AI large model-based alarm intelligent analysis and noise reduction verification method, device and equipment

Abstract

The invention discloses an alarm intelligent analysis and noise reduction verification method, device and equipment based on an AI large model, and relates to the technical field of alarm intelligent analysis, and the method comprises the following steps: obtaining alarm data and environment context information, constructing a system relation graph, and generating a multi-dimensional feature vector set based on the system relation graph; based on the multi-dimensional feature vector set, obtaining causal intensity among the alarm events to obtain a causal intensity matrix, and mapping the causal intensity matrix to a system relation graph to form an alarm causal association graph; performing graph structure clustering and screening on the alarm causal association graph to obtain a causal cluster; performing root cause alarm identification and clustering compression according to the causal clustering cluster to obtain compressed output of redundant alarms; according to the invention, high-precision causal identification and adaptive clustering of multi-source alarm events are realized, repeated alarms and false alarms are effectively reduced, and the root cause analysis and noise reduction efficiency is improved.

Description

Technical Field

[0001] This invention relates to the field of intelligent alarm analysis technology, and more specifically, to a method, apparatus, and equipment for intelligent alarm analysis and noise reduction verification based on AI large model. Background Technology

[0002] With the widespread application of cloud computing, the Internet of Things, and distributed microservice architectures, the scale and complexity of information systems are constantly increasing, leading to highly dynamic, multi-layered dependencies between system components, services, and networks. In such complex environments, monitoring systems typically use multi-source alarm mechanisms to capture system anomalies. However, in actual operation, alarm systems often generate a large number of redundant alarms, false alarms, and cascading alarms, which not only increases the alarm handling burden on operations and maintenance personnel but also reduces the accuracy and response efficiency of root cause analysis. Summary of the Invention

[0003] To overcome the aforementioned deficiencies of the prior art, embodiments of the present invention provide a method, apparatus, device, and medium for intelligent alarm analysis and noise reduction verification based on AI large model, which enables high-precision causal identification and adaptive clustering of multi-source alarm events, effectively reducing duplicate alarms and false alarms, and improving root cause analysis and noise reduction efficiency.

[0004] To achieve the above objectives, the present invention provides the following technical solution: Firstly, this application provides an AI-based large-scale model-based intelligent alarm analysis and noise reduction verification method. This method includes: acquiring alarm data and environmental context information and constructing a system relationship graph; generating a multi-dimensional feature vector set based on the system relationship graph; obtaining the causal strength between each alarm event based on the multi-dimensional feature vector set, obtaining a causal strength matrix, and mapping it to the system relationship graph to form an alarm causal relationship graph; performing graph structure clustering and filtering on the alarm causal relationship graph to obtain causal clusters; and performing root cause alarm identification and cluster compression based on the causal clusters to obtain compressed output of redundant alarms.

[0005] In one embodiment, alarm data and environmental context information are acquired, and a system relationship graph is constructed. The environmental context information includes a system topology description file and a service dependency table. Specifically, the alarm data is preprocessed to generate a structured standard alarm dataset; the dataset is segmented to generate a word vector sequence; the word vector sequence is input into a pre-trained BERT encoding model to obtain the context encoding output, and the average is taken to obtain the semantic embedding vector corresponding to each alarm text; the semantic similarity between different alarm texts is calculated, and clustering and normalization are performed to output the semantic label and semantic embedding vector of each alarm; the nodes in the system are parsed according to the system topology description file, and directed edges are generated and assigned edge weights according to the call records in the service dependency table; a system relationship graph is constructed based on the nodes, directed edges, and edge weights.

[0006] In one embodiment, a multidimensional feature vector set is generated based on the system relationship graph. Specifically, for each alarm event, the corresponding node is found in the system relationship graph, and the set of upstream and downstream adjacent nodes, alarm time difference features, and co-occurrence frequency features of the corresponding node are obtained. The dependency strength features are calculated based on the alarm time difference features and co-occurrence frequency, and a context association feature vector is generated. The alarm time series is modeled according to a fixed sliding time window, and the time series feature vector is extracted. The semantic tags and semantic embedding vectors, context association feature vectors, and time series feature vectors are normalized, and a multidimensional feature vector set is generated by weighted summation.

[0007] In one embodiment, the causal strength between alarm events is obtained based on a multidimensional feature vector set, resulting in a causal strength matrix, which is then mapped onto the system relationship graph to form an alarm causal relationship graph. Specifically, based on the multidimensional feature vector set, all alarm events are sorted by occurrence time, and a time window for an adaptive adjustment mechanism is set; alarm event sets with time differences smaller than the time window are extracted to form a time-related alarm subset; based on the time-related alarm subset, the time difference between each alarm event pair is calculated and standardized as a time dependency weight; based on the time dependency weight and the cosine similarity between semantic and contextual features in the multidimensional feature vector set, the comprehensive similarity between each alarm event is calculated, and a comprehensive correlation matrix is ​​generated; based on the comprehensive correlation matrix, the causal strength matrix is ​​obtained through the conditional independence test of the improved PC algorithm and mapped onto the system relationship graph to form an alarm causal relationship graph.

[0008] In one embodiment, based on the comprehensive correlation matrix, a causal strength matrix is ​​obtained through the conditional independence test of the improved PC algorithm, and mapped onto the system relationship graph to form an alarm causal relationship graph. Specifically, the following steps are taken: an initial undirected graph is set according to the comprehensive correlation matrix; for each node, a partial correlation coefficient is obtained on a preset candidate condition set, and the alarm event pairs of the current node are deemed conditionally independent based on the partial correlation coefficient, and the edges are deleted; the edge direction is set based on the chronological order and the minimum path principle to obtain the skeleton of the causal directed graph; based on the causal directed graph skeleton, the causal strength is calculated for each directed edge, and after normalization, a causal strength matrix is ​​obtained; the causal strength matrix is ​​mapped onto the system relationship graph to form an alarm causal relationship graph with edge weights.

[0009] In one embodiment, a time window for the adaptive adjustment mechanism is set, specifically as follows: extracting time-series data between each pair of service nodes under service dependencies from historical alarm data to construct a service time-series feature matrix; generating multiple candidate time window sets based on the time-series feature matrix; obtaining the time correlation of each candidate time window on the alarm event time series; jointly analyzing the time correlation of each candidate time window with the set alarm event causal labels to calculate the information gain value of each window, and selecting the window with the largest information gain as the current optimal time window; applying the current optimal time window to alarm subset filtering and time dependency matrix construction.

[0010] In one embodiment, graph structure clustering and filtering are performed on the alarm causal relationship graph to obtain causal clusters. Specifically, based on the alarm causal relationship graph, the nodes are initially divided to obtain a preliminary cluster set; the average causal density and node contribution within each cluster are calculated; loose nodes are marked according to their node contribution, and the average causal density and loose node set of each cluster are output; nodes marked as loose are processed in the following order: 1) If the average edge weight of a loose node outside a cluster is higher than its average edge weight within the original cluster, the node is transferred from the current cluster to the other cluster; 2) If the maximum correlation strength of the node in any cluster is lower than a preset isolation threshold, the node is formed into a single-node cluster; 3) If the average causal density of a cluster is lower than a set minimum cluster density threshold after transfer and isolation, the cluster is merged or disbanded to obtain the final cluster set; the node with the largest node contribution in the final cluster set is taken as the representative alarm of the cluster and clustered to obtain the causal cluster.

[0011] In one embodiment, root cause alarm identification and cluster compression are performed based on causal clusters to obtain compressed output of redundant alarms. Specifically, the following steps are taken: the comprehensive impact score of a node is calculated based on trigger credibility and node contribution; in the causal cluster, nodes are sorted from largest to smallest according to their comprehensive impact score and several nodes are selected as root cause candidate sets; the node with the largest comprehensive impact score among the root cause candidates is selected as the representative alarm, and a representative alarm list is output; all non-representative alarms within the cluster are compressed into redundant entries according to preset rules to obtain compressed output; and the final compressed output is generated based on the representative alarm list and the compressed output.

[0012] Secondly, this application provides an AI-based large-scale model alarm intelligent analysis and noise reduction verification device, which includes: a vector set generation module, used to acquire alarm data and environmental context information and construct a system relationship graph, and generate a multi-dimensional feature vector set based on the system relationship graph; an alarm causal relationship graph construction module, used to obtain the causal strength between each alarm event based on the multi-dimensional feature vector set, obtain a causal strength matrix, and map it to the system relationship graph to form an alarm causal relationship graph; a causal cluster generation module, used to perform graph structure clustering and filtering on the alarm causal relationship graph to obtain causal clusters; and a compression output module, used to perform root cause alarm identification and cluster compression based on the causal clusters to obtain compressed output of redundant alarms.

[0013] Thirdly, this application provides an electronic device, comprising: Memory, used to store computer programs; A processor is used to execute the computer program to implement the steps of the aforementioned AI-based large model alarm intelligent analysis and noise reduction verification method.

[0014] As can be seen from the above technical solutions, the embodiments of this application have the following advantages: By integrating alarm semantic features, system topology context information, and time-series behavior, a multi-dimensional feature vector set is constructed, and an improved causal inference mechanism is introduced. This enables high-precision identification of causal relationships and root cause localization of alarm events in complex and heterogeneous system environments. Dynamic matching of system load and propagation characteristics via adaptive time windows effectively improves the robustness and accuracy of causal analysis. Combining semantic clustering and topological dependency features, modeling of the actual propagation links between alarm events and noise filtering are achieved. Furthermore, through graph structure clustering and node contribution calculation, root cause alarms are automatically identified, and redundant alarms are clustered and compressed for output. This scheme can significantly reduce the number of alarms, improve the interpretability and computational efficiency of causal inference, thereby providing operation and maintenance systems with efficient, intelligent, and visualized alarm correlation analysis and root cause diagnosis capabilities. Attached Figure Description

[0015] Figure 1This is a schematic diagram of a method for intelligent analysis and noise reduction verification of alarms based on a large AI model, provided in an embodiment of this application.

[0016] Figure 2 This is a schematic diagram of a device for intelligent alarm analysis and noise reduction verification based on an AI large model, provided in an embodiment of this application.

[0017] Figure 3 This is a structural diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0019] Reference Figure 1 As shown in the diagram, the present invention provides a flowchart of an AI-based large-scale model-based intelligent alarm analysis and noise reduction verification method, which includes the following steps: S1: Obtain alarm data and environmental context information and construct a system relationship graph, and generate a multi-dimensional feature vector set based on the system relationship graph.

[0020] The alarm data is collected from the monitoring system, device log system, and business monitoring platform. The alarm data includes alarm identifier, timestamp, alarm level, alarm source, alarm object, and alarm content. At the same time, the runtime environment context information is read from the system configuration management library, including the system topology description file (JSON format), service dependency table, and resource usage monitoring log. The service dependency table is a structured data table used to record the calling relationship between various services or modules in the system. It includes fields such as caller identifier, callee identifier, dependency type, communication protocol, call frequency, average response time, and dependency status, which are used to support the construction of system topology relationship and alarm causal relationship analysis.

[0021] In this embodiment, alarm data and environmental context information are acquired, and a system relationship diagram is constructed, specifically as follows: The alarm data is preprocessed to generate a structured standard alarm dataset. The preprocessing includes time alignment, format standardization, and anomaly cleaning for each alarm event using a unified clock source. The alarm text field in the standard alarm dataset is segmented into words, and the initial word vector corresponding to each sub-word is found based on a preset vocabulary to obtain a word vector sequence. The word segmentation process adopts the Chinese sub-word decomposition method based on the WordPiece algorithm to divide the text into the smallest recognizable semantic units. The word vector sequence is input into a pre-trained BERT encoding model based on the Transformer structure to obtain the context encoding output; The average value of the context encoding output is used as the overall semantic representation of the sentence to obtain the semantic embedding vector corresponding to each alarm text; Cosine similarity is used to calculate the semantic similarity between different alarm texts, and clustering and normalization are performed based on a set threshold to output the semantic label and semantic embedding vector of each alarm. The difference between different alarm texts is calculated based on their semantic similarity. If the difference is lower than a set threshold, they are classified into the same category.

[0022] Based on the system topology description file, the nodes (services, modules, devices) in the system are parsed, and directed edges are generated and assigned weight values ​​based on the call records in the service dependency table; The specific formula for calculating the edge weight is as follows:

[0023] In the formula, The edge weight value. , These are the empirical weights, The number of calls per unit of time. This represents the average response time.

[0024] Construct a system relationship graph based on nodes, directed edges, and edge weights.

[0025] Furthermore, a multi-dimensional feature vector set is generated based on the system relationship graph, specifically as follows: For each alarm event, locate its corresponding node in the system relationship diagram; Obtain the set of upstream and downstream adjacent nodes of the corresponding node, and obtain the alarm time difference characteristics and co-occurrence frequency characteristics; Among them, the alarm time difference feature indicates the temporal relationship between two alarm events, and the co-occurrence frequency feature indicates the frequency at which the two events occur simultaneously within the sliding time window.

[0026] Dependency strength features are calculated based on alarm time difference characteristics and co-occurrence frequency, and context-related feature vectors are generated. The specific calculation formula for the dependency strength feature is as follows:

[0027] In the formula, For the strength of dependence feature, For target alarm nodes With adjacent nodes Co-occurrence frequency characteristics, This refers to the alarm time difference characteristic.

[0028] The contextual correlation feature vector refers to a multi-dimensional numerical feature set formed by statistically calculating the time difference, co-occurrence frequency, and dependency strength characteristics of the target alarm node and its upstream and downstream dependent nodes based on the system topology graph, and then standardizing and vectorizing it. It is used to describe the causal correlation characteristics of alarm events in the topological context. The larger the dependency strength feature, the closer the target alarm node and its set of neighboring nodes are in time, the more frequent their co-occurrence, and the stronger their causal relationship.

[0029] The alarm time series is modeled according to a fixed sliding time window, and the time series feature vector is extracted. The time series feature vector includes the mean and standard deviation of the event interval within the time window. The semantic labels and semantic embedding vectors, context-related feature vectors, and temporal feature vectors are normalized, and a multi-dimensional feature vector set is generated by weighted summation.

[0030] It should be noted that dependency strength features refer to the measure of the degree of association between an alarm node and its upstream and downstream neighboring nodes in the system relationship graph. The multidimensional feature vector set refers to a high-dimensional numerical feature set that integrates semantic information, topological context information, and time-series information, used to comprehensively characterize the semantic meaning, contextual dependencies, and temporal behavior of each alarm event in the system.

[0031] S2, based on the multi-dimensional feature vector set, obtain the causal strength between each alarm event, obtain the causal strength matrix, and map it to the system relationship graph to form an alarm causal relationship graph.

[0032] In this embodiment, the causal strength between each alarm event is obtained based on a multi-dimensional feature vector set, resulting in a causal strength matrix, which is then mapped onto the system relationship graph to form an alarm causal relationship graph, specifically: Based on a multidimensional feature vector set, all alarm events are sorted according to their occurrence time, and a time window for the adaptive adjustment mechanism is set. Extract the set of alarm events with a time difference smaller than the time window to form a time-related alarm subset, so as to ensure that causal analysis is only performed between alarms that are close in time and have a real possibility of propagation; Based on the time-dependent alarm subset, calculate the time difference between each alarm event pair and standardize it into a time-dependent weight; The time-dependent weights are calculated using the following formula:

[0033] In the formula, For time-dependent weights, The time difference between each alarm event pair This is the time decay coefficient.

[0034] The time decay coefficient is adaptively updated based on the system load volatility, specifically as follows: In the formula, The initial time decay coefficient, For adjustment coefficients, This refers to the system load volatility.

[0035] Based on the time-dependent weights and the cosine similarity between semantic and contextual features in the multidimensional feature vector set, the comprehensive similarity between each alarm event is calculated, and a comprehensive correlation matrix is ​​generated. The comprehensive similarity is calculated using the following formula:

[0036] In the formula, For alarm events and The overall correlation between them These are weighting coefficients. Cosine similarity between semantic and contextual features in a multidimensional feature vector set.

[0037] Based on the comprehensive correlation matrix, the causal strength matrix is ​​obtained by improving the conditional independence test of the PC algorithm, and then mapped onto the system relationship graph to form an alarm causal relationship graph.

[0038] Furthermore, based on the comprehensive correlation matrix, a causal strength matrix is ​​obtained through the conditional independence test of the improved PC algorithm, and mapped onto the system relationship graph to form an alarm causal relationship graph, specifically: The edges in the comprehensive correlation matrix whose comprehensive similarity value is greater than a preset similarity threshold are used as the initial undirected graph; For each node The partial correlation coefficient is obtained on the preset candidate condition set. If the partial correlation coefficient is less than the set independence threshold, the alarm event pairs of the current node are considered to be conditionally independent and the edges are deleted. Among them, the candidate condition set refers to the set of alarm events excluding the node being tested when performing conditional independence testing. and A subset of alarm events selected from external sources that are highly correlated with or have a service dependency relationship with both are used for testing after controlling for the impact of this subset. and Whether to maintain statistical dependence in order to determine whether there is a direct causal relationship between the two; The partial correlation coefficient is calculated using the following formula:

[0039] In the formula, The partial correlation coefficient, To alarm events without controlling any other variables and The Pearson correlation coefficient between them For alarm events With candidate condition set The multivariate correlation coefficient, For alarm events With candidate condition set The multivariate correlation coefficient.

[0040] Based on the chronological order and the principle of minimum path, the edge direction is set so that the edge direction points from the earlier event to the later event, thus avoiding causal loops and obtaining the skeleton of the causal directed graph. Based on the causal directed graph skeleton, the causal strength is calculated for each directed edge, and after normalization, the causal strength matrix is ​​obtained. The causal strength matrix is ​​mapped to the system relationship graph to form an alarm causal relationship graph. Specifically, non-zero elements in the causal strength matrix are mapped to the system service topology. If an alarm event corresponding to a service node has an edge... Then, weighted edges are added to the system relationship graph to form a weighted alarm causal relationship graph, where the weight of each edge represents the strength of the causal relationship between alarm events.

[0041] Furthermore, a time window for the adaptive adjustment mechanism is set, specifically as follows: Extract time-series data between each pair of service nodes under service dependency from historical alarm data, and construct a service time-series feature matrix. The time-series data includes propagation delay, delay variance, co-occurrence frequency and trigger interval. Multiple candidate time window sets are generated based on the aforementioned time series feature matrix, with each candidate time window corresponding to a different delay distribution range; For each candidate time window, the temporal correlation is obtained in parallel on the time series of alarm events to reflect the strength of the temporal correlation of events at different time scales; The specific formula for calculating the time correlation is as follows:

[0042] In the formula, For time relevance, This is the candidate time window.

[0043] The time correlation of each candidate time window is jointly analyzed with the set causal label of the alarm event, the information gain value of each window is calculated, and the window with the largest information gain is selected as the current optimal time window. The specific formula for calculating the information gain value is as follows:

[0044] In the formula, This is the information gain value. Y is a mutual information function, and Y is an indicator label variable indicating whether there is a true causal relationship between alarm events.

[0045] The current optimal time window is applied to alarm subset filtering and time dependency matrix construction.

[0046] It's important to note that the advantage of setting an adaptive adjustment mechanism for the time window is that it can dynamically adjust the time analysis range based on system load, inter-service propagation latency, and the timing characteristics of alarm events, thus adaptively matching the fault propagation characteristics under different business scenarios. Compared to a fixed time window, it automatically selects the time scale that best reflects the true causal relationship through statistical analysis and information gain optimization of historical alarm time-series data. This ensures that alarm causal inference can cover potential delayed propagation while effectively filtering out irrelevant temporal noise events, thereby significantly improving the accuracy and robustness of causal correlation analysis and reducing the occurrence of false positives and false negatives.

[0047] S3, perform graph structure clustering and filtering on the alarm causal relationship graph to obtain causal clusters.

[0048] In this embodiment, graph structure clustering and filtering are performed on the alarm causal relationship graph to obtain causal clusters, specifically as follows: Based on the alarm causal relationship graph, a community detection algorithm is used to initially divide the nodes to obtain a preliminary cluster set. The community detection algorithm is the Louvain algorithm. Calculate the average causal density and node contribution within each cluster; The average causality density is calculated using the following formula:

[0049] In the formula, For average causal density, For the k-th cluster, For causal weights, the average causal density characterizes the average causal connection strength within a cluster, reflecting the overall degree of correlation between nodes within the cluster; a larger value indicates a more "dense" cluster.

[0050] The specific formula for calculating the node contribution is as follows:

[0051] In the formula, Contribution to the node The total causal strength within the cluster represents the sum of the causal influence strengths among all nodes in the cluster. For nodes The total causal output strength for other nodes within the cluster.

[0052] It should be noted that the node contribution score is used to measure the "contribution degree" of a single alarm node within the cluster. A higher value indicates that the node accounts for a large proportion of the causal output within the cluster and may be the core trigger alarm of the cluster. A lower value indicates that the node contributes less to the overall behavior within the cluster and may be an affected passive alarm or a noise alarm.

[0053] Nodes whose contribution is less than the set partition threshold are marked as loose nodes, and the average causal density and the set of loose nodes for each cluster are output. For nodes marked as loose, process them in the following order: 1) If the average edge weight of a loose node outside a cluster is higher than its average edge weight inside the original cluster, then the node is transferred from the current cluster to the new cluster. 2) If the maximum association strength of a node in any cluster is lower than the preset isolation threshold, then the node will be formed into a single-node cluster. 3) If the average causal density of a cluster falls below the set minimum cluster density threshold after transfer and isolation, then the cluster is merged or dissolved to obtain the final cluster set. The node with the largest contribution in the final cluster set is taken as the representative alarm of the cluster and used as the root cause candidate. They are then clustered to obtain causal clusters.

[0054] S4. Based on the causal clustering clusters, root cause alarm identification and clustering compression are performed to obtain compressed output of redundant alarms.

[0055] In this embodiment, root cause alarm identification and cluster compression are performed based on causal clustering clusters to obtain compressed output of redundant alarms, specifically as follows: The trigger credibility is obtained and combined with the node contribution to calculate the node's comprehensive influence score through a weighted summation. In the causal clustering, nodes are sorted from largest to smallest based on their comprehensive influence and a number of nodes are selected as the root cause candidate set. The node with the largest comprehensive impact score among the root cause candidates is used as the representative alarm, and a representative alarm list is output. The representative alarm list includes the alarm identifier, timestamp, original alarm semantic summary (a short text generated by aggregating semantic vectors within the cluster), its causal propagation subgraph, and intra-cluster compressed statistics (number of nodes, original alarm time range, average causal density). All non-representative alarms within a cluster are compressed into redundant entries according to preset rules to obtain compressed output. The preset rules include marking a node as compressed and hidden if the semantic similarity between a node and a representative alarm is greater than a preset compression threshold. The compressed output includes alarm records, a count and time range of compressed hidden alarms, and several key examples of compressed hidden alarms.

[0056] A final compressed output is generated based on the representative alarm list and the compressed output. The final compressed output includes a representative alarm list, a list or range of compressed alarm IDs corresponding to each representative, and a simplified view of the causal propagation graph.

[0057] Reference Figure 2 As shown in the diagram, this invention provides a schematic diagram of an AI-based large-model alarm intelligent analysis and noise reduction verification device, which includes a vector set generation module, an alarm causal relationship graph construction module, a causal cluster generation module, and a compression output module. The modules are interconnected. The vector set generation module is used to acquire alarm data and environmental context information and construct a system relationship graph, and generate a multi-dimensional feature vector set based on the system relationship graph; The alarm causal relationship graph construction module is used to obtain the causal strength between each alarm event based on a multi-dimensional feature vector set, obtain the causal strength matrix, and map it to the system relationship graph to form the alarm causal relationship graph. The causal cluster generation module is used to perform graph structure clustering and filtering on the alarm causal relationship graph to obtain causal clusters; The compression output module is used to identify and compress root cause alarms based on causal clustering clusters, and to obtain compressed output of redundant alarms.

[0058] Furthermore, embodiments of this application also disclose an electronic device, Figure 3 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application.

[0059] Figure 3 This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of this application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the AI-based large model alarm intelligent analysis and noise reduction verification method disclosed in any of the foregoing embodiments. Alternatively, the electronic device 20 in this embodiment may specifically be a computer.

[0060] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here. The processor 21 may include one or more processing cores, such as a quad-core processor or an octa-core processor. The processor 21 may be implemented using at least one hardware form selected from DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). The processor 21 may also include a main processor and a coprocessor. The main processor, also known as a CPU (Central Processing Unit), is used to process data in the wake-up state; the coprocessor is a low-power processor used to process data in the standby state. In some embodiments, the processor 21 may integrate a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the screen. In some embodiments, the processor 21 may also include an AI (Artificial Intelligence) processor, which is used to handle computational operations related to machine learning.

[0061] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored thereon can include operating system 221, computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0062] The operating system 221 manages and controls the various hardware devices and computer programs 222 on the electronic device 20 to enable the processor 21 to perform calculations and processing on the massive amounts of data 223 in the memory 22. It can be Windows Server, Netware, Unix, Linux, etc. The computer program 222, in addition to including a computer program capable of performing the AI-based large-model alarm intelligent analysis and noise reduction verification method executed by the electronic device 20 as disclosed in any of the foregoing embodiments, may further include computer programs capable of performing other specific tasks. The data 223 may include data received by the electronic device from external devices, as well as data collected by its own input / output interface 25.

[0063] Furthermore, this application also discloses a computer-readable storage medium storing a computer program. When the computer program is loaded and executed by a processor, it implements the steps of the AI-based large model alarm intelligent analysis and noise reduction verification method provided in any of the foregoing embodiments.

[0064] The above formulas are all dimensionless calculations. The formulas are derived from software simulations based on a large amount of collected data to obtain the most recent real-world results. The preset parameters in the formulas are set by those skilled in the art according to the actual situation.

[0065] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, in the form of a computer program product.

[0066] Those skilled in the art will recognize that the modules and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0067] In addition, the functional modules in the various embodiments of this application can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module.

[0068] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0069] In conclusion, the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. An AI large model-based alarm intelligent analysis and noise reduction verification method, characterized in that, The method comprises the following steps: acquiring alarm data and environment context information and constructing a system relationship graph, generating a multi-dimensional feature vector set based on the system relationship graph; based on the multi-dimensional feature vector set, acquiring the causal strength between each alarm event, obtaining a causal strength matrix, and mapping it to the system relationship graph to form an alarm causal correlation graph; performing graph structure clustering and filtering on the alarm causal correlation graph to obtain a causal clustering cluster; according to the causal clustering cluster, identifying and clustering the root cause alarm to obtain a compressed output of redundant alarms. 2.The AI large model-based warning intelligent analysis and noise reduction verification method according to claim 1, characterized in that, The method comprises the following steps: preprocessing the alarm data and generating a structured standard alarm data set; performing word segmentation processing on the data set and generating a word vector sequence; inputting the word vector sequence into a pre-trained BERT encoding model to obtain a context encoding output, and taking the average to obtain a semantic embedding vector corresponding to each alarm text; calculating the semantic similarity between different alarm texts and performing clustering normalization to output the semantic label and semantic embedding vector of each alarm; analyzing the nodes in the system according to the system topology description file, generating directed edges and assigning edge weight values according to the call records in the service dependency table; constructing a system relationship graph according to the nodes, directed edges and edge weight values. 3.The AI large model-based alarm intelligent analysis and noise reduction verification method of claim 2, wherein, The method comprises the following steps: for each alarm event, find the corresponding node in the system relationship graph and acquire the upstream and downstream adjacent node set, alarm time difference feature and co-occurrence frequency feature of the corresponding node; calculate the dependency strength feature according to the alarm time difference feature and co-occurrence frequency to generate a context association feature vector; model the alarm time sequence according to a fixed sliding time window to extract a time series feature vector; normalize the semantic label and semantic embedding vector, context association feature vector and time series feature vector, and generate a multi-dimensional feature vector set by weighted summation. 4.The AI large model-based alarm intelligent analysis and noise reduction verification method of claim 3, wherein, The method comprises the following steps: based on the multi-dimensional feature vector set, sort all alarm events according to the occurrence time and set an adaptive adjustment mechanism time window; extract the alarm event set with a time difference less than the time window to form a time-related alarm subset; calculate the time difference between each alarm event pair according to the time-related alarm subset and standardize it to a time dependency weight value; calculate the comprehensive similarity between each alarm event according to the time dependency weight value and the cosine similarity between the semantic and context features in the multi-dimensional feature vector set to generate a comprehensive correlation matrix; based on the comprehensive correlation matrix, obtain the causal strength matrix by improving the conditional independence test of the PC algorithm and map it to the system relationship graph to form an alarm causal correlation graph. 5.The AI large model-based warning intelligent analysis and noise reduction verification method according to claim 4, characterized in that, The method comprises the following steps: set an initial undirected graph according to the comprehensive correlation matrix; For each node, obtain a partial correlation coefficient on a preset candidate condition set, determine that the current node alarm event pairs are conditionally independent according to the partial correlation coefficient, and delete the edges; Set the edge direction based on the time sequence and the minimum path principle to obtain a causal directed graph skeleton; Based on the causal directed graph skeleton, calculate the causal strength of each directed edge, and obtain a causal strength matrix after normalization; Map the causal strength matrix to the system relationship graph to form an alarm causal correlation graph with edge weights. 6.The AI large model-based warning intelligent analysis and noise reduction verification method according to claim 5, characterized in that, The adaptive adjustment mechanism is set for a time window, specifically: Extract the timing data between each pair of service nodes under the service dependency relationship from the historical alarm data to construct a service timing feature matrix; Based on the timing feature matrix, generate a plurality of candidate time window sets; For each candidate time window, obtain the time correlation on the alarm event time sequence; Jointly analyze the time correlation under each candidate time window and the set alarm event causal label, calculate the information gain value of each window, and select the window with the maximum information gain as the current optimal time window; Apply the current optimal time window to alarm subset screening and time dependency matrix construction. 7.The AI large model-based warning intelligent analysis and noise reduction verification method according to claim 6, characterized in that, The alarm causal correlation graph is clustered and screened to obtain a causal clustering cluster, specifically: Based on the alarm causal correlation graph, the nodes are preliminarily divided to obtain a preliminary cluster set; Calculate the average causal density and node contribution degree in each cluster; Mark the loose nodes according to the node contribution degree, and output the average causal density and loose node set of each cluster; For the nodes marked as loose, the following order is processed: 1) If the average edge weight of the loose node outside the cluster is higher than the average edge weight in the original cluster, the node is transferred from the current cluster to a certain cluster; 2) If the maximum correlation strength in any cluster is lower than the preset isolation threshold, the node is formed into a single-node cluster alone; 3) If the transfer and isolation result in an average causal density of a cluster being lower than the set minimum cluster density threshold, the cluster is executed to perform a merge or disperse operation to obtain a final cluster set; The node with the maximum node contribution degree in the final cluster set is taken as the representative alarm of the cluster, and the causal clustering cluster is obtained by clustering. 8.The AI large model-based warning intelligent analysis and noise reduction verification method of claim 7, wherein, The root cause alarm identification and clustering compression are performed according to the causal clustering cluster to obtain a compressed output of redundant alarms, specifically: Calculate the node comprehensive influence score based on the trigger credibility and node contribution degree; In the causal clustering cluster, sort the nodes according to the node comprehensive influence score from large to small and select a certain number of nodes as a root cause candidate set; Take the node comprehensive influence score in the root cause candidate as the representative alarm, and output a representative alarm list; Compress all non-representative alarms in the cluster into redundant entries through a preset rule to obtain a compressed output; Generate a final compressed output according to the representative alarm list and the compressed output.

9. An apparatus using the AI-based large model alarm intelligent analysis and noise reduction verification method according to any one of claims 1-8, characterized in that, It includes: A vector set generation module for obtaining alarm data and environmental context information and constructing a system relationship graph, generating a multi-dimensional feature vector set based on the system relationship graph; An alarm causal correlation graph construction module for obtaining the causal strength between each alarm event based on the multi-dimensional feature vector set, obtaining a causal strength matrix, and mapping it to the system relationship graph to form an alarm causal correlation graph; A cause-effect clustering cluster generation module is configured to perform graph structure clustering and filtering on the alarm cause-effect correlation graph to obtain a cause-effect clustering cluster; A compression output module is configured to perform root cause alarm identification and clustering compression according to the cause-effect clustering cluster to obtain a compression output of redundant alarms.

10. An electronic device, comprising: The method comprises the following steps: a memory configured to store a computer program; a processor configured to execute the computer program to implement the steps of the AI large model-based alarm intelligent analysis and noise reduction verification method according to any one of claims 1 to 8.

Images