Method and system for automatic generation of knowledge base based on generative AI

Abstract

The application belongs to the technical field of knowledge graph, and discloses a knowledge base automatic generation method and system based on generative AI, which comprises the following steps: encapsulating original event data of different sources into a standard envelope containing the source, original timestamp and load, and publishing the standard event message to the corresponding message agent theme of the configured Kafka theme list; based on the preset event session time window and the preset event session silence period, performing state aggregation on the standardized event message stream, and recombining discrete events around a single fault into associated event packages; the application effectively solves the integration problem of heterogeneous data sources, improves the data integration quality, ensures that new knowledge can be accurately integrated into the existing knowledge system, and makes the knowledge graph maintain consistency and effectiveness.

Description

Technical Field

[0001] This invention relates to the field of knowledge graph technology, and more specifically, to a method and system for automatically generating knowledge bases based on generative AI. Background Technology

[0002] In the field of modern intelligent operations and maintenance (AIOps), its core driving force is evolving from reactive problem handling to proactive, predictive risk avoidance. This evolution places unprecedented demands on the underlying knowledge representation capabilities. Traditional operational data, such as discrete log entries and independent monitoring metrics, are essentially isolated snapshots of time points, making it difficult to support complex analytical tasks. To address this challenge, knowledge graphs, as a structured technology capable of effectively representing complex entities and their interrelationships, are increasingly being introduced into the AIOps field to build a unified view of IT infrastructure and services.

[0003] However, the knowledge graphs widely used in the industry today are inherently static. While these static knowledge graphs can effectively depict the structural relationships between system components, they have fundamental shortcomings in capturing the dynamic, temporal, and causal nature of operational events. They excel at answering "what is related to what," but cannot explain "how events evolve over time" or "why one event leads to another." Furthermore, static knowledge graphs face severe data quality and integration challenges when integrating heterogeneous data sources such as logs, monitoring, and work orders, further limiting their application value in dynamic environments.

[0004] Therefore, the AIOps field faces a common technical bottleneck: the lack of a knowledge representation paradigm that can go beyond static correlations and effectively model and reason about dynamic, temporal, and causal dependencies. This directly hinders the leap to higher-order predictive and autonomous operation and maintenance capabilities.

[0005] In view of this, the present invention proposes a method and system for automatically generating knowledge bases based on generative AI to solve the above problems. Summary of the Invention

[0006] To overcome the aforementioned shortcomings of the prior art and achieve the above objectives, the present invention provides the following technical solution: a method for automatically generating a knowledge base based on generative AI, comprising:

[0007] Step F1: Encapsulate the raw event data from different sources into a standard envelope containing the source, raw timestamp, and payload, and publish it as a standardized event message to the corresponding message broker topic in the configured Kafka topic list;

[0008] Step F2: Based on the preset event conversational time window and the preset event conversational silence period, perform stateful aggregation on the standardized event message stream, and reorganize discrete events around a single fault into related event packets.

[0009] Step F3: Extract causal relationships from the associated event packages through a large language model call chain that includes logical reasoning and fact-checking, and generate a verified causal directed acyclic graph.

[0010] Step F4: Perform online entity parsing on each entity string mentioned in the verified causal directed acyclic graph, align the entity strings to the namespace of the initial state of the global temporal and causal knowledge graph, and obtain a normalized causal directed acyclic graph.

[0011] Step F5 involves performing a dual query on the normalized causal directed acyclic graph, combining subgraph isomorphic pattern matching and entity embedding vector similarity search, to identify the optimal phylogenetic grafting point of the normalized causal directed acyclic graph in the initial state of the global temporal series and causal knowledge graph, and generating a grafting plan.

[0012] Step F6: If the normalized causal directed acyclic graph contains new entities or event types that cannot be mapped to the current ontology, then after obtaining approval through the configured intelligent operation and maintenance expert review interface, the ontology of the initial state of the global temporal and causal knowledge graph is updated, and the graph writing operation is performed according to the grafting plan to obtain an updated and consistent global temporal and causal knowledge graph.

[0013] Furthermore, the implementation method of step F3 includes: step F3F1, integrating all text content in the associated event package into a context block, and guiding the large language model to generate a natural language narrative arranged in chronological order through thought chain prompts to obtain the event narrative text; step F3F2, combining the event narrative text with the original text of the associated event package, and instructing the large language model to formalize the narrative into a structured directed acyclic graph by carrying a prompt carrying a preset causal directed acyclic graph extraction JSON object schema format, to obtain the original extracted directed acyclic graph; step F3F3, performing reflective self-correction on the original extracted directed acyclic graph, filtering out illusory content below the preset fact-checking confidence threshold, and generating a verified causal directed acyclic graph.

[0014] Further, the implementation method of step F5 includes: step F5F1, performing a subgraph isomorphism search on the topological structure of the normalized causal directed acyclic graph, searching for all structurally matching historical event subgraphs in the initial state of the global temporal and causal knowledge graph, and generating a list of structural matching results; step F5F2, extracting the pre-computed embedding vectors of all asset nodes in the normalized causal directed acyclic graph, and performing a k-nearest neighbor vector similarity search based on the pre-computed embedding vectors in the initial state of the global temporal and causal knowledge graph to find historically influential... For events involving similar assets, a semantic matching result list is generated; in step F5F3, the structural matching result list and the semantic matching result list are fused using a pre-set grafting scoring model weight and a pre-set inverse sorting fusion constant, generating a candidate grafting point list sorted by comprehensive score; in step F5F4, the event with the highest score is selected from the candidate grafting point list as the best grafting point, and a directed acyclic graph containing the new event, meta-relationships to be created belonging to recurrence relationships or shared root cause relationships, and a grafting plan defined by the target grafting point are generated.

[0015] Furthermore, the implementation method of step F6 includes: Step F6F1, initiating a graph database transaction to ensure the atomicity of all subsequent operations; Step F6F2, checking whether there are any new entities marked as to be created or unknown event types in the normalized causal directed acyclic graph. If so, triggering the schema evolution process driven by the large language model to obtain the approved ontology update instruction; Step F6F3, in the database transaction, first executing the approved ontology update instruction to add new node labels or attribute definitions to the schema of the graph database; Step F6F4, according to the instructions defined in the grafting plan, creating nodes and edges representing new events in the database transaction, and establishing higher-order recurrence relations or shared root cause relations; Step F6F5, committing the database transaction. If any step fails, a complete rollback is performed to obtain an updated and consistent global temporal and causal knowledge graph.

[0016] Furthermore, the implementation method of step F3F1 includes: step F3F1F1, extracting the text payload and timestamp of all events from the associated event package; step F3F1F2, sorting the extracted text by timestamp and formatting it into coherent text blocks; step F3F1F3, constructing a prompt containing thought chain instructions; step F3F1F4, combining the prompt with the formatted text blocks, sending a request to the large language model through the configured large language model endpoint and credentials, and using the returned text content as the event narrative text.

[0017] The implementation method of step F3F2 includes: step F3F2F1, constructing a prompt, instructing the large language model to extract key event nodes and their causal or temporal relationships based on the provided event narrative text and the original text of the associated event package; step F3F2F2, requiring the output of the large language model to conform to the preset schema format of the causal directed acyclic graph extraction JSON object; step F3F2F3, sending the prompt, event narrative text, original text of the associated event package, and the preset schema format of the causal directed acyclic graph extraction JSON object together to the configured large language model endpoint and the model specified by the credential; step F3F2F4, parsing the JSON object returned by the large language model that conforms to the schema format into the original extracted directed acyclic graph;

[0018] The implementation method of step F3F3 includes: Step F3F3F1, firstly, performing syntax validation on the original extracted directed acyclic graph to ensure that the original extracted directed acyclic graph is a valid JSON object; Step F3F3F2, for each node and edge in the original extracted directed acyclic graph, initiating a reflective validation request to the large language model, requiring the large language model to find original text evidence supporting the node or edge in the associated event package, and providing a confidence score to obtain a validation report; Step F3F3F3, parsing the validation report, removing all nodes and edges from the original extracted directed acyclic graph whose confidence is lower than the preset fact-checking confidence threshold or which are not supported by original text evidence; Step F3F3F4, outputting the filtered and corrected graph structure as a validated causal directed acyclic graph.

[0019] Further, the implementation method of step F5F1 includes: step F5F1F1, converting the node and edge topology of the normalized causal directed acyclic graph into a graph query language pattern; step F5F1F2, executing the graph query language pattern in the initial state of the global temporal and causal knowledge graph to find all matching items that satisfy the subgraph isomorphism condition; step F5F1F3, organizing all found matching items and their matching scores into a list of structural matching results arranged in descending order of matching scores.

[0020] The implementation method of step F5F2 includes: step F5F2F1, for each asset node involved in the normalized causal directed acyclic graph, obtaining the pre-calculated embedding vector of the asset node from the initial state of the global temporal and causal knowledge graph; step F5F2F2, aggregating the embedding vectors obtained in step F5F2F1 into a single vector representing the semantic center of the normalized causal directed acyclic graph; step F5F2F3, using the single vector, performing a k-nearest neighbor search on the vector index of the initial state of the global temporal and causal knowledge graph; step F5F2F4, converting the search results... The most similar historical events and their similarity scores are organized into a list of semantic matching results sorted in descending order of scores;

[0021] The implementation method of step F5F3 includes: Step F5F3F1, for each unique historical event appearing in the structure matching result list or semantic matching result list, initializing the inverse sorting fusion score of the historical event to 0; Step F5F3F2, traversing the structure matching result list, for each historical event, calculating the structured inverse sorting fusion component of the historical event according to its ranking in the structure matching result list and accumulating it to its total score; Step F5F3F3, traversing the semantic matching result list, for each historical event, calculating the semantic inverse sorting fusion component of the historical event according to its ranking in the semantic matching result list and accumulating it to its total score; Step F5F3F4, sorting all historical events in descending order according to the final accumulated inverse sorting fusion total score of each historical event to obtain a candidate grafting point list.

[0022] Further, the implementation method of step F6F2 includes: step F6F2F1, traversing the normalized causal directed acyclic graph, identifying all event types marked as new entities to be created or not existing in the ontology of the initial state of the global temporal and causal knowledge graph; step F6F2F2, if any new type exists, triggering a pattern evolution proxy process for each new type; step F6F2F3, the pattern evolution proxy process first constructs a prompt, providing the large language model with the context of the new type and the general information model and information technology infrastructure library ontology structure of the current global temporal and causal knowledge graph; step F6F2F4, the large language model generates a suggestion on integrating the new type into the existing ontology based on the context of the new type and the general information model and information technology infrastructure library ontology structure of the current global temporal and causal knowledge graph, obtaining a pattern extension suggestion; step F6F2F5, sending the pattern extension suggestion through the review interface, receiving the finally confirmed pattern definition from the review interface, and formatting the finally confirmed pattern definition into an approved ontology update instruction.

[0023] Furthermore, the implementation method of step F3F3F2 includes: step F3F3F2F1, traversing every node and edge in the original extracted directed acyclic graph; step F3F3F2F2, constructing a verification prompt for each extracted item; step F3F3F2F3, sending the verification prompt and the original text of the associated event package to the large language model; step F3F3F2F4, collecting the return results of the large language model for all extracted items, and summarizing the return results into a structured verification report.

[0024] Further, the implementation method of step F5F1F2 includes: step F5F1F2F1, connecting to the graph database instance represented by the initial state of the global temporal and causal knowledge graph; step F5F1F2F2, initializing the executor of the VF2 algorithm; step F5F1F2F3, using the transformed graph query mode as the query graph and the initial state of the global temporal and causal knowledge graph as the data graph, inputting them into the VF2 executor; step F5F1F2F4, executing the VF2 algorithm to find and collect all isomorphic subgraph instances that meet the conditions into the original structure matching list.

[0025] A knowledge base automatic generation system based on generative AI, implementing the aforementioned generative AI-based knowledge base automatic generation method, includes:

[0026] The acquisition module encapsulates raw event data from different sources into standard envelopes containing the source, raw timestamp, and payload, and publishes them as standardized event messages to the corresponding message broker topics in the configured Kafka topic list.

[0027] The association module, based on a preset event session time window and a preset event session silence period, performs stateful aggregation on the standardized event message stream, reorganizing discrete events around a single fault into associated event packages.

[0028] The verification module extracts causal relationships from the associated event packages through a large language model call chain that includes logical reasoning and fact-checking, and generates a verified causal directed acyclic graph.

[0029] The standardization module performs online entity parsing on each entity string mentioned in the verified causal directed acyclic graph, aligns the entity strings to the namespace of the initial state of the global temporal and causal knowledge graph, and obtains a standardized causal directed acyclic graph.

[0030] The grafting plan module performs a dual query on the normalized causal directed acyclic graph, combining subgraph isomorphic pattern matching and entity embedding vector similarity search, to identify the optimal phylogenetic grafting point of the normalized causal directed acyclic graph in the initial state of the global temporal series and causal knowledge graph, and generates a grafting plan.

[0031] If the normalized causal directed acyclic graph contains new entities or event types that cannot be mapped to the current ontology, the update module, after obtaining approval through the configured intelligent operation and maintenance expert review interface, updates the ontology of the initial state of the global temporal and causal knowledge graph, and performs graph writing operations according to the grafting plan to obtain an updated and consistent global temporal and causal knowledge graph.

[0032] The beneficial effects of the automatic knowledge base generation method and system based on generative AI proposed in this invention are as follows:

[0033] This invention encapsulates raw event data from different sources into standard envelopes containing the source, original timestamp, and payload, and publishes these as standardized event messages to the message broker topic corresponding to the configured Kafka topic. Then, based on a preset event session window and quiescent period, stateful aggregation is performed on the standardized event message stream, reorganizing discrete events surrounding a single fault into related event packages. Subsequently, using a large language model call chain containing logical reasoning and fact-checking, causal relationships are extracted from the related event packages to generate a verified causal directed acyclic graph (DAG). Finally, each entity string mentioned in the verified DAG is processed... Online entity parsing is performed and aligned to the namespace of the initial state of the global temporal and causal knowledge graph, resulting in a normalized causal directed acyclic graph. Then, a dual query is performed on the normalized graph: subgraph isomorphic pattern matching and entity embedding vector similarity search. A candidate grafting point list is generated using a reciprocal sorting fusion algorithm with preset weights and constants. The optimal grafting point is selected, and a grafting plan is generated. Finally, if the normalized graph contains new entities or event types that cannot be mapped to the current ontology, after review by intelligent operation and maintenance experts, the global knowledge graph ontology is updated transactionally, and the graph is written according to the grafting plan, resulting in an updated and consistent global temporal and causal knowledge graph.

[0034] This invention addresses the challenges of isolated traditional operations and maintenance (O&M) data, which struggles to support complex analyses; the inability of static knowledge graphs to capture the dynamic, temporal, and causal aspects of events; and the data quality and integration challenges encountered when integrating heterogeneous data sources, thus hindering the leap towards predictive and autonomous O&M. Its advantages lie in its fully automated transformation from unstructured O&M data to a dynamic, causal-rich knowledge graph, with an auditable process; its adaptive handling of newly emerging entity and event types; and its expert review ensuring the accuracy and authority of the knowledge graph. The generated knowledge graph not only presents the static relationships between system components but also clearly reflects the evolution of events over time and the causal logic between them, providing more comprehensive knowledge support for intelligent O&M. Furthermore, by using entity parsing and dual queries to find the optimal integration point, it effectively solves the integration problem of heterogeneous data sources, improves data integration quality, ensures that new knowledge can be accurately integrated into the existing knowledge system, and maintains the consistency and effectiveness of the knowledge graph. Attached Figure Description

[0035] Figure 1 This is a schematic diagram of the method flow for the automatic knowledge base generation method based on generative AI proposed in this invention;

[0036] Figure 2 This is a schematic diagram of the system modules of the knowledge base automatic generation system based on generative AI proposed in this invention;

[0037] Figure 3This is a schematic diagram illustrating an application scenario of the knowledge base automatic generation method based on generative AI proposed in this invention. Detailed Implementation

[0038] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0039] Example 1

[0040] See Figure 1 This embodiment provides a method and system for automatically generating a knowledge base based on generative AI. The method includes steps F1 to F6.

[0041] This embodiment aims to elaborate on the complete implementation process of transforming raw, heterogeneous event streams into a structured, queryable, logically consistent, and updated global temporal and causal knowledge graph. This process is divided into several key stages, each building upon the output of the previous stage, collectively forming an end-to-end data intelligence pipeline. The process begins with the collection and standardization of event data, reconstructing it into contextualized event sessions using stateful stream processing technology. Subsequently, the process enters the core intelligent processing stage, including: extracting and verifying causal narratives using a large language model; performing entity parsing and normalization using hybrid matching technology; employing a novel hybrid search and result fusion mechanism to perform phylogenetic localization of new events within the global history; and finally, securely writing all new knowledge into the global graph in a transactional manner through an adaptive pattern evolution mechanism combining AI suggestions and human expert review. For the overall application scenario of this process interacting with the external environment, please refer to [link to relevant documentation]. Figure 3 .

[0042] Step F1 involves encapsulating the raw event data collected from different sources into a standard envelope containing the source, raw timestamp, and payload, and publishing it as a standardized event message to the corresponding message broker topic in the configured Kafka topic list.

[0043] The fundamental source of the raw event data collected is various heterogeneous monitoring and management systems deployed in the enterprise IT environment, including log aggregation platforms (such as the ELK Stack), application performance monitoring (APM) tools, and IT service management (ITSM) platforms. These systems continuously generate events through their respective lightweight data producers, such as Filebeat, Prometheus exporters, or custom API clients. The raw information is quantified into a machine-readable format by forcibly encapsulating each event into a data object that must contain two core fields: a UTC timestamp string conforming to ISO 8601 indicating the time the event occurred, and a text payload containing a description of the raw event. This encapsulation process ensures that data from all sources has a consistent time base and processable text content.

[0044] The fundamental source of the configured Kafka topic list is the manual configuration and creation by the system administrator based on the classification and planning of the raw event data sources collected. The quantification method is as follows: each data source type, such as logs, alerts, and tickets, is mapped to a unique string. This corresponding string is then used as the name of a specific topic in the Kafka message broker cluster. Finally, the strings representing each topic name are organized into a list, which serves as the configuration input for this scheme.

[0045] The standardized event message generated in step F1 is a structured JSON object following a predefined Avro schema. The core role of this standardized event message in the logical chain is to unify raw event data collected from different source systems and with varying formats into a common, standardized unit of information. The Avro schema mandates the inclusion of fields such as source system identifiers, ISO 8601 compliant raw timestamps, and text payloads, ensuring data consistency and interoperability. This standardized event message will be published as a producer message to the corresponding topic in Kafka, thus serving as a reliable input data stream for subsequent stateful stream processing steps. To improve transmission efficiency, the message body only contains the schema ID, not the complete schema definition.

[0046] Before conducting in-depth causal analysis on any event, a crucial issue must be addressed: individual log entries or alarm messages are, in most cases, lack context and have limited meaning. A typical IT failure triggers a series of interconnected events across multiple systems within a short period. Treating these events in isolation will lose sight of the common failure scenario they all point to. Therefore, performing a subsequent sessionization step is absolutely necessary. The goal of this sessionization step is to re-aggregate these temporally close and content-related discrete events into an internally coherent event session or related event package centered around a single failure. This provides a context-rich, complete micro-narrative unit of the failure for subsequent large-scale language model analysis, forming the foundation for high-quality causal extraction.

[0047] Step F2, based on the preset event session time window and the preset event session silence period, performs stateful aggregation on the standardized event message stream, and reassembles discrete events around a single fault into related event packages.

[0048] The fundamental source of the preset event session time window is empirical analysis of historical IT failure event data. Its quantification method is a statistical analysis process: First, a large amount of archived failure tickets with clearly defined start and end times and all associated event data are collected; then, the complete duration of each failure from the occurrence of the first related event to the occurrence of the last related event is calculated; finally, through statistical distribution analysis of the complete duration, for example, calculating the 95th or 99th percentile of the complete duration, an integer value, such as 300, is determined that can cover the complete lifecycle of most typical failures, ensuring that the aggregation window is large enough and will not divide a complete failure into multiple incomplete segments due to an excessively small window.

[0049] The fundamental basis for the preset event session silence period is the analysis of the event flow characteristics within a single fault scenario. Its quantification method involves studying the time intervals between various related events during the duration of a known fault. By statistically analyzing the time intervals between these related events, a silence duration that can reliably distinguish between a fault still developing and one that has completely ended is determined. For example, if the analysis shows that 99% of related events have intervals of no more than 60 seconds, the preset event session silence period is set to an integer slightly larger than this value, such as 60 seconds. The purpose of setting the event session silence period is to accurately determine whether a fault scenario has fully unfolded and can be safely closed when the event flow is temporarily interrupted.

[0050] The core objective of step F2 is to reconstruct fragmented event data from different sources into a contextually coherent event session centered around a single failure. An IT failure often generates records simultaneously in logs, alarms, and ticketing systems. These records are highly correlated in time and point to a common IT asset. Processing these events independently would result in the loss of contextual information. Therefore, the event data must be sessionified before being fed into a large language model for in-depth analysis.

[0051] Sessionualization is a typical stateful stream processing task. Unlike stateless processing, which processes only a single event at a time, stateful processing needs to maintain a memory or state of past events. In this scenario, the state is each ongoing faulty session and the set of events it contains.

[0052] To achieve this functionality, choosing Apache Spark's Structured Streams as the standard engineering model is appropriate. Specifically, its transformWithState operator, designed for complex state management, should be employed. This operator provides all the key functionalities required for handling stateful stream computations: 1. It allows maintaining independent, complex state objects for each grouping key (such as incidentID), such as a list containing all event messages. 2. It has built-in support for processing timer, enabling precise implementation of session timeout logic based on preset event session quiet periods. When a session has no new events arriving within a specified time, the timer triggers a callback function to perform session shutdown and output operations. 3. Through integration with checkpointing mechanisms, it ensures that the state of all active sessions can be reliably saved and restored even in the event of a failure, guaranteeing end-to-end consistency of data processing.

[0053] By applying the transformWithState operator, step F2 can efficiently and reliably transform the raw, discrete event stream into a series of context-rich, related event packages, providing high-quality input for subsequent causal narrative extraction.

[0054] The associated event package generated in step F2 is a structured JSON object. The data format of the associated event package includes a globally unique session ID and an array of standardized event message objects aggregated into that session, sorted by timestamp. The core role of the associated event package in the logical chain is to represent a logically coherent and complete single IT failure scenario reconstructed from the original event stream. It organizes scattered information from different time points and sources into a failure profile with a unified context. The purpose of the associated event package is to serve as complete, high-quality input for the causal extraction process driven by the large language model in subsequent step F3, providing the large language model with all the raw text and temporal information needed to understand the full picture of the failure.

[0055] The implementation method of step F2 includes: Step F2F1, using a stream processing engine to consume the standardized event message stream from Kafka, and grouping the message stream according to predefined key identifiers in the messages, such as hostname, service name, and ticket ID. Step F2F2, for each group, applying a stateful processing logic based on a preset event sessionization time window and a preset event sessionization silence period, aggregating standardized event messages that are close in time and related in identifier into a session state. Step F2F3, when a session times out and closes due to reaching the preset event sessionization silence period, all event texts, session IDs, and associated metadata aggregated in that session are encapsulated into an associated event package and sent to the downstream processing queue.

[0056] The implementation method of step F2F1 includes: Step F2F1F1, initializing the consumer connected to the Kafka cluster. Step F2F1F2, subscribing to all topics specified in the configured Kafka topic list. Step F2F1F3, in the stream processing job, parsing the content of each received standardized event message to extract predefined key identifiers. Step F2F1F4, grouping messages with the same key identifier into the same logical group to generate a grouped event message stream.

[0057] The implementation method of step F2F2 includes: Step F2F2F1, applying the transformWithState operator to the grouped event message stream. Step F2F2F2, inside the state handling function of transformWithState, for each arriving message, first obtain or initialize the session state corresponding to the grouping key, obtaining a data structure containing an event list. Step F2F2F3, appending the new message to the event list of the session state. Step F2F2F4, resetting or setting a processing timer, whose trigger time is the current time plus a preset event session silence period. Step F2F2F5, saving and outputting the updated session state.

[0058] Step F3, based on the associated event package, and using the configured large language model endpoints and credentials, the preset causal directed acyclic graph (DAG) is used to extract the schema format of the JSON object and the preset fact-checking confidence threshold. Through the large language model call chain containing thought chain hints, JSON object schema format constraints and reflective fact-checking hints, the verified causal directed acyclic graph depicting the micro-narrative of a single failure is extracted and verified.

[0059] The fundamental source of the default schema format for extracting JSON objects from causal directed acyclic graphs (DAGs) is the design of the target data structure by the solution developers. Its quantification method involves creating a text file that conforms to the schema format of JSON objects. This text file defines the precise structure that a JSON object named "Original Extracted Directed Acyclic Graph" must follow, using the standard JSON object schema format. Specifically, this schema format mandates that each object must contain an array named `nodes`, where each node object must have four fields: `eventID`, `timestamp`, `eventType`, and `message`; and an array named `edges`, where each edge object must have three fields: `source`, `target`, and `type`.

[0060] The fundamental source of the preset fact-checking confidence threshold is an empirical model calibration process. Its quantification method is as follows: First, prepare a validation dataset consisting of associated event packets and their corresponding manually labeled, correctly causal directed acyclic graphs. Then, run the extraction and validation process of step F3 on this validation set, systematically changing the fact-checking confidence threshold, which can range from, for example, 0.5 to 0.95, with a step size of 0.05. For each confidence threshold setting, calculate the precision and recall of the extraction results. Finally, select a floating-point value that achieves the best balance between precision and recall as the preset confidence threshold, for example, 0.75, where the best balance, for example, maximizes the F1-Score. This method ensures that the selection of the confidence threshold is based on data-driven, quantifiable optimization objectives, rather than subjective settings.

[0061] Step F3 is a systematic application of various advanced large language model interaction modes, aiming to maximize the robustness and factual accuracy of information extraction. First, the application of the thought chain prompt strategy significantly improves the performance of the large language model in handling complex tasks requiring multi-step logical reasoning by guiding it to generate intermediate narrative steps. This process forces the large language model to internally construct a coherent event timeline, laying a solid foundation for subsequent structured extraction. Second, the forced structured output by extracting the schema format of JSON objects using a pre-defined causal directed acyclic graph borrows from the functionality provided by modern large language model APIs. This functionality ensures that the output JSON is 100% syntactically consistent with the predefined pattern, fundamentally eliminating the reliance on fragile, regular expression-based output parsing and ensuring machine readability. Finally, the reflective fact-checking stage is a concrete implementation of self-correcting paradigms such as verification chains. By having the large language model generate verification questions about its initial conclusions and forcing it to find evidence in the original text to answer these questions, it effectively binds the large language model's claims to its knowledge sources, greatly suppressing the risk of content-level illusions. The three-stage workflow of generation, formalization, and correction constitutes a robust and complex engineering model that aims to fully utilize the language understanding capabilities of large language models while systematically avoiding their inherent weaknesses in factuality and consistency.

[0062] Step F3 is the first core innovation of the Systematic Event Phylogeny and Grafting Atlas (PEGA) framework proposed in this scheme. Its design goal is to robustly extract structured, timestamped directed acyclic graphs (DAGs) from unstructured event texts. In its implementation, Step F3 intentionally avoids the weakness of large language models directly making causal inferences from raw statistical data. Instead, it strictly limits its task to understanding and structuring the narrative logic and causal statements already embedded in the text. To this end, Step F3 adopts a closed-loop workflow of generation-formalization-correction, transforming the idea of ​​reconstructing causal storylines from the event data itself into a concrete and highly robust technical implementation.

[0063] This closed-loop workflow of generation, formalization, and correction comprises three internal stages. First, in the generation stage, to address the difficulty of directly extracting causal relationships from discrete events, the solution employs a thought chain prompting strategy. This guides the large language model to act as a seasoned Site Reliability Engineer (SRE), synthesizing all discrete information into a coherent, chronologically ordered event narrative, thus establishing a logical foundation for subsequent structured extraction. Next, in the formalization stage, to ensure machine readability and structural consistency of the output, the solution uses a JSON object-based schema format structured output constraint technique. By providing a strictly predefined causal directed acyclic graph in the API call to extract the JSON object's schema format, the large language model's output is forced to conform to the predefined format, thereby significantly improving the reliability of parsing. Finally, in the correction phase, to mitigate the risk of illusion at the content level, the solution introduces a self-correcting loop inspired by the verification chain. This requires the large language model to act as a fact checker, comparing each node and edge in the original extracted directed acyclic graph one by one, and rigorously verifying it with the original text in the associated event package, in order to filter out content that lacks original text support or has a confidence level lower than the preset fact-checking confidence threshold.

[0064] The verified causal directed acyclic graph (DAG) generated in step F3 is a JSON object that strictly adheres to the schema format specification for extracting JSON objects from causal DAGs. The verified DAG's data form is a graph structure consisting of an array of `nodes` containing event nodes and an array of `edges` containing directed edges of type `CAUSES` or `PRECEDES`. The core role of the verified DAG in the logical chain is to represent a structured, machine-readable, and fact-checked micro-narrative of the failure extracted from unstructured event clusters. Each node and edge has been verified against the original text and assigned a confidence level higher than a preset fact-checking confidence threshold. The verified DAG serves as input for entity parsing in the subsequent step F4, providing a structured carrier containing the entity strings to be parsed, such as service names, with rich causal and temporal context.

[0065] The implementation method of step F3 includes: Step F3F1, integrating all text content in the associated event package into a context block, and guiding the large language model to generate a natural language narrative arranged in chronological order through thought chain prompts, thus obtaining the event narrative text. Step F3F2, combining the event narrative text with the original text of the associated event package, and instructing the large language model to formalize the narrative into a structured directed acyclic graph by carrying a prompt carrying a preset causal directed acyclic graph extraction JSON object schema, thus obtaining the original extracted directed acyclic graph. Step F3F3, performing reflective self-correction on the original extracted directed acyclic graph, filtering out illusory content below the preset fact-checking confidence threshold, and generating a verified causal directed acyclic graph.

[0066] The implementation method of step F3F1 includes: Step F3F1F1, extracting the text payload and timestamps of all events from the associated event packets. Step F3F1F2, sorting the extracted text by timestamp and formatting it into coherent text blocks. Step F3F1F3, constructing a prompt containing thought chain instructions, such as: "As a senior site reliability engineer, please carefully read the following chronologically ordered event data and describe in detail the complete occurrence, development, and diagnosis process of this fault in a coherent, third-person narrative style." Step F3F1F4, combining this prompt with the formatted text blocks, initiating a request to the Large Language Model (MLM) through the configured MLM endpoint and credentials, and using the returned text content as the event narrative text.

[0067] Step F3F1 is the first step in the generation-formalization-revision pattern. Its design aims to leverage the powerful natural language generation and synthesis capabilities of large language models to transform discrete and disorganized raw event data, such as logs and alarms, into a logically clear and contextually coherent natural language narrative.

[0068] Employing thought chain cues is crucial. By requiring the large language model to think step-by-step or assume specific expert roles, it can be guided to reason more deeply, rather than simply summarizing surface information. This helps the model internally build causal models about how events evolve over time, laying the foundation for more accurate structured extraction later.

[0069] The implementation method of step F3F2 includes: Step F3F2F1, constructing a prompt, instructing the large language model to extract key event nodes and their causal or temporal relationships based on the provided event narrative text and the original text of the associated event packages. Step F3F2F2, explicitly requiring the output of the large language model to strictly adhere to the attached preset schema format for the extracted causal directed acyclic graph JSON object. Step F3F2F3, sending this prompt, the event narrative text, the original text of the associated event packages, and the preset schema format for the extracted causal directed acyclic graph JSON object together to the configured large language model endpoint and the model specified by the credentials. Step F3F2F4, parsing the schema-compliant JSON object returned by the large language model into the original extracted directed acyclic graph.

[0070] Step F3F2 is the second step in the generative-formalized-corrected pattern. Its goal is to transform the unstructured narrative generated in the first step into fully structured, machine-readable data.

[0071] To ensure the reliability and consistency of the output, steps F3 and F2 enforce the use of structured output functionality supported by the large language model service provider. By providing a preset schema format for extracting JSON objects from a causal directed acyclic graph in the API request and setting `strict` to `true`, it can be ensured that the returned JSON object is 100% structurally valid and contains all necessary fields and the correct data types. This avoids writing fragile post-processing code to parse and validate the large language model output, as is common in traditional methods, and resolves the issue of formatting errors.

[0072] The implementation method of step F3F3 includes: Step F3F3F1, firstly, performing syntax validation on the original extracted directed acyclic graph to ensure that the original extracted directed acyclic graph is a valid JSON object. Step F3F3F2, for each node and edge in the original extracted directed acyclic graph, initiating a reflective validation request to the large language model, requiring the large language model to find original text evidence supporting the node or edge in the associated event package, and providing a confidence score to obtain a validation report. Step F3F3F3, parsing the validation report, removing all nodes and edges from the original extracted directed acyclic graph whose confidence score is lower than the preset fact-checking confidence threshold or which lack original text evidence support. Step F3F3F4, outputting the filtered and corrected graph structure as a validated causal directed acyclic graph.

[0073] Step F3F3, the third step in the Generate-Formulate-Revise schema, is crucial for ensuring the accuracy of extracted facts and addresses the issue of content illusions that can occur even when large language models adhere to the schema. To this end, step F3F3 employs a proactive, self-correcting loop based on the concept of a verification chain. This loop enhances reliability through a more structured process than simple reflection: First, for each claim in the original extracted directed acyclic graph, such as "Event A causes Event B," the system prompts the large language model to generate specific verification questions; next, the large language model must answer these questions by extracting precise citations from the original text of the associated event bundles; finally, based on the availability of evidence, the large language model is required to output a confidence score for each original extraction. This process, placing the large language model in the role of a "fact checker," forces it to bind claims to original textual evidence, effectively suppressing illusions and providing a traceable chain of evidence for each extracted knowledge fragment.

[0074] The implementation method of step F3F3F2 includes: Step F3F3F2F1, traversing every node and edge in the original extracted directed acyclic graph. Step F3F3F2F2, for each extracted item, constructing a verification hint, for example: for the relationship 'event A causes event B', find and cite one or more sentences in the following original text that can directly prove this causal relationship; if no direct evidence is found, please explain; finally, give a confidence score between 0.0 and 1.0. Step F3F3F2F3, sending the verification hint along with the original text of the associated event package to the large language model. Step F3F3F2F4, collecting the return results of the large language model for all extracted items, and summarizing the return results into a structured verification report.

[0075] While the verified causal directed acyclic graph (DAG) produced in step F3 is structurally and causally complete, the entities mentioned within it, such as the server name "s-db-01" and the service name "auth-svc," are still raw, non-normalized text strings. These strings themselves lack global uniqueness and may contain aliases, abbreviations, or spelling errors. Without processing, these entities cannot be associated with the existing, authoritative entity nodes in the initial state of the global temporal and causal knowledge graph, thus forming isolated information islands. Therefore, performing the entity resolution step is crucial. The core intention of this step is to build a bridge from the textual world of the verified causal DAG to the structured knowledge world of the initial state of the global temporal and causal knowledge graph, accurately aligning each entity string extracted from the text to a unique, normalized entity URI in the graph, laying a solid foundation for subsequent graph fusion and knowledge reasoning.

[0076] Step F4 combines deterministic matching and probabilistic matching techniques based on a preset entity Jaccard similarity threshold to perform online entity parsing on each entity string mentioned in the verified causal directed acyclic graph, aligning the entity strings to the namespace of the initial state of the global temporal and causal knowledge graph, thus obtaining a normalized causal directed acyclic graph.

[0077] The initial state of the global temporal and causal knowledge graph originates from the logical state persistently stored in the graph database after a successful execution of the previous process. This is quantified by accessing the entire knowledge graph as a workable graph object through standardized graph database connections, such as using the Bolt protocol to connect to Neo4j. Upon initial system startup, the initial state of the global temporal and causal knowledge graph is an empty graph containing only predefined ontologies based on CIM and ITIL standards. In subsequent incremental runs, it represents a snapshot of the graph containing all historical event information, following the most recent successful update.

[0078] The fundamental source of the preset entity Jaccard similarity threshold is a systematic analysis and experimentation with entity name variations in historical data. The quantification method is as follows: First, different name strings known to point to the same normalized entity are collected from historical operational data to form positive sample pairs, such as ("auth-service", "authentication-svc"), and name strings explicitly pointing to different entities are collected to form negative sample pairs. Next, the tokenized Jaccard similarity score is calculated for all sample pairs. Finally, a threshold optimization process is performed on these scores, for example, by using ROC curve analysis to find the optimal balance point, to determine a floating-point value that maximizes the differentiation between positive and negative sample pairs. For example, choosing a threshold of 0.85 means that only when the Jaccard similarity of two strings is higher than this value are they judged to refer to the same entity. This method ensures that the threshold selection is based on the quantifiable goal of maximizing entity resolution accuracy.

[0079] Step F4 aims to address the entity alignment problem, which involves associating the unstructured entity names extracted from the large language model in the validated causal directed acyclic graph, such as "s-db-01" and "auth-svc", with the existing, standardized entity nodes in the global knowledge graph. This is a crucial step in data integration and knowledge graph construction because the diversity of data sources and the non-standardization of data entry often lead to multiple different representations of the same entity.

[0080] Step F4 employs a hybrid matching strategy. First, for unique identifiers such as IP addresses and fully qualified domain names, deterministic matching, i.e., exact string matching, is used. This method is fast and highly accurate.

[0081] However, deterministic matching often fails for more variable names such as service names and application names. In such cases, probabilistic matching techniques are needed. Among various probabilistic matching algorithms, this scheme chooses token matching based on Jaccard similarity. The logic of this method is implemented through a three-step process: First, the two entity name strings to be compared, such as "auth-service" and "authentication-svc", are tokenized, each decomposed into a set of tokens (e.g., {auth, service} and {authentication, svc}). Next, the Jaccard similarity is calculated based on these two token sets, using the formula...

[0082]

[0083] This quantifies the degree of overlap between two sets, with values ​​ranging from 0 (completely different) to 1 (completely identical); where, The Jaccard similarity score represents the similarity between set A and set B; It represents the size of the intersection of set A and set B, that is, the number of common elements in the two sets; This represents the size of the union of sets A and B, which is the total number of unique elements in both sets. Finally, the calculated similarity score is compared with a preset Jaccard similarity threshold for entities. If the score is higher than the threshold, the two strings are determined to refer to the same entity.

[0084] Jaccard similarity was chosen as the core algorithm because it is both simple and effective in handling text similarity, especially for short texts such as entity names. It is also insensitive to word order and handles abbreviations and aliases well. This combination of deterministic and probabilistic methods allows for robust linking of entities in new events to the existing knowledge system of the knowledge graph, laying the foundation for subsequent graph fusion.

[0085] The core model for probabilistic entity matching in step F4 is Jaccard similarity. Its logic originates from classic methods in statistics and information retrieval used to measure the similarity between finite sample sets. The calculation process for Jaccard similarity is as follows: First, each of the two entity strings to be compared is split into a set of tokens; then, the number of common tokens in the two sets is calculated; next, the total number of unique tokens after merging the two sets is calculated; finally, the number of common tokens is divided by the total number of unique tokens to obtain a similarity score between 0 and 1. Because Jaccard similarity only cares about the existence of elements and not their order or frequency, it is very suitable for comparing tokenized short text strings such as service names, and can effectively handle problems such as abbreviations, aliases, and word order reversals.

[0086] The normalized causal directed acyclic graph (DAG) generated in step F4 maintains the same data format as the verified DAG, remaining a JSON object following the preset DAG extraction schema format. The core difference lies in the semantic level of the content. The core role of the normalized DAG in the logical chain is to represent a fault narrative where all entity references have been parsed from fuzzy text strings and aligned to authoritative, globally unique entity identifier URIs in the initial state of the global temporal and causal knowledge graph. It completes the semantic mapping from plain text representation to the graph namespace. The purpose of the normalized DAG is to serve as the core query object for the subsequent phylogenetic grafting in step F5. Because its nodes are normalized, it can be used to perform precise structured and semantic searches within the global graph.

[0087] The implementation method of step F4 includes: Step F4F1, traversing each entity string in the verified causal directed acyclic graph, first using this string to perform an exact match query in the initial state of the global temporal and causal knowledge graph. Step F4F2, if an exact match is successful, replacing the entity string with the globally unique identifier URI of the matched graph database node. Step F4F3, if an exact match fails, performing a probabilistic matching calculation based on a preset entity Jaccard similarity threshold for the entity string and the names of all similar asset nodes in the initial state of the global temporal and causal knowledge graph. Step F4F4, if the probabilistic matching finds a unique best match with a score higher than the threshold, replacing the entity string with the URI of the matching node; otherwise, marking the entity as a new entity to be created. Step F4F5, after processing all entities, outputting a normalized causal directed acyclic graph in which all entities are aligned to the global knowledge graph namespace.

[0088] After successfully aligning entities in the normalized causal directed acyclic graph (DAG) to the global knowledge graph, the next key task is to integrate this new knowledge fragment into the existing knowledge system. A simple approach is to directly add new nodes and edges to the graph, but this would degenerate the knowledge graph into a log database that merely records isolated events, failing to reveal the deep connections between events. To build a truly intelligent AIOps system, it is essential to understand whether the relationship between new and historical failures is a simple reproduction of a known problem or a new variant with similar root causes but different manifestations. Therefore, performing subsequent grafting steps is a necessary requirement for realizing the core value of the solution. The logical intent of this step is to use an advanced hybrid search mechanism to find the optimal phylogenetic grafting point for the new normalized causal DAG in a vast historical event database, thereby not only recording new events but also proactively constructing an evolutionary genealogy between events.

[0089] Step F5 involves performing a dual query on the normalized causal directed acyclic graph, combining subgraph isomorphic pattern matching and entity embedding vector similarity search. Using a pre-defined grafting scoring model weight and a pre-defined inverse sorting fusion weighted scoring function, the optimal phylogenetic grafting point of the normalized causal directed acyclic graph in the initial state of the global temporal series and causal knowledge graph is identified, and a grafting plan is generated.

[0090] The pre-defined weights of the grafted scoring model are fundamentally derived from empirical optimization based on historical fault datasets or prior knowledge from domain experts. The quantification method is typically a controlled optimization process, such as grid search. The specific process involves: preparing a test set containing historical faults and their known correlations, such as which faults are reproducible; and then systematically iterating through a structured search for the weights. Possible values ​​for the semantic search weight, for example, from 0.0 to 1.0, with a step size of 0.1; and set the semantic search weight. for For each weight configuration, the grafting algorithm is run and its ability to rank known associated faults at the top of the list is evaluated, for example, using Mean Reciprocal Rank as the evaluation metric. Finally, the weight pair that maximizes the evaluation metric, such as [0.6, 0.4], is selected as the preset grafting scoring model weights. This ensures that the weight selection is based on a data-driven approach that maximizes the predictive accuracy of historical cases.

[0091] The pre-defined reciprocal ranking fusion constant is fundamentally derived from publicly available research and industry best practices in the field of information retrieval. Its quantification method is not optimized for a specific dataset, but rather based on theoretical and experimental observations of the characteristics of the Reciprocal Rank Fusion (RRF) algorithm itself. Research shows that in the RRF formula... In the middle, a smaller one A value of around 60 is generally recommended to effectively balance the contributions of top-ranked and bottom-ranked results, while giving sufficient attention to top-level results and demonstrating good robustness to the fusion of different score distributions. Therefore, the preset inverse ranking fusion constant is set to a fixed positive integer constant, such as 60, to follow this widely accepted practice standard.

[0092] Step F5 is designed based on a core judgment: a single similarity metric is insufficient to fully capture the correlations between complex IT failures. Therefore, the solution employs a dual search strategy combining structure and semantics, a mature hybrid search paradigm. First, structured pattern matching focuses on the behavioral topology of the failure, i.e., the shape of the causal propagation chain. Its implementation relies on subgraph isomorphic search, a classic graph theory problem. The VF2 algorithm is chosen as its standard engineering implementation because VF2, when handling large-scale graphs, demonstrates good average performance and crucially linear space complexity through a series of ingenious feasibility rules for pruning, making it efficient and feasible in practice. Second, semantic context matching focuses on the intrinsic meaning of the asset entities involved in the failure. By encoding entities and their contexts as vectors and performing k-nearest neighbor search, events affecting similar types of assets can be discovered, even if their failure propagation paths are completely different. These two search perspectives are complementary. However, their raw scores, such as match counts and cosine similarity, are completely incompatible in scale and distribution, and cannot be directly added. To address this typical problem of heterogeneous result fusion, this solution employs a reciprocal sorting fusion algorithm. The theoretical advantage of RRF lies in its insensitivity to the original scores: it calculates the final score based solely on the rank of an entry in each of the sorted result lists. This method is highly robust to merging sorted lists from different systems, with unknown score distributions, or containing outliers, and is a recognized, simple, and powerful fusion technique in the field of information retrieval.

[0093] Step F5 is the second core innovation of the Systematic Event Phylogeny and Grafting Atlas (PEGA) framework proposed in this scheme. It aims to intelligently integrate individual event DAGs into a global temporal and causal knowledge graph, rather than simply adding nodes and edges. Its core idea draws on phylogenetics in biology, namely, finding the evolutionary position of each new event in the global graph to construct a family tree of faults. This localization process is achieved through a novel hybrid search and result fusion mechanism. The mechanism first executes two complementary searches in parallel to comprehensively evaluate the similarity between new and historical events: the first is structured pattern matching, which focuses on the behavioral patterns or propagation signatures of faults. It searches for structurally perfectly matching historical faults by performing a subgraph isomorphism search (implemented using the VF2 algorithm) between the topology of the directed acyclic graph of new events and the global temporal and causal knowledge graph. The second is semantic context matching, which focuses on the asset entities involved in the faults. It finds events that have historically affected semantically similar assets by encoding entities in new events into high-dimensional vectors and performing a k-nearest neighbor similarity search in the vector indexes of the global temporal and causal knowledge graph.

[0094] Because the result lists and relevance scores generated by these two search methods—for example, the number of subgraph matches and the cosine similarity of vectors—are completely different in scale and distribution, they cannot be directly and meaningfully fused. To address this typical hybrid search fusion problem, the mechanism then employs Regression-Ranking (RRF). RRF does not rely on the original score values ​​but calculates the final score based solely on the rank of an entry in each of the sorted result lists. Therefore, it is highly robust to fusion of sorted lists from different sources with unknown score distributions.

[0095] Through this mechanism of dual "structure + semantic" search and intelligent fusion with RRF, this step can go beyond simple event recording, proactively and intelligently constructing evolutionary relationships between events, thereby forming a "fault family genealogy" with a nested hierarchical structure in the knowledge graph. This provides a powerful topological foundation for accurate root cause analysis and predictive maintenance. As shown in Table 1, the differences between the PEGA proposed in this scheme and traditional knowledge graph technologies in terms of core characteristics are clearly summarized.

[0096] Table 1. Differences between Systemic Event Ancestry Mapping and Traditional Knowledge Graph Technology

[0097]

[0098] The grafting plan generated in step F5 is a structured JSON object. The grafting plan's data format contains two main parts: the first part is the complete content of the normalized causal directed acyclic graph to be written into the graph; the second part defines the goal of the grafting operation, including the URIs of the historical event nodes selected as the best match in the initial state of the global temporal and causal knowledge graph, and the type of high-order relation to be created, such as recurrence relations or shared root cause relations. The core role of the grafting plan in the logical chain is as a complete, deterministic, and declarative set of graph update instructions. It precisely describes the new content that needs to be added to the global knowledge graph and how to connect this new content with the existing best-matching historical events. The transitional purpose of the grafting plan is to serve as the sole input for the transactional graph write operation in the final step F6, guiding this step to complete the atomic update of the initial state of the global temporal and causal knowledge graph.

[0099] The implementation method of step F5 includes: Step F5F1, performing a subgraph isomorphism search on the topological structure of the normalized causal directed acyclic graph, searching for all structurally matching historical event subgraphs in the initial state of the global temporal and causal knowledge graph, and generating a list of structural matching results. Step F5F2, extracting pre-computed embedding vectors of all asset nodes in the normalized causal directed acyclic graph, and performing a k-nearest neighbor vector similarity search based on the pre-computed embedding vectors in the initial state of the global temporal and causal knowledge graph to find events that have historically affected similar assets, and generating a list of semantic matching results. Step F5F3, using preset grafting scoring model weights and preset inverse sorting fusion constants, applying RRF to fuse the list of structural matching results and the list of semantic matching results to generate a list of candidate grafting points sorted by comprehensive score. Step F5F4, selecting the event with the highest score from the list of candidate grafting points as the best grafting point, and generating a directed acyclic graph containing the new event, meta-relations to be created belonging to recurrence relations or shared root cause relations, and a grafting plan defined by the target grafting point.

[0100] The implementation method of step F5F1 includes: Step F5F1F1, converting the node and edge topology of the normalized causal directed acyclic graph into a graph query language pattern. Step F5F1F2, on the initial state of the global temporal and causal knowledge graph, executing the graph query language pattern to find all matching items that satisfy the subgraph isomorphism condition. Step F5F1F3, organizing all found matching items and their matching scores, where the matching item is the root node of the historical event subgraph, and the matching score can be, for example, the number of matches or confidence level, into a structural matching result list sorted in descending order of matching score.

[0101] Step F5F1 aims to identify similar events by comparing the propagation patterns of failures. Its core is solving the subgraph isomorphism problem, which involves finding all subgraph instances in the large data graph (i.e., the global temporal and causal knowledge graph) that structurally perfectly match a small query graph, where the small query graph refers to a directed acyclic graph of new events. This is an NP-complete problem, but several heuristic algorithms exist that can efficiently solve it in practical applications.

[0102] This solution employs the efficient VF2 algorithm as the standard engineering model for solving this problem. VF2 is a depth-first search-based backtracking algorithm that significantly improves matching efficiency by pruning the search space on a large scale through a series of sophisticated feasibility rules. These rules include checking node degree and neighborhood connectivity. The node degree check requires that the degree of a candidate node must be greater than or equal to the degree of the corresponding node in the query graph. The neighborhood connectivity check checks whether the connectivity between the neighbors of the matched node and the neighbors of the node to be matched is consistent. Due to its good average performance and linear space complexity, the VF2 algorithm is widely used in various graph databases and pattern recognition tasks, making it a mature and reliable choice for implementing this step.

[0103] The implementation method of step F5F1F2 includes: Step F5F1F2F1, connecting to the graph database instance represented by the initial state of the global temporal and causal knowledge graph. Step F5F1F2F2, initializing the executor of the VF2 algorithm. Step F5F1F2F3, using the transformed graph query pattern as the query graph and the initial state of the global temporal and causal knowledge graph as the data graph, inputting them into the VF2 executor. Step F5F1F2F4, executing the VF2 algorithm to find and collect all isomorphic subgraph instances that meet the conditions in the original structure matching list. The condition is that they completely match the transformed graph query pattern as the query graph in terms of topological structure, that is, the node type, edge type, and connection relationship between nodes in the isomorphic subgraph instance are consistent with the transformed graph query pattern.

[0104] The implementation method of step F5F2 includes: Step F5F2F1, for each asset node involved in the normalized causal directed acyclic graph, obtaining the pre-computed embedding vector of the asset node from the initial state of the global temporal and causal knowledge graph. Step F5F2F2, aggregating the embedding vectors obtained in step F5F2F1 into a single vector representing the semantic center of the normalized causal directed acyclic graph, for example, through average pooling. Step F5F2F3, using the single vector, performing a k-nearest neighbor search on the vector index of the initial state of the global temporal and causal knowledge graph. Step F5F2F4, converting the search results... The most similar historical events and their similarity scores are organized into a list of semantic matching results, sorted in descending order of scores.

[0105] Step F5F2 aims to identify similar events by comparing the “asset entities” affected by the failures. Unlike strict structural matching, this approach focuses on semantic-level similarity. For example, two failures may affect different servers, but if these servers host the same database service, then they are semantically related.

[0106] The standard approach to achieving this semantic search is vector embedding. Using graph neural networks (GNNs) or other techniques, each asset node in the graph can be represented as a high-dimensional vector that captures the node's attributes and its topological context within the graph.

[0107] Once all nodes are vectorized, similarity search transforms into an efficient k-nearest neighbor query problem. By using specialized vector indexes (such as HNSW), sub-millisecond similarity searches can be achieved in a vector space of billions, enabling the rapid identification of historical assets most similar to those involved in a new event, and subsequently, the location of related historical events.

[0108] The implementation method of step F5F3 includes: Step F5F3F1, for each unique historical event appearing in the structure matching result list or semantic matching result list, initializing the inverse ranking fusion score of the historical event to 0. Step F5F3F2, traversing the structure matching result list, for each historical event, calculating its structured inverse ranking fusion component based on its ranking in the list and adding it to its total score. Step F5F3F3, traversing the semantic matching result list, for each historical event, calculating its semantic inverse ranking fusion component based on its ranking in the list and adding it to its total score. Step F5F3F4, sorting all historical events in descending order according to the final accumulated inverse ranking fusion total score of each historical event to obtain the candidate grafting point list.

[0109] The core of step F5F3 is the application of the Reverse Rank fusion algorithm. When calculating the final score for each historical event, its ranking in both the structured search and semantic search result lists is considered. RRF is chosen because it does not rely on the absolute value of the original score, using only ranking information, which allows it to robustly fuse results from heterogeneous search systems such as subgraph matching and vector search.

[0110] The core model used in step F5 to fuse the scores of two irrelevant searches is a weighted improvement on the idea of ​​inverse ranking fusion. Standard RRF solves the problem of fusing heterogeneous and non-normalizable score sources by defining the final score of each entry as the sum of its inverse ranking across all subquery result lists. This solution introduces pre-defined grafting score model weights to reflect the different importance of structured search and semantic search in specific scenarios. The weighted fusion score calculation formula is as follows:

[0111] ;

[0112] In the formula, Representing historical events The final fusion score; and These are the weight coefficients from the structured and semantic searches of the pre-defined grafting scoring model weights, respectively; It is a preset inverse sorting fusion constant, a constant used to smooth the score; and These are historical events The ranking (starting from 1) in both the structured search results list and the semantic search results list. This formula is used to robustly merge the ranking results from two different search methods into a unified, comprehensive ranking list to identify the most relevant historical events. The calculation process of this formula is as follows: for each candidate historical event... First, obtain its ranking in the structure matching results list. And calculate its structured components. Next, obtain its ranking in the semantic matching results list. And calculate its semantic components. If an event is not in a list, its rank in that list is considered infinity, and its corresponding component contribution is 0. Finally, these two components are added together to obtain the final fusion score for the historical event. .

[0113] Step F6: Examine the normalized causal directed acyclic graph. If a new entity or event type that cannot be mapped to the current ontology is found, the configured large language model endpoint and credentials are used to trigger a "pattern evolution agent" driven by the large language model and based on the Common Information Model (CIM) of the Distributed Management Task Group and the Information Technology Infrastructure Library framework. After obtaining approval through the configured intelligent operation and maintenance expert review interface, the ontology of the initial state of the global temporal and causal knowledge graph is updated transactionally, and the graph writing operation is performed according to the grafting plan to obtain an updated and consistent global temporal and causal knowledge graph.

[0114] The fundamental source of the configured intelligent operations and maintenance expert review interface lies in the design of the system integration architecture, aiming to establish a formal, machine-operable interaction contract for critical process steps requiring human expert judgment. Its quantification method is to define a clear, stable interface that can be invoked by external systems. This interface can have various implementation forms, such as: a dedicated API endpoint URL adhering to RESTful principles; a specific project queue identifier pre-configured in an IT service management system (such as Jira or ServiceNow); or a webhook URL for a human-monitored instant messaging channel (such as Slack). Regardless of the form, the definition of this interface is a deterministic, program-accessible string that constitutes the formal communication protocol for the human-machine collaboration loop.

[0115] Step F6 is designed to address a core challenge that is unavoidable when building and maintaining knowledge graphs in dynamic IT environments: schema evolution. A fixed, unchanging ontology can quickly become out of touch with reality and fail to accurately model newly emerging IT assets or event types. To address this challenge, this solution employs a hybrid intelligent strategy, seeking a balance between a rigid, predefined ontology and a disordered, fully dynamic ontology. Its rationale is reflected in three levels: First, the ontology is based on industry-recognized IT management standards, specifically using the Common Information Model (CIM) of the Distributed Management Task Force (DMTF) to model IT assets and the IT service management process framework of the Information Technology Infrastructure Library (ITIL) to model IT services. This ensures that the core semantics of the knowledge graph are stable, interoperable, and widely understood. Second, when encountering new concepts, the system utilizes a schema evolution agent to assist in the evolution. This agent leverages the powerful contextual understanding and schema induction capabilities of the Large Language Model (LLM), intelligently proposing definitions for new schemas based on the usage of new terms in events and the existing CIM and ITIL ontology structures. This significantly enhances the adaptability and agility of the ontology. Finally, and most importantly, all pattern suggestions proposed by the large language model are not automatically adopted; instead, they must be submitted to human experts for review and approval through a configured intelligent operations and maintenance expert review interface. This human-centered design is a necessary guarantee for ensuring the authority and accuracy of the knowledge graph. It combines the efficiency of AI with the rigorous judgment of humans, effectively preventing semantic pollution caused by model illusions.

[0116] Step F6 is the third core innovation of the PEGA framework, addressing a key challenge in building knowledge graphs in dynamic environments: schema evolution. IT environments are constantly changing, with new applications, devices, and event types emerging continuously. A fixed, predefined knowledge graph ontology quickly becomes rigid and outdated, failing to accurately reflect reality.

[0117] This solution employs a hybrid intelligence strategy, achieving a balance between rigid, predefined ontologies and disordered, fully dynamic ontologies. The core of this strategy is to first establish industry standards as a foundation, then combine AI assistance with human review for dynamic evolution.

[0118] First, at the foundational level of ontology construction, the temporal and causal knowledge graph TC-KG is not built from scratch, but rather based on industry-recognized IT management standards. This ensures that the graph's fundamental semantics are stable, clear, and interoperable. Specifically: In IT asset modeling, the solution adopts the Common Information Model (CIM) of the DMTF Distributed Management Task Group. It provides a standard, object-oriented set of class, attribute, and relationship definitions for various managed elements in the IT environment, such as computer systems, applications, and network devices. For example, a server node will be assigned the label CIM_ComputerSystem and possess standard attributes such as hostName and ipAddress. In IT process modeling, the solution uses the ITIL (Information Technology Infrastructure Library) framework to define event management-related concepts. For example, an event ticket will be represented in the graph as an ITIL_Incident node, containing standard attributes such as incidentID, priority, and status.

[0119] Building upon this standardization, the strategy achieves its adaptability through two subsequent layers. First, it utilizes a large language model for evolution: when an upstream process identifies a new entity or event type that cannot be mapped to an existing CIM / ITIL ontology—for example, a new application developed by an enterprise called "QuantumLeap-Processor"—the system triggers a dedicated schema evolution agent. This agent intelligently proposes new schema definitions using the large language model, combined with the context of the new terminology and the existing general information model and IT infrastructure library ontology structure. Second, it employs a human verification loop: to ensure the accuracy and authority of the knowledge, schema suggestions proposed by the large language model are not automatically adopted. Instead, they are submitted to human experts for review and verification through a configured intelligent operations and maintenance expert review interface, effectively preventing semantic confusion introduced by the illusion of the large language model.

[0120] Through this hybrid strategy of standard-based, AI-assisted, and human-verified approaches, the TC-KG constructed in this solution maintains its structure and standardization while possessing high adaptability and vitality, enabling it to continuously and accurately reflect the unique evolution of the enterprise IT environment. Table 2 fully defines the core node and relationship types and their key attributes used in this solution. Finally, all write operations to the graph, including ontology updates and data writes, are executed within database transactions. This ensures the atomicity of operations (ACID properties) and guarantees that the global temporal and causal knowledge graph remains consistent and complete at all times.

[0121] Table 2 Core Nodes, Relationship Types, and Their Key Attributes

[0122]

[0123] The implementation method for step F6 includes: Step F6F1, initiating a graph database transaction to ensure the atomicity of all subsequent operations. Step F6F2, checking whether there are any new entities marked as to be created or unknown event types in the normalized causal directed acyclic graph. If so, triggering the schema evolution process driven by the large language model to obtain the approved ontology update instruction. Step F6F3, within the database transaction, first executing the approved ontology update instruction to add new node labels or attribute definitions to the graph database schema. Step F6F4, according to the instructions defined in the grafting plan, creating nodes and edges representing new events within the database transaction, and establishing higher-order recurrence relations or shared root cause relations. Step F6F5, committing the database transaction; if any step fails, a complete rollback is performed, resulting in an updated and consistent global temporal and causal knowledge graph.

[0124] The implementation method of step F6F2 includes: Step F6F2F1, traversing the normalized causal directed acyclic graph to identify all new entities marked as to be created or event types that do not exist in the initial state of the global temporal and causal knowledge graph ontology. Step F6F2F2, if any new type exists, triggering the pattern evolution proxy process for each new type. Step F6F2F3, the pattern evolution proxy process first constructs a prompt, providing the large language model with the context of the new type and the general information model and information technology infrastructure library ontology structure of the current temporal and causal knowledge graph. Step F6F2F4, based on the context of the new type and the general information model and information technology infrastructure library ontology structure of the current temporal and causal knowledge graph, the large language model generates suggestions on how to integrate the new type into the existing ontology, such as suggesting the name, parent class, and attributes of the new class, thus obtaining pattern extension suggestions. Step F6F2F5, sending the pattern extension suggestions to the operation and maintenance experts for review through the configured intelligent operation and maintenance expert review interface. Step F6F2F6: Wait for and receive the approval signal and final confirmed pattern definition from the expert, and format the final confirmed pattern definition into an approved ontology update instruction.

[0125] Steps F6 and F2 implement the adaptive ontology and pattern evolution mechanism of the PEGA framework. It achieves a balance between flexibility and rigor through a combination of large language model suggestions and human review. The large language model leverages its powerful language understanding and pattern induction capabilities to rapidly generate high-quality extension suggestions based on the context of new terms and existing ontology knowledge, significantly reducing the burden on ontology maintainers of defining new patterns from scratch. The final human review process ensures the semantic consistency and accuracy of the knowledge graph, preventing errors or confusion that might be introduced by the automated process, thus forming a complete human-centered intelligent system.

[0126] This embodiment details the implementation process, fully depicting an evolutionary path from raw, unordered data to structured, intelligent knowledge. At the data flow level, the process begins by unifying heterogeneous collected raw event data into standardized event messages, which are then aggregated into context-rich event packages through stateful stream processing. Subsequently, after deep processing by a large language model, the unstructured event packages are transformed into structured, verified causal directed acyclic graphs (DAGs), and further upgraded into normalized causal DAGs associated with global knowledge through entity parsing. Finally, based on this normalized data generation grafting plan, the initial state of the global temporal and causal knowledge graph is atomically updated, producing the final updated and consistent global temporal and causal knowledge graph.

[0127] From a technological perspective, this process, through a series of interconnected innovative steps, successfully transforms a static knowledge base into a dynamic historical record that can self-evolve and dynamically reflect system behavior. From the extraction of validated causal narratives driven by a large language model, to the grafting of phylogenetic data based on hybrid search, and then to the adaptive pattern evolution of AI suggestions combined with human review, each step aims to inject deeper semantic, temporal, and causal relationships into the final knowledge graph, providing a solid, reliable, and auditable data foundation for achieving advanced AIOps applications such as accurate root cause analysis and predictive maintenance.

[0128] Example 2

[0129] See Figure 2 As shown, this embodiment provides an automatic knowledge base generation system based on generative AI, used to implement the aforementioned automatic knowledge base generation method based on generative AI. The system includes:

[0130] The acquisition module encapsulates raw event data collected from different sources into a standard envelope containing the source, raw timestamp, and payload, and publishes it as a standardized event message to the corresponding message broker topic in the configured Kafka topic list;

[0131] The association module, based on a preset event session time window and a preset event session silence period, performs stateful aggregation on the standardized event message stream, reorganizing discrete events around a single fault into associated event packages.

[0132] The verification module extracts causal relationships from the associated event packages through a large language model call chain that includes logical reasoning and fact-checking, in order to generate a verified causal directed acyclic graph.

[0133] The standardization module performs online entity parsing on each entity string mentioned in the verified causal directed acyclic graph, aligns the entity strings to the namespace of the initial state of the global temporal and causal knowledge graph, and obtains a standardized causal directed acyclic graph.

[0134] The grafting plan module performs a dual query on the normalized causal directed acyclic graph, combining subgraph isomorphic pattern matching and entity embedding vector similarity search, to identify the optimal phylogenetic grafting point of the normalized causal directed acyclic graph in the initial state of the global temporal series and causal knowledge graph, and generates a grafting plan.

[0135] If the normalized causal directed acyclic graph contains new entities or event types that cannot be mapped to the current ontology, the update module, after obtaining approval through the configured intelligent operation and maintenance expert review interface, updates the ontology of the initial state of the global temporal and causal knowledge graph, and performs graph writing operations according to the grafting plan to obtain an updated and consistent global temporal and causal knowledge graph.

[0136] For any parts not mentioned in this application, existing technologies may be used or referenced.

[0137] The various embodiments in this specification are described in a progressive manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments.

[0138] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A method for automatically generating a knowledge base based on generative AI, characterized in that, include: Step F1: Encapsulate the raw event data from different sources into a standard envelope containing the source, raw timestamp, and payload, and publish it as a standardized event message to the corresponding message broker topic in the configured Kafka topic list; Step F2: Based on the preset event conversational time window and the preset event conversational silence period, perform stateful aggregation on the standardized event message stream, and reorganize discrete events around a single fault into related event packets. Step F3: Extract causal relationships from the associated event packages through a large language model call chain that includes logical reasoning and fact-checking, and generate a verified causal directed acyclic graph. The implementation method of step F3 includes: Step F3F1, integrating all text content in the associated event package into a context block, and guiding the large language model to generate a natural language narrative arranged in chronological order through mind chain prompts to obtain the event narrative text; Step F3F2, combining the event narrative text with the original text of the associated event package, and instructing the large language model to formalize the narrative into a structured directed acyclic graph by carrying a prompt carrying the schema format of the JSON object extracted from the causal directed acyclic graph, to obtain the original extracted directed acyclic graph; Step F3F3, performing reflective self-correction on the original extracted directed acyclic graph, filtering out illusory content below the preset fact-checking confidence threshold, and generating a verified causal directed acyclic graph; Step F4: Perform online entity parsing on each entity string mentioned in the verified causal directed acyclic graph, align the entity strings to the namespace of the initial state of the global temporal and causal knowledge graph, and obtain a normalized causal directed acyclic graph. Step F5 involves performing a dual query on the normalized causal directed acyclic graph, combining subgraph isomorphic pattern matching and entity embedding vector similarity search, to identify the optimal phylogenetic grafting point of the normalized causal directed acyclic graph in the initial state of the global temporal series and causal knowledge graph, and generating a grafting plan. Step F6: If the normalized causal directed acyclic graph contains new entities or event types that cannot be mapped to the current ontology, then after obtaining approval through the configured intelligent operation and maintenance expert review interface, the ontology of the initial state of the global temporal and causal knowledge graph is updated, and the graph writing operation is performed according to the grafting plan to obtain an updated and consistent global temporal and causal knowledge graph.

2. The method for automatically generating a knowledge base based on generative AI according to claim 1, characterized in that, The implementation method of step F5 includes: Step F5F1, performing a subgraph isomorphism search on the topological structure of the normalized causal directed acyclic graph, searching for all structurally matching historical event subgraphs in the initial state of the global temporal and causal knowledge graph, and generating a list of structural matching results; Step F5F2, extracting the pre-computed embedding vectors of all asset nodes in the normalized causal directed acyclic graph, and performing a k-nearest neighbor vector similarity search based on the pre-computed embedding vectors in the initial state of the global temporal and causal knowledge graph, and generating a list of semantic matching results; Step F5F3, using a preset grafting scoring model weight and a preset inverse sorting fusion constant, applying the inverse sorting fusion algorithm to fuse the list of structural matching results and the list of semantic matching results, generating a list of candidate grafting points sorted by comprehensive score; Step F5F4, selecting the event with the highest score from the list of candidate grafting points as the best grafting point, and generating a directed acyclic graph containing the new event, meta-relations to be created belonging to recurrence relations or shared root cause relations, and a grafting plan defined by the target grafting point.

3. The method for automatically generating a knowledge base based on generative AI according to claim 1, characterized in that, The implementation method of step F6 includes: Step F6F1, starting the graph database transaction; Step F6F2, checking whether there are any new entities marked as to be created or unknown event types in the normalized causal directed acyclic graph. If so, triggering the schema evolution process driven by the large language model to obtain the approved ontology update instruction; Step F6F3, in the database transaction, first executing the approved ontology update instruction to add new node labels or attribute definitions to the schema of the graph database; Step F6F4, according to the instructions defined in the grafting plan, creating nodes and edges representing new events in the database transaction, and establishing higher-order recurrence relations or shared root cause relations; Step F6F5, committing the database transaction. If any step fails, a complete rollback is performed to obtain an updated and consistent global temporal and causal knowledge graph.

4. The method for automatically generating a knowledge base based on generative AI according to claim 1, characterized in that, The implementation method of step F3F1 includes: step F3F1F1, extracting the text payload and timestamp of all events from the associated event package; step F3F1F2, sorting the extracted text by timestamp and formatting it into coherent text blocks; step F3F1F3, constructing a prompt containing thought chain instructions; step F3F1F4, combining the prompt with the formatted text blocks, sending a request to the large language model through the configured large language model endpoint and credentials, and using the returned text content as the event narrative text. The implementation method of step F3F2 includes: step F3F2F1, constructing a prompt, instructing the large language model to extract key event nodes and their causal or temporal relationships based on the provided event narrative text and the original text of the associated event package; step F3F2F2, requiring the output of the large language model to conform to the preset schema format of the causal directed acyclic graph extraction JSON object; step F3F2F3, sending the prompt, event narrative text, original text of the associated event package, and the preset schema format of the causal directed acyclic graph extraction JSON object to the configured large language model endpoint and the model specified by the credential; step F3F2F4, parsing the JSON object returned by the large language model that conforms to the schema format into the original extracted directed acyclic graph; The implementation method of step F3F3 includes: Step F3F3F1, performing syntax validation on the original extracted directed acyclic graph to ensure that the original extracted directed acyclic graph is a valid JSON object; Step F3F3F2, for each node and edge in the original extracted directed acyclic graph, initiating a reflective validation request to the large language model, requiring the large language model to find original text evidence supporting the node or edge in the associated event package, and providing a confidence score to obtain a validation report; Step F3F3F3, parsing the validation report, removing all nodes and edges from the original extracted directed acyclic graph whose confidence is lower than the preset fact-checking confidence threshold or which are not supported by original text evidence; Step F3F3F4, outputting the filtered and corrected graph structure as a validated causal directed acyclic graph.

5. The method for automatically generating a knowledge base based on generative AI according to claim 2, characterized in that, The implementation method of step F5F1 includes: step F5F1F1, converting the node and edge topology of the normalized causal directed acyclic graph into a graph query language pattern; step F5F1F2, executing the graph query language pattern in the initial state of the global temporal and causal knowledge graph to find all matching items that satisfy the subgraph isomorphism condition; step F5F1F3, organizing all found matching items and their matching scores into a list of structure matching results arranged in descending order of matching scores. The implementation method of step F5F2 includes: step F5F2F1, for each asset node involved in the normalized causal directed acyclic graph, obtaining the pre-calculated embedding vector of the asset node from the initial state of the global temporal and causal knowledge graph; step F5F2F2, aggregating the embedding vectors obtained in step F5F2F1 into a single vector representing the semantic center of the normalized causal directed acyclic graph; step F5F2F3, using the single vector, performing a k-nearest neighbor search on the vector index of the initial state of the global temporal and causal knowledge graph; step F5F2F4, converting the search results... The most similar historical events and their similarity scores are organized into a list of semantic matching results sorted in descending order of scores; The implementation method of step F5F3 includes: Step F5F3F1, for each unique historical event appearing in the structure matching result list or semantic matching result list, initializing the inverse sorting fusion score of the historical event to 0; Step F5F3F2, traversing the structure matching result list, for each historical event, calculating the structured inverse sorting fusion component of the historical event according to its ranking in the structure matching result list and accumulating it to its total score; Step F5F3F3, traversing the semantic matching result list, for each historical event, calculating the semantic inverse sorting fusion component of the historical event according to its ranking in the semantic matching result list and accumulating it to its total score; Step F5F3F4, sorting all historical events in descending order according to the final accumulated inverse sorting fusion total score of each historical event to obtain a candidate grafting point list.

6. The method for automatically generating a knowledge base based on generative AI according to claim 3, characterized in that, The implementation method of step F6F2 includes: Step F6F2F1, traversing the normalized causal directed acyclic graph, identifying all event types marked as new entities to be created or not existing in the ontology of the initial state of the global temporal and causal knowledge graph; Step F6F2F2, if any new type exists, triggering the pattern evolution proxy process for each new type; Step F6F2F3, the pattern evolution proxy process first constructs a prompt, providing the large language model with the context of the new type and the general information model and information technology infrastructure library ontology structure of the current global temporal and causal knowledge graph; Step F6F2F4, the large language model generates a suggestion on integrating the new type into the existing ontology based on the context of the new type and the general information model and information technology infrastructure library ontology structure of the current global temporal and causal knowledge graph, obtaining a pattern extension suggestion; Step F6F2F5, sending the pattern extension suggestion through the review interface, receiving the finally confirmed pattern definition from the review interface, and formatting the finally confirmed pattern definition into an approved ontology update instruction.

7. The method for automatically generating a knowledge base based on generative AI according to claim 4, characterized in that, The implementation method of step F3F3F2 includes: step F3F3F2F1, traversing every node and edge in the original extracted directed acyclic graph; step F3F3F2F2, constructing a verification prompt for each extracted item; step F3F3F2F3, sending the verification prompt and the original text of the associated event package to the large language model; step F3F3F2F4, collecting the return results of the large language model for all extracted items, and summarizing the return results into a structured verification report.

8. The method for automatically generating a knowledge base based on generative AI according to claim 5, characterized in that, The implementation method of step F5F1F2 includes: step F5F1F2F1, connecting to the graph database instance represented by the initial state of the global temporal and causal knowledge graph; step F5F1F2F2, initializing the executor of the VF2 algorithm; step F5F1F2F3, using the transformed graph query mode as the query graph and the initial state of the global temporal and causal knowledge graph as the data graph, and inputting them into the VF2 executor; step F5F1F2F4, executing the VF2 algorithm to find and collect all isomorphic subgraph instances that meet the conditions into the original structure matching list.

9. A knowledge base automatic generation system based on generative AI, characterized in that, The system for implementing the automatic knowledge base generation method based on generative AI as described in any one of claims 1-8 includes: The acquisition module encapsulates raw event data from different sources into standard envelopes containing the source, raw timestamp, and payload, and publishes them as standardized event messages to the corresponding message broker topics in the configured Kafka topic list. The association module, based on a preset event session time window and a preset event session silence period, performs stateful aggregation on the standardized event message stream, reorganizing discrete events around a single fault into associated event packages. The verification module extracts causal relationships from the associated event packages through a large language model call chain that includes logical reasoning and fact-checking, and generates a verified causal directed acyclic graph. The implementation method of the verification module includes: integrating all text content in the associated event package into a context block, guiding the large language model to generate a natural language narrative arranged in chronological order through mind chain prompts, and obtaining the event narrative text; combining the event narrative text with the original text of the associated event package, and instructing the large language model to formalize the narrative into a structured directed acyclic graph by carrying a hint carrying a preset causal directed acyclic graph extraction JSON object schema format, and obtaining the original extracted directed acyclic graph; performing reflective self-correction on the original extracted directed acyclic graph, filtering out illusory content below the preset fact-checking confidence threshold, and generating a verified causal directed acyclic graph; The standardization module performs online entity parsing on each entity string mentioned in the verified causal directed acyclic graph, aligns the entity strings to the namespace of the initial state of the global temporal and causal knowledge graph, and obtains a standardized causal directed acyclic graph. The grafting plan module performs a dual query on the normalized causal directed acyclic graph, combining subgraph isomorphic pattern matching and entity embedding vector similarity search, to identify the optimal phylogenetic grafting point of the normalized causal directed acyclic graph in the initial state of the global temporal series and causal knowledge graph, and generates a grafting plan. If the normalized causal directed acyclic graph contains new entities or event types that cannot be mapped to the current ontology, the update module, after obtaining approval through the configured intelligent operation and maintenance expert review interface, updates the ontology of the initial state of the global temporal and causal knowledge graph, and performs graph writing operations according to the grafting plan to obtain an updated and consistent global temporal and causal knowledge graph.

Images