficient of the molecule is used for the edge number normalization of the undirected graph.

[0103] S304: Calculate the shortest propagation distance of each node to the node corresponding to the abnormal symptom vector; determine the knowledge vector corresponding to the node whose comprehensive influence index is higher than the preset influence threshold and whose shortest propagation distance is within the preset hop number as the potential root cause vector.

[0104] In the embodiments of the present application, the shortest propagation distance refers to the path length with the least number of edges from any node to the target node corresponding to the abnormal symptom vector in the dynamically fused knowledge graph. This distance reflects the closest connection relationship between knowledge vectors in the graph topology structure and the shortest path of influence propagation. For example, in the IT operation scenario, the shortest propagation distance from the database performance node to the application response abnormal symptom node is 2 hops, indicating that the database performance problem can be propagated to the application response abnormality through the influence chain of 2 intermediate nodes.

[0105] Specifically, first, the node corresponding to the abnormal symptom vector is marked as the target node, and the distance value of this node is initialized to 0, and the distance values of all other nodes are initialized to infinity. Then, a to-be-processed node queue is established, and the target node is added to the queue as the starting point of the breadth-first search. Then, the breadth-first traversal algorithm is executed, and the node with the smallest current distance value is taken out from the queue as the current processing node, and all adjacent nodes of the node are traversed. For each adjacent node, if the path distance through the current node is less than the distance value recorded for the adjacent node, the distance value of the adjacent node is updated to the distance value of the current node plus 1, and the updated adjacent node is added to the to-be-processed queue. Repeat the above traversal process until the queue is empty, and obtain the shortest propagation distance of all nodes in the graph to the node corresponding to the abnormal symptom vector. Then, the comprehensive influence index of all nodes is traversed, and a node set with a value greater than the preset influence threshold is selected. Then, in the selected high-influence node set, nodes with a shortest propagation distance less than or equal to the preset hop number are further selected to form a candidate node set that satisfies both the influence and distance constraints. Finally, the original knowledge vector corresponding to each node in the candidate node set is extracted to form the potential root cause vector.

[0106] S105: Search all paths between the abnormal symptom vector and the potential root cause vector, and calculate the comprehensive weight value of each path, and take the path with the highest comprehensive weight value as the root cause reasoning chain of the complex problem.

[0107] In the embodiments of the present application, the root cause inference chain refers to a causal relationship inference sequence formed by a connection path in the dynamically fused knowledge graph from the abnormal symptom vector to the potential root cause vector. The chain reflects the propagation process and influence path of a problem from the root cause to the final manifestation symptom, and can provide a clear logical basis for the diagnosis and solution of a complex problem. For example, in an IT operation scenario, a root cause inference chain from a database connection pool configuration abnormal root cause vector to an application response timeout abnormal symptom vector can include a complete propagation path of intermediate nodes such as a database connection pool, a database service, an application service, and response time.

[0108] Specifically, first, all possible paths from the node corresponding to the abnormal symptom vector to the node corresponding to each potential root cause vector are searched on the dynamically fused knowledge graph using a weighted shortest path algorithm. The graph structure is traversed using depth-first search or breadth-first search, and all non-repeated path sequences that can reach each root cause node from the symptom node are recorded. Then, the weight of each path searched is calculated, and the sum of the weight values of all edges on the path is obtained. At the same time, the path length, i.e., the number of edges included in the path, is counted. Then, the comprehensive weight value of each path is calculated based on the sum of the weight values and the path length. The calculation method is to divide the sum of the weight values by the square root of the path length, which takes into account both the overall correlation strength of the path and the simplicity of the path, avoiding the influence of propagation attenuation caused by too long paths. Subsequently, the comprehensive weight values of all paths are compared, and the path with the highest value is identified as the optimal propagation path. Then, the path with the highest comprehensive weight value is verified to check the logical connection relationship between the nodes in the path and the rationality of the causal propagation. Finally, the path that passes the verification with the highest comprehensive weight value is determined as the root cause inference chain of the complex problem.

[0109] Based on the above embodiments, as an optional embodiment, S105: searching all paths between the abnormal symptom vector and the potential root cause vector and calculating the comprehensive weight value of each path, can specifically include the following steps:

[0110] S501: On the dynamically fused knowledge graph, all paths from the node corresponding to the abnormal symptom vector to the node corresponding to the potential root cause vector are searched using a weighted shortest path algorithm.

[0111] In the embodiments of the present application, the weighted shortest path algorithm refers to a calculation method for finding a path with the minimum total weight or a path that meets a specific weight condition between two nodes in a graph structure with weights. This algorithm determines the optimal connection scheme by considering the path length and edge weight information, and can find the propagation path with the lowest cost or the strongest influence in a complex network topology. For example, in an IT operation knowledge graph, the weighted shortest path algorithm can be used to find the influence propagation path with the maximum total weight between a database abnormal symptom node and a server hardware root cause node.

[0112] Specifically, first, the starting node set of path search is initialized, and the node corresponding to the abnormal symptom vector in the dynamically fused knowledge graph is marked as the starting point of the search, and the nodes corresponding to all potential root cause vectors are marked as the search endpoint set. Then a priority queue is established, the starting node is added to the queue and its distance to itself is set to 0, and the distance values of the remaining nodes are initialized to infinity. Then an extended version of Dijkstra algorithm is executed, the node with the optimal cumulative weight is taken out from the priority queue as the current processing node, all adjacent nodes of the current node are traversed, the path cumulative weight of each adjacent node through the current node is calculated, and the cumulative weight of the current node is added to the weight value of the connecting edge to calculate the cumulative weight. Then the newly calculated cumulative weight is compared with the optimal weight recorded in the adjacent node, if the weight of the new path is more optimal, the optimal weight value and the predecessor node information of the adjacent node are updated, and the updated adjacent node is added to the priority queue. Repeat the above extension process until the queue is empty or all target root cause nodes are accessed. Then the predecessor node information is traced back from each potential root cause vector corresponding to the endpoint node to the starting abnormal symptom node to construct all complete paths.

[0113] S502: Calculate the sum of the weight values of all edges on each path, and calculate the comprehensive weight value of each path based on the length of each path and the sum of the weight values of each path.

[0114] Specifically, first, all candidate paths are traversed, and all edges contained in each path are extracted according to the node connection order, and the weight values of the edges are added to obtain the sum of the weight values of the path. Then the length information of each path is counted, and the number of edges contained in the path is calculated as the path length, where k represents the index of the kth path. Then the comprehensive weight value calculation formula is applied to perform accurate calculation. The formula adopts a numerator and denominator structure design, the numerator part amplifies the influence of high weight short paths by multiplying the harmonic mean and the exponential decay function, and the denominator part suppresses the weight contribution of long paths by using a logarithmic function. The advantage of this structure design is that it can highlight the strong correlation path with high weight concentration, and avoid the false high weight of long path due to cumulative effect. In physical meaning, it reflects the strength retention and distance decay law of information propagation in complex network. In the formula represents the total number of edges contained in the kth path, which is calculated by traversing the path node sequence to obtain the number of adjacent node pairs; represents the weight value of the jth edge in the kth path, which is directly extracted from the edge weight matrix of the dynamically fused knowledge graph; The sum of the reciprocals of all edge weights in the path is calculated, which is used for the denominator part of the harmonic mean; The harmonic mean is more sensitive to small weight values than the arithmetic mean, and can effectively identify high-quality paths with uniform weight distribution and high numerical values; D represents the number of edges contained in the shortest distance between the node corresponding to the abnormal symptom vector and the node corresponding to the potential root cause vector in the dynamic fusion knowledge graph. This parameter is calculated by performing a breadth-first search algorithm on the knowledge graph to obtain the shortest hop count from the symptom node to the root cause node, serving as a reference value for distance attenuation; The exponential decay function is used to normalize and attenuate the current path length based on the shortest distance D, simulating the natural attenuation of information propagation with increasing relative distance. The attenuation factor is always greater than 1 by adding 1, avoiding excessive punishment of reasonable paths close to the shortest path length. The logarithmic penalty term is a mild nonlinear penalty on path length, which is more suitable for handling path length differences of different orders of magnitude than linear penalty. Finally, the comprehensive weight value of each path is calculated by the formula .

[0115] S106: Extract the processing strategies corresponding to each knowledge vector from the pre-built solution knowledge base, and optimize them according to the logical order of the root cause reasoning chain and the processing strategies through the AI large model to generate a solution to the complex problem.

[0116] Specifically, first, according to the knowledge vectors contained in the root cause reasoning chain determined in the previous steps, perform vector similarity matching retrieval in the pre-built solution knowledge base. By calculating the cosine similarity or Euclidean distance between the query knowledge vector and the solution vector stored in the knowledge base, extract candidate processing strategies with a similarity exceeding a pre-set threshold. Then, according to the logical order of the root cause reasoning chain, sort and organize the extracted processing strategies, placing the core processing strategy corresponding to the root cause node in a priority position, and arranging the auxiliary strategies corresponding to the intermediate propagation nodes according to the chronological order of the causal relationship. Then input the sorted processing strategy set and the structure information of the root cause reasoning chain into the AI large model, and perform semantic understanding and logical analysis on each independent strategy through natural language processing technology. Subsequently, the AI large model identifies the dependency relationship, execution order constraints and resource conflict situations between different processing strategies based on deep learning reasoning ability, and integrates and logically reconstructs multiple discrete processing strategies through attention mechanism and sequence-to-sequence generation model. Then, the AI large model optimizes the connection process between strategies, adjusts the execution parameter configuration, supplements necessary coordination mechanisms and exception handling branches based on the characteristics of the complex problem while maintaining the integrity of the core steps of each processing strategy. Finally, the AI large model outputs the complete solution after optimization and integration.

[0117] On the basis of the above-mentioned embodiments, as an optional embodiment, after the step of S106: generating a solution for the composite problem, a step of executing the processing strategy is further included, which can specifically include the following steps:

[0118] S701: arrange each processing strategy in the solution in reverse order of the root cause reasoning chain to generate a processing strategy execution sequence.

[0119] In the embodiments of the present application, the processing strategy execution sequence refers to a solution execution order list arranged according to the reverse reasoning principle of the causal relationship. The sequence organizes the execution order of each strategy according to the reverse processing logic from the root cause to the surface symptom, and ensures that the root cause of the problem is solved first and then the chain problems caused thereby are processed step by step.

[0120] Specifically, first, all processing strategies contained in the generated solution for the composite problem are extracted and classified and labeled according to the strategy content and the corresponding knowledge vector. Then, the root cause reasoning chain structure information determined in the previous step is obtained, the hierarchical relationship and the causal propagation direction of each node in the reasoning chain are identified, the root cause node is marked as the starting processing point, and the abnormal symptom node is marked as the final verification point. Then, each processing strategy in the solution is rearranged in reverse order of the root cause reasoning chain, the core processing strategy corresponding to the root cause node is placed at the beginning of the execution sequence, the auxiliary processing strategy corresponding to the intermediate propagation node is arranged in reverse order of the causal relationship, and the verification strategy corresponding to the abnormal symptom node is placed at the end of the execution sequence. Subsequently, the processing strategies arranged in reverse order are checked for dependency relationship, the pre-condition constraints and resource conflict situations between the strategies are identified, the strategies that can be executed in parallel are grouped and labeled, and the strategies that have strict sequence requirements are prioritized. Then, each processing strategy in the execution sequence is assigned a unique sequence number and an execution time window, the estimated execution time and resource demand of each strategy are calculated, and a detailed execution plan containing the strategy identification, execution order, time arrangement, and resource allocation is generated. Finally, a complete processing strategy execution sequence is formed.

[0121] S702: Before executing each processing strategy, risk assessment is performed on each processing strategy, and the influence range and execution risk index of each processing strategy are calculated.

[0122] Specifically, before executing each processing strategy, the detailed operation content, target object and execution parameter of each processing strategy are extracted by traversing the processing strategy execution sequence. Then, for each processing strategy, its influence range is calculated by combining static analysis and dynamic modeling, specifically including identifying the direct target object of the strategy operation, tracking the associated components that may be indirectly affected through the system dependency graph, and counting the number of system modules, service instances and user connections in the influence range, and then weighting and summing these number information according to the predefined weight coefficients to obtain the influence range score. Then, the execution risk index of each processing strategy is calculated, and a multi-factor risk assessment model is used for quantitative calculation. The model considers the strategy operation complexity factor, system sensitivity factor, rollback feasibility factor and historical execution success rate factor, and finally adds the four weighted results to obtain the execution risk index.

[0123] S703: Set execution checkpoints according to the execution risk indexes of the processing strategies, collect system state data at each execution checkpoint and convert it into a real-time knowledge vector; calculate the closeness of each real-time knowledge vector to the normal baseline vector, and when the closeness reaches a preset recovery threshold, terminate the execution of subsequent processing strategies.

[0124] In the embodiments of the present application, the execution checkpoint refers to a system state monitoring node set in the processing strategy execution process. The checkpoint is arranged according to the strategy execution risk index and the key operation time, and is used to monitor the strategy execution effect and the system health state in real time.

[0125] Specifically, first, the checkpoint setting density and position are determined according to the risk index of each processing strategy. For high-risk strategies, intensive checkpoints are set before and after the execution to conduct strict monitoring. For low-risk strategies, moderately spaced checkpoints are set to conduct regular monitoring. Meanwhile, dynamic checkpoints are added in the middle stage of the execution of key strategies to discover abnormal situations in time. Next, system state data collection programs are started at each execution checkpoint to collect multi-dimensional real-time monitoring data including system resource usage, service running state, business processing performance, network connection status, etc., to ensure the completeness and timeliness of data collection. Then, the collected system state data is processed through a pre-trained feature extraction model to convert the original monitoring data into standardized feature vectors, and then a corresponding real-time knowledge vector is generated through a vector encoding algorithm. This vector can fully reflect the running state characteristics of the current system. Subsequently, a pre-constructed normal baseline vector is obtained from the knowledge base. This baseline vector is a standard state representation generated by analyzing a large amount of historical normal running data using statistical methods. The closeness between the current real-time knowledge vector and the normal baseline vector is calculated, and the cosine similarity measurement method is used to quantify the similarity of the two vectors. Then, the calculated closeness value is compared with the pre-set recovery threshold, which is pre-set according to the system characteristics and business requirements. When the closeness reaches or exceeds the pre-set recovery threshold, it is determined that the composite problem has been effectively solved and the system state has basically returned to normal, and a termination instruction is immediately sent to the strategy execution engine to stop the execution of subsequent processing strategies.

[0126] S704: When the closeness does not reach the pre-set recovery threshold and all processing strategies are executed, the current system state, root cause reasoning chain and execution result are stored in the solution knowledge base as historical case data for optimizing subsequent root cause analysis.

[0127] Specifically, first, it is detected whether the current proximity value is lower than the preset recovery threshold, and it is confirmed that all processing strategies have completed operation according to the execution sequence, and the historical case data storage process is started when the two conditions are met at the same time. Then collect and organize the current system state information, obtain the real-time running parameters of each component through the system monitoring interface, including hardware resource usage, software service state, business performance index, network connection condition and other multi-dimensional data, standardize the collected state data and unify the format, ensure the integrity and consistency of the data. Then extract and encapsulate the complete root cause reasoning chain information, including initial problem description, problem feature vector, reasoning step sequence, used reasoning rule, key evidence node, finally identified root cause and other detailed records, structure the decision basis and logical path in the reasoning process, form reusable reasoning knowledge. Then summarize the execution result data of each processing strategy, record the execution state, start and end time, execution parameter configuration, generated system change, problem improvement effect, abnormal situation processing and other detailed information of each strategy, calculate the success rate and effect score of strategy execution, provide quantitative basis for strategy optimization. Then structure the system state, root cause reasoning chain and execution result according to the predefined data mode, generate the historical case record in standard format, which contains case identification, timestamp, problem classification label, processing strategy label, effect evaluation and other metadata information. Finally, store the generated historical case data into the solution knowledge base, establish the association index with the existing cases, update the statistical information and retrieval index of the knowledge base, so that the newly added cases can be effectively used by the subsequent root cause analysis and strategy recommendation algorithm, realize the continuous learning and optimization improvement of the system problem processing capability.

[0128] An example of an AI large model-based operation and maintenance device is introduced below. Figure 5 is an example of the hardware structure of an AI large model-based operation and maintenance device provided by the embodiments of the present application.

[0129] In some embodiments, the AI large model-based operation and maintenance device is a computer device or includes a computer device in the AI large model-based operation and maintenance device. The computer device includes a processor, a memory, and a network interface connected through a system bus. The processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for running the operating system and the computer program in the non-volatile storage medium. The database of the computer device is configured to store data. The network interface of the computer device is configured to communicate with other terminals or servers outside through a network connection. In some embodiments, the network interface can be a wired network interface, and in some embodiments, the network interface can also be a wireless network interface. The computer program is executed by the processor to implement the method in the embodiments of the present application.

[0130] Those skilled in the art can understand that, Figure 5 The structure shown in the above-mentioned figure is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied. A specific computer device can include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0131] The above-described embodiments are only used to illustrate the technical solutions of the present application, but not limit the technical solutions thereof. Even though the technical solutions of the present application have been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: they can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacements to some technical features thereof; and these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

[0132] In the above-described embodiments, according to the context, the term "when" can be interpreted as meaning "if" or "after" or "in response to determining" or "in response to detecting". Similarly, according to the context, the phrase "upon determining" or "if detecting (the stated condition or event)" can be interpreted as meaning "if determining" or "in response to determining" or "upon detecting (the stated condition or event)" or "in response to detecting (the stated condition or event)".

[0133] In the above embodiments, all or part of the embodiments can be implemented by software, hardware, firmware or any combination thereof. When implemented by software, all or part of the embodiments can be implemented in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present application are generated. The computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable apparatus. The computer instructions can be stored in a computer readable storage medium or transmitted from one computer readable storage medium to another computer readable storage medium, for example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center through wired (such as coaxial cable, optical fiber, digital subscriber line) or wireless (such as infrared, wireless, microwave, etc.) manner. The computer readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. integrated with one or more available media. The available media can be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid state disk) and the like.

[0134] Those of ordinary skill in the art understand that all or part of the processes in the above embodiments can be implemented by a computer program to instruct the relevant hardware, which can be stored in a computer readable storage medium. The program can include the processes of the above method embodiments when executed. The aforementioned storage medium includes ROM or random access memory (RAM), magnetic disk or optical disk, and various media that can store program codes.

Claims

1. An AI large model-based operation and maintenance method, characterized in that, The method comprises: obtaining real-time monitoring data of a target system, analyzing the monitoring data by an AI large model, and decomposing the analyzed monitoring data into a plurality of domain feature sets according to a preset domain classification standard; determining the knowledge vectors corresponding to each domain feature set through a pre-constructed domain knowledge vector space; obtaining historical normal operation data of each knowledge vector, calculating a normal reference vector according to the historical normal operation data, calculating the deviation values of each knowledge vector and the normal reference vector, and determining an abnormal symptom vector according to each deviation value; calculating the semantic correlation between the knowledge vectors of any two different domain feature sets, and screening out a set of cross-domain vector pairs associated across domains according to each semantic correlation; constructing a dynamic fusion knowledge graph with the set of cross-domain vector pairs as edges and each knowledge vector as a node, and assigning the corresponding semantic correlation of each edge as a weight value; calculating the connection degree of each node in the dynamic fusion knowledge graph and the total weight value of each edge; calculating the comprehensive influence index of each node according to the connection degree and the total weight value of the edge; calculating the shortest propagation distance of each node to the node corresponding to the abnormal symptom vector; determining the knowledge vector corresponding to the node with a comprehensive influence index higher than a preset influence threshold and a shortest propagation distance within a preset hop number as a potential root cause vector; searching all paths from the abnormal symptom vector to the potential root cause vector, calculating the comprehensive weight value of each path, and taking the path with the highest comprehensive weight value as the root cause reasoning chain of a complex problem; extracting the processing strategy corresponding to each knowledge vector from a pre-constructed solution knowledge base, and generating a solution to the complex problem by optimizing the root cause reasoning chain in logical order and the processing strategy through the AI large model. 2.The AI large model-based operation and maintenance method of claim 1, wherein, The calculation of the normal reference vector according to the historical normal operation data, the calculation of the deviation values of each knowledge vector and the normal reference vector, and the determination of the abnormal symptom vector according to each deviation value comprise: convert the historical normal operation data into historical knowledge vectors, and calculate the statistical mean of each historical knowledge vector to obtain the normal reference vector; calculate the confidence interval of the normal fluctuation range according to the standard deviation of each historical knowledge vector; calculate the deviation values between each knowledge vector and the normal reference vector, and determine the knowledge vectors with deviation values exceeding the confidence interval as abnormal symptom vectors. 3.The AI large model-based operation and maintenance method of claim 1, wherein, The calculation of the comprehensive influence index of each node according to the connection degree and the total weight value of the edge comprises: substitute the connection degree and the total weight value of the edge into the comprehensive influence index formula to obtain the comprehensive influence index of each node; The comprehensive influence index calculation formula is: ； Wherein the is the comprehensive influence index of node i; is the total weight value of all edges of node i; is the connection degree of node i; is the number of edges within the preset hop number of node i; is the number of nodes within the preset hop number of node i. 4.The AI large model-based operation and maintenance method of claim 1, wherein, The search for all paths from the abnormal symptom vector to the potential root cause vector and the calculation of the comprehensive weight value of each path comprise: On the dynamic fusion knowledge graph, a weighted shortest path algorithm is used to search all paths from the abnormal symptom vector corresponding node to the potential root cause vector corresponding node; The sum of the weight values of all edges on each path is calculated, and the comprehensive weight value of each path is calculated based on the length of each path and the sum of the weight values of each path. 5.The AI big model-based operation and maintenance method according to claim 4, characterized in that, The comprehensive weight value of each path is calculated based on the length of each path and the sum of the weight values of each path, including: The length of each path and the sum of the weight values of each path are substituted into a preset comprehensive weight value calculation formula to calculate the comprehensive weight value of each path. The comprehensive weight value calculation formula is: ； The abnormal symptom vector corresponding node and the potential root cause vector corresponding node in the dynamic fusion knowledge graph. is a comprehensive weight value of the kth path, is the number of edges on the kth path, is a weight value of the jth edge on the kth path, is the length of the kth path, and D is the number of edges contained in the shortest distance between the abnormal symptom vector corresponding node and the potential root cause vector corresponding node in the dynamic fusion knowledge graph. 6.The AI large model-based operation and maintenance method of claim 1, wherein, After the solution to the complex problem is generated, it further includes: Arranging each processing strategy in the solution in reverse order of the root cause reasoning chain to generate a processing strategy execution sequence; Before executing each processing strategy, risk assessment is performed on each processing strategy to calculate the influence range and execution risk index of each processing strategy; According to the execution risk index of each processing strategy, an execution checkpoint is set, system state data is collected at each execution checkpoint and converted into real-time knowledge vectors; The proximity between each real-time knowledge vector and the normal baseline vector is calculated, and when the proximity reaches a preset recovery threshold, the execution of subsequent processing strategies is terminated; When the proximity does not reach the preset recovery threshold and all processing strategies have been executed, the current system state, the root cause reasoning chain and the execution result are stored in the solution knowledge base as historical case data for optimizing subsequent root cause analysis.

7. An AI large model-based operation and maintenance device, characterized in that The AI large model-based operation and maintenance device includes one or more processors and a memory; the memory is coupled to the one or more processors, the memory is used to store computer program code, the computer program code includes computer instructions, and the one or more processors invoke the computer instructions to make the AI large model-based operation and maintenance device execute the method of any one of claims 1-6.

8. A computer program product comprising instructions, characterized in that, When the computer program product runs on the AI large model-based operation and maintenance device, it makes the AI large model-based operation and maintenance device execute the method of any one of claims 1-6.

9. A computer-readable storage medium comprising instructions, characterized in that, When the instructions run on the AI large model-based operation and maintenance device, it makes the AI large model-based operation and maintenance device execute the method of any one of claims 1-6.

Images