Model training method and device, equipment, medium and program product
By training the teacher model and distilling it into the student model, a root cause localization model is constructed, which solves the problem of low efficiency in traditional manual analysis, and achieves efficient and accurate root cause localization of operation and maintenance log faults, reducing resource consumption.
Patent Information
- Application Number
- CN202511683971.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-11-17
- Publication Date
- 2026-02-17
AI Technical Summary
Traditional operation and maintenance log root cause localization relies on manual analysis, which is inefficient and makes it difficult to quickly and accurately locate the root cause of business system failures.
By acquiring fault logs and real labels from business systems, a teacher model is trained and distilled onto a student model to construct a root cause localization model. This model utilizes fault entity causal chains and distillation techniques to improve localization efficiency and accuracy.
It improves the efficiency and accuracy of root cause analysis, reduces the resource consumption of model deployment, and enhances the automation level of root cause analysis of operation and maintenance log failures.
Smart Images
Figure CN121542736A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of model training technology, and can be applied to the financial technology field. In particular, it relates to a model training method, device, medium, and program product. Background Technology
[0002] To ensure service reliability, most business systems are equipped with operational capabilities such as log printing and log collection to help operations and maintenance personnel locate and resolve problems in a timely manner, ensuring the smooth operation of business systems.
[0003] Traditional methods for root cause analysis of operational logs rely on experienced technicians to manually analyze logs, which is inefficient. Summary of the Invention
[0004] This invention provides a model training method, apparatus, medium, and program product to improve the efficiency of locating the root cause of faults in operation and maintenance logs.
[0005] In a first aspect, embodiments of the present invention provide a model training method, including:
[0006] Obtain at least one business system fault log and the true label of each business system fault log;
[0007] For each business system fault log, extract the causal chain of the fault entity corresponding to the fault log of that business system.
[0008] Based on the fault logs of each business system, as well as the causal chain and real label of the fault entity corresponding to each business system fault log, the initial teacher model is trained to obtain a trained teacher model.
[0009] The trained teacher model is distilled onto the student model to obtain the trained root cause localization model.
[0010] Secondly, embodiments of the present invention also provide a model training apparatus, comprising:
[0011] Obtain at least one business system fault log and the true label of each business system fault log;
[0012] For each business system fault log, extract the causal chain of the fault entity corresponding to the fault log of that business system.
[0013] Based on the fault logs of each business system, as well as the causal chain and real label of the fault entity corresponding to each business system fault log, the initial teacher model is trained to obtain a trained teacher model.
[0014] The trained teacher model is distilled onto the student model to obtain the trained root cause localization model.
[0015] Thirdly, embodiments of the present invention also provide an electronic device, comprising:
[0016] At least one processor; and
[0017] A memory that is communicatively connected to at least one processor; wherein
[0018] The memory stores instructions that can be executed by at least one processor, which enables the at least one processor to perform the model training method provided in any embodiment of the present invention.
[0019] Fourthly, embodiments of the present invention also provide a computer-readable storage medium storing computer instructions that are used to cause a processor to execute the model training method of any embodiment of the present invention.
[0020] Fifthly, embodiments of the present invention also provide a computer program product, characterized in that the computer program product includes a computer program, which, when executed by a processor, implements the model training method of any embodiment of the present invention.
[0021] The technical solution of this invention trains a model for root cause localization using business system fault logs and real labels. Compared with the prior art of manually analyzing logs, training the root cause localization model improves the efficiency of root cause localization. Distillation quantization perception training compresses the model size, reducing the resource consumption of model deployment. By extracting the causal chain of fault entities to train the teacher model, the accuracy of the root cause localization model obtained by distillation in locating the root cause of the fault is further improved.
[0022] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description
[0023] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0024] Figure 1 This is a flowchart of a model training method provided in Embodiment 1 of the present invention;
[0025] Figure 2 This is a flowchart of a model training method provided in Embodiment 2 of the present invention;
[0026] Figure 3 This is a schematic diagram of the structure of a model training device according to Embodiment 3 of the present invention;
[0027] Figure 4 This is a structural diagram of an electronic device that implements a model training method according to an embodiment of the present invention. Detailed Implementation
[0028] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.
[0029] It should be noted that the terms "first" and "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.
[0030] In the technical solutions of the embodiments of the present invention, the acquisition, storage and application of subject information, key information and configuration information, etc., all comply with the provisions of relevant laws and regulations and do not violate public order and good morals.
[0031] Example 1
[0032] Figure 1 This is a flowchart of a model training method provided in Embodiment 1 of the present invention. This embodiment is applicable to the case of training a root cause localization model. The method can be executed by a model training device, which can be implemented in hardware and / or software and specifically configured in an electronic device.
[0033] See Figure 1 The model training method shown includes:
[0034] S101. Obtain at least one business system fault log and the real label of each business system fault log.
[0035] S102. For each business system fault log, extract the causal chain of the fault entity corresponding to the fault log of that business system.
[0036] S103. Based on the fault logs of each business system, and the fault entity causal chain and real label corresponding to the fault logs of each business system, train the initial teacher model to obtain the trained teacher model.
[0037] S104. Distill the trained teacher model onto the student model to obtain the trained root cause localization model.
[0038] In this embodiment, the business system fault log may include, but is not limited to, at least one of the following: transaction timeout logs, settlement failure logs, and gateway anomaly logs. The true label of the business system fault log may be the root cause of the fault in the manually annotated business system fault log. The fault entity causal chain may include at least two fault entities and the causal relationship between them; for example, the fault entity causal chain may be that fault entity A causes fault entity B. A fault entity may include, but is not limited to, at least one of the following: faulty component entity, fault indicator entity, and time entity. For example, a faulty component entity may be a payment interface, gateway, and central processing unit; a fault indicator entity may be a timeout rate of XXX%, a load of XXX%, and a utilization rate of XXX%, where XXX represents a numerical value.
[0039] The initial teacher model can be an initial, untrained teacher model. The trained root cause localization model, also known as the trained student model, can be used to perform root cause localization on the input business system fault logs.
[0040] Specifically, at least one business system fault log and the true labels of each business system fault log are obtained; for each business system fault log, the causal chain of the fault entity corresponding to the business system fault log is extracted; the predicted labels corresponding to each business system fault log are output through the initial teacher model; the initial teacher model is trained with the goal of minimizing the difference between the predicted labels and the true labels of the business system fault logs to obtain a trained teacher model; and the trained teacher model is distilled onto the student model using a certain algorithm to obtain a trained root cause localization model.
[0041] In one optional embodiment, a prompt word template is obtained; business system fault logs are filled into the prompt word template; and the initial teacher model is trained using the prompt word template filled with business system fault logs and the real labels of the business system fault logs to obtain a trained teacher model.
[0042] Optionally, the step of distilling the trained teacher model onto the student model to obtain a trained root cause localization model includes: for each business system fault log, inputting the business system fault log into the trained teacher model to obtain the reasoning text output by the teacher model and the output soft tags; the reasoning text includes at least one conclusion inference statement; the soft tags include the probability of the inference result in each conclusion inference statement; and training the initial student model based on the soft tags, the inference results in each conclusion inference statement, and the true tags of the business system fault log to obtain a trained root cause localization model.
[0043] The reasoning text can record the reasoning process performed by the teacher model during the generation of output results; the reasoning text can include, but is not limited to, at least one conclusion inference statement; the conclusion inference statement can be a text recording a single logical reasoning process in the teacher model's reasoning process. The inference result can be a definite result in the conclusion inference statement.
[0044] For example, the reasoning text could be: "The current scenario is the peak period of Double 11 (00:00-02:00), and the payment interface timeout rate is 35%, requiring priority troubleshooting according to peak scenario rules; first, verify the faulty core node 'gateway,' and query real-time data shows a load of 82%, exceeding the 80% threshold, indicating the 'gateway' is overloaded; next, check the 'API node,' whose concurrency reaches 2800 TPS, exceeding the design threshold of 2000 TPS, indicating the 'API node' is overloaded; finally, check the 'server CPU utilization,' currently at 96%, exceeding the 95% threshold, identified as the core root cause; if all the above indicators are normal, then other factors such as network fluctuations may need to be investigated." The conclusions in this reasoning text would be: "The current scenario is the peak period of Double 11 (00:00-02:00), and the payment interface timeout rate is 35%, requiring priority troubleshooting according to peak scenario rules; first, verify the faulty core node 'gateway,' and query real-time data shows a load of 82%, exceeding the 80% threshold, indicating the 'gateway' is overloaded; next, check the 'API node,' whose concurrency reaches 2800 TPS, exceeding the design threshold of 2000 TPS, indicating the 'API node' is overloaded; finally, check the 'server CPU utilization,' currently at 96%, exceeding the 95% threshold, identified as the core root cause; if the above indicators are all normal, then other factors such as network fluctuations may need to be investigated." The inference result for "Peak scenario rule investigation" is "Investigate according to peak scenario rules"; "First, verify the faulty core node 'gateway'. Real-time data shows a load of 82%, exceeding the 80% threshold, indicating 'gateway' load is overloaded", the inference result is "'gateway' load is overloaded"; "Next, investigate the 'API node'. Its concurrency reaches 2800 TPS, exceeding the design threshold of 2000 TPS, indicating 'API node' concurrency is overloaded", the inference result is "'API node' concurrency is overloaded"; "Finally, check the 'server CPU utilization'. The current utilization is 96%, exceeding the 95% threshold, and is determined to be the core root cause", the inference result is "Server CPU utilization exceeding the limit is the core root cause"; "If the above indicators are all normal, it may be necessary to investigate other factors such as network fluctuations", the inference result is "No need to investigate other factors such as network fluctuations".
[0045] The soft label includes the probability of the inference result in each conclusion inference statement. Taking the above example, the probability of "investigating according to peak scenario rules" is 0.92; "'gateway load' exceeds the limit" is 0.95; "'API node' concurrency exceeds the limit" is 0.93; "server CPU utilization exceeding the limit is the core root cause" is 0.98; and "no need to investigate network fluctuations and other factors" is 0.7.
[0046] Using a specific algorithm, the initial student model is trained based on the soft labels, the inference results in each of the conclusion inference statements, and the real labels in the business system fault logs, to obtain a trained root cause localization model.
[0047] It is understandable that by adopting the above technical solution, for each business system fault log, the business system fault log is input into the trained teacher model to obtain the reasoning and thinking text output by the teacher model, as well as the output soft tags; based on the soft tags, the inference results in each conclusion inference statement, and the real tags of the business system fault log, the initial student model is trained to obtain a trained root cause localization model. The soft tags and reasoning and thinking text of the teacher model can assist the training of the student model, thereby improving the training efficiency of the student model.
[0048] Optionally, the step of training the initial student model based on the soft labels, the inference results in each of the conclusion inference statements, and the real labels in the business system fault logs to obtain a trained root cause localization model includes: obtaining the probability weights of the inference results in each of the conclusion inference statements; weighting the soft labels according to the probability weights of each of the inference results to obtain weighted soft labels; and training the initial student model based on the weighted soft labels and the real labels in the business system fault logs to obtain a trained root cause localization model.
[0049] The probability weights of each inference result can be pre-set by technical personnel based on actual needs or practical experience. The weighted soft label includes the weighted probability of each inference result; the weighted probability is the result of weighting the probabilities of the inference results.
[0050] Specifically, the probability weights of each inference result are obtained; the soft labels are weighted according to the probability weights of each inference result to obtain weighted soft labels; the initial student model is trained according to the weighted soft labels and the real labels of the business system fault logs to obtain a trained root cause localization model.
[0051] Specifically, the soft tags are weighted according to the probability weights of each inference result to obtain weighted soft tags, including: for the probability of each inference result in the soft tag, multiplying the probability weight of the inference result with the probability of the inference result to obtain the weighted probability of the inference result; and obtaining the weighted soft tags according to the weighted probabilities of each inference result.
[0052] It is understandable that by adopting the above technical solution, the probability weights of the inference results in each conclusion inference statement are obtained; the soft labels are weighted according to the probability weights of each inference result to obtain weighted soft labels; the initial student model is trained according to the weighted soft labels and the real labels of the business system fault log to obtain a trained root cause localization model. This model can flexibly adjust the probability of the inference results according to different inference results, thereby correcting the soft labels and improving the accuracy of the trained root cause localization model.
[0053] The technical solution of this invention trains a model for root cause localization using business system fault logs and real labels. Compared with the prior art of manually analyzing logs, training the root cause localization model improves the efficiency of root cause localization. Distillation quantization perception training compresses the model size, reducing the resource consumption of model deployment. By extracting the causal chain of fault entities to train the teacher model, the accuracy of the root cause localization model obtained by distillation in locating the root cause of the fault is further improved.
[0054] Example 2
[0055] Figure 2 This is a flowchart of a model training method provided in Embodiment 2 of the present invention. Based on the technical solution of the above embodiments, the present invention optimizes and improves the construction operation of the causal chain of fault entities.
[0056] Furthermore, the step of "extracting the causal chain of fault entities corresponding to the fault log of the business system" is refined to "extracting fault component entities, fault indicator entities, and time entities from the fault log of the business system, and determining the relationship between the fault component entities and the fault indicator entities; combining the interrelated fault component entities and fault indicator entities to obtain fault phenomenon entities; performing dependency parsing on the log fragment to which the fault phenomenon entity belongs for each fault phenomenon entity to obtain fault entity causal relationship pairs; the log fragments are text fragments in the fault log of the business system; and constructing fault entity causal chains based on each fault entity causal relationship pair using a graph network model" to improve the construction operation of fault entity causal chains.
[0057] It should be noted that for any parts not described in detail in the embodiments of the present invention, please refer to the description in the foregoing embodiments.
[0058] See Figure 2 The model training methods shown include:
[0059] S201. Obtain at least one business system fault log and the real label of each business system fault log.
[0060] S202. For each business system fault log, extract the fault component entity, fault indicator entity, and time entity from the business system fault log, and determine the relationship between the fault component entity and the fault indicator entity.
[0061] S203. Combine the interconnected faulty component entities and fault indicator entities to obtain the fault phenomenon entity.
[0062] S204. For each fault phenomenon entity, perform dependency parsing on the log segment to which the fault phenomenon entity belongs to obtain fault entity causal relationship pairs; the log segment is a text segment in the fault log of the business system.
[0063] S205. Using a graph network model, construct a causal chain for each fault entity based on the causal relationships between the fault entities.
[0064] S206. Based on the fault logs of each business system, and the fault entity causal chain and real label corresponding to the fault logs of each business system, train the initial teacher model to obtain the trained teacher model.
[0065] S207. Distill the trained teacher model onto the student model to obtain the trained root cause localization model.
[0066] In this embodiment, the fault phenomenon entity is the result of combining the fault component entity and the fault indicator entity; for example, if the fault component entity is "gateway" and the fault indicator entity is "load is 82%", then the fault phenomenon entity is "gateway load is 82%". The fault entity causal relationship includes two different fault phenomenon entities and the pointing relationship between the two different fault phenomenon entities.
[0067] Specifically, from the fault logs of the business system, fault component entities, fault indicator entities, and time entities are extracted, and fault component entities and fault indicator entities located in the same coherent sentence are associated; the coherent sentence does not include separators such as commas or periods; the associated fault component entities and fault indicator entities are combined to obtain fault phenomenon entities; for each fault phenomenon entity, a dependency parsing model is used to perform dependency syntax analysis on the log segment to which the fault phenomenon entity belongs to obtain fault entity causal relationship pairs; for example, if the log segment associated with the fault phenomenon entity is "gateway load is 82%, causing the payment interface timeout rate to rise to 35%", then by analyzing the log segment through the dependency parsing model, the verb "causes", the parent word of the verb "causes" is "gateway", and the child word is "payment interface", then the fault entity causal relationship pair is determined to include the fault phenomenon entity "gateway load is 82%" and the fault phenomenon entity "payment interface timeout rate 35%", and the causal relationship is "gateway load is 82%" pointing to "payment interface timeout rate 35%". Using a specific algorithm and a graph network model, a causal chain of fault entities is constructed based on the causal relationships between each fault entity.
[0068] Optionally, the step of constructing a fault entity causal chain based on each fault entity causal relationship pair using a graph network model includes: performing graph-based modeling on each fault entity causal relationship pair using the graph network model to obtain a directed graph of fault entity causal relationships; and constructing a fault entity causal chain based on the directed graph of fault entity causal relationships.
[0069] The directed graph of causal relationships of fault entities includes, but is not limited to, at least one node and at least one directed edge; the node is a fault phenomenon entity; the directed edge represents the causal relationship between connected nodes; for example, if node A and node B are connected by a directed edge, and the reverse direction of the directed edge is A to B, then it represents that the fault phenomenon entity corresponding to node A causes the fault phenomenon entity corresponding to node B.
[0070] Specifically, the graph network model is used to perform graph-based modeling of the causal relationships of each fault entity, resulting in a directed graph of causal relationships of fault entities; and a certain algorithm is used to construct a causal chain of fault entities based on the directed graph of causal relationships of fault entities.
[0071] It is understood that by adopting the above technical solution, the graph network model is used to perform graph-based modeling of the causal relationship pairs of each fault entity, resulting in a directed graph of causal relationships of fault entities; based on the directed graph of causal relationships of fault entities, a causal chain of fault entities is constructed, which can construct a directed graph that includes each fault phenomenon entity and the connection relationship between each fault phenomenon entity, thereby improving the accuracy of the determined causal chain of fault entities.
[0072] Optionally, constructing a causal chain for the fault entities based on the directed graph of causal relationships of the fault entities includes: determining at least one starting node based on the direction of the edges of each node in the directed graph of causal relationships of the fault entities and the connection relationships between each node; determining at least one first node pointed to by the starting node; for each first node, determining whether there is a node pointed to by the first node based on the direction of the edges of the first node; if there is no node pointed to by the first node, then determining the first node as a termination node; constructing a causal chain for the fault entities based on the starting node and the termination node, and the pointing relationship between the starting node and the termination node; if there is a node pointed to by the first node, then determining the first node as an intermediate node, and The node pointed to by the intermediate node is determined as the second node; based on the direction of the edge of the second node, it is determined whether there is a node pointed to by the second node; if there is no node pointed to by the second node, the second node is determined as the termination node; based on the starting node, the intermediate node, and the termination node, and the pointing relationship between the starting node, the intermediate node, and the termination node, a fault entity causal chain is constructed; if there is a node pointed to by the second node, the second node is determined as the intermediate node, and the node pointed to by the intermediate node is determined as the second node, and the process returns to the step of determining whether there is a node pointed to by the second node based on the direction of the edge of the second node, until there is no node pointed to by the second node.
[0073] Specifically, in the directed graph of causal relationships of fault entities, the starting point not pointed to by any other node is determined as the starting node; at least one first node is determined to be pointed to by the starting node; for each first node, based on the direction of the edge of the first node, it is determined whether there is a node pointed to by the first node; if there is no node pointed to by the first node, the first node is determined as the termination node; the causal chain from the fault entity corresponding to the starting node to the corresponding fault entity of the termination node is determined as the fault entity causal chain; if there is a node pointed to by the first node, the first node is determined as the intermediate node, and the node pointed to by the intermediate node is determined as the second node; based on the edge of the second node... The direction of the edge of the second node is used to determine whether there is a node pointed to by the second node; if there is no node pointed to by the second node, the second node is determined as the termination node; the causal chain from the fault phenomenon entity corresponding to the starting node to the fault phenomenon entity corresponding to the intermediate node, and then from the fault phenomenon entity corresponding to the intermediate node to the fault phenomenon entity corresponding to the termination node is determined as the fault entity causal chain; if there is a node pointed to by the second node, the second node is determined as the intermediate node, and the node pointed to by the intermediate node is determined as the second node, and the process returns to the step of determining whether there is a node pointed to by the second node based on the direction of the edge of the second node, until there is no node pointed to by the second node.
[0074] It is understandable that by adopting the above technical solution, the starting node can be determined from the directed graph of the causal relationship of the fault entity, and then the ending node of the starting node and the intermediate nodes between the starting node and the ending node can be determined according to the connection relationship of each node in the directed graph of the causal relationship of the fault entity, thereby generating the causal chain of the fault entity and improving the accuracy and completeness of the causal chain of the fault entity.
[0075] This invention extracts faulty component entities, faulty indicator entities, and time entities from the fault logs of a business system, and determines the relationship between the faulty component entities and the faulty indicator entities. It then combines the related faulty component entities and faulty indicator entities to obtain faulty phenomenon entities. For each faulty phenomenon entity, it performs dependency parsing on the log segment to which the faulty phenomenon entity belongs to obtain faulty entity causal relationship pairs. The log segment is a text segment in the business system's fault log. Using a graph network model, a faulty entity causal chain is constructed based on each faulty entity causal relationship pair. After obtaining the faulty entity causal relationship pairs through dependency parsing, the faulty entity causal chain is constructed using a graph network model, thus improving the accuracy of the faulty entity causal chain.
[0076] Example 3
[0077] Figure 3This is a schematic diagram of a model training device provided in Embodiment 3 of the present invention. This embodiment of the present invention is applicable to situations where a root cause localization model has been trained. The device can execute model training methods and can be implemented in hardware and / or software. The device can be configured in an electronic device.
[0078] See Figure 3 The model training device shown includes an acquisition module 301, an extraction module 302, a training module 303, and a distillation module 304, wherein...
[0079] Module 301 is used to acquire fault logs from at least one business system.
[0080] Extraction module 302 is used to extract the fault entity causal chain corresponding to the fault log of each business system.
[0081] Training module 303 is used to train the initial teacher model based on the fault logs of each business system and the fault entity causal chain corresponding to the fault logs of each business system, so as to obtain a trained teacher model.
[0082] Distillation module 304 is used to distill the trained teacher model onto the student model to obtain a trained root cause localization model.
[0083] The technical solution of this invention trains a model for root cause localization using business system fault logs and real labels. Compared with the prior art of manually analyzing logs, training the root cause localization model improves the efficiency of root cause localization. Distillation quantization perception training compresses the model size, reducing the resource consumption of model deployment. By extracting the causal chain of fault entities to train the teacher model, the accuracy of the root cause localization model obtained by distillation in locating the root cause of the fault is further improved.
[0084] Optionally, the extraction module 302 includes:
[0085] The extraction unit is used to extract faulty component entities, fault indicator entities, and time entities from the fault log of the business system, and to determine the relationship between the faulty component entities and the fault indicator entities.
[0086] The combination unit is used to combine the interconnected faulty component entities and fault indicator entities to obtain the fault phenomenon entity.
[0087] The syntax analysis unit is used to perform dependency syntax analysis on the log segment to which the fault phenomenon entity belongs for each fault phenomenon entity, and to obtain the fault entity causal relationship pair; the log segment is a text segment in the fault log of the business system.
[0088] The building unit is used to construct the causal chain of fault entities based on the causal relationship pairs of each fault entity using a graph network model.
[0089] Optional building blocks include:
[0090] The modeling subunit performs graph-based modeling of the causal relationship pairs of each fault entity through the graph network model, thereby obtaining a directed graph of causal relationships of fault entities.
[0091] A sub-unit is constructed to construct a causal chain of fault entities based on the directed graph of causal relationships of the fault entities.
[0092] Optionally, the building subunit is specifically used for:
[0093] Based on the direction of the edges of each node in the directed graph of the causal relationship of the fault entities and the connection relationship between each node, at least one starting node is determined;
[0094] Determine at least one first node that the starting node points to;
[0095] For each first node, determine whether there exists a node that the first node points to, based on the direction of the edge of the first node;
[0096] If the node pointed to by the first node does not exist, then the first node is determined as the termination node;
[0097] Based on the starting node and the ending node, and the pointing relationship between the starting node and the ending node, construct the causal chain of the fault entity;
[0098] If there exists a node that the first node points to, then the first node is determined as an intermediate node, and the node that the intermediate node points to is determined as the second node.
[0099] Based on the direction of the edge of the second node, determine whether there exists a node that the second node points to;
[0100] If the node pointed to by the second node does not exist, then the second node is determined as the termination node;
[0101] Based on the starting node, the intermediate node, and the ending node, as well as the pointing relationship between the starting node, the intermediate node, and the ending node, a causal chain of the fault entity is constructed;
[0102] If a node is pointed to by the second node, then the second node is determined as the intermediate node, and the node pointed to by the intermediate node is determined as the second node. Then, return to execute the step of determining whether a node is pointed to by the second node based on the direction of the edge of the second node, until no node is pointed to by the second node.
[0103] Optionally, the distillation module 304 includes:
[0104] The input unit is used to input the fault log of each business system into the trained teacher model to obtain the reasoning text output by the teacher model and the soft tags output by the model; the reasoning text includes at least one conclusion inference statement; the soft tags include the probability of the inference result in each conclusion inference statement.
[0105] The training unit is used to train the initial student model based on the soft labels, the inference results in each of the conclusion inference statements, and the real labels in the business system fault logs, to obtain a trained root cause localization model.
[0106] Optionally, the training unit is specifically used for:
[0107] Obtain the probability weights of the inference results in each of the aforementioned conclusion inference statements;
[0108] Based on the probability weights of each inference result, the soft labels are weighted to obtain weighted soft labels;
[0109] The initial student model is trained based on the weighted soft labels and the real labels of the business system fault logs to obtain a trained root cause localization model.
[0110] The model training apparatus provided in the embodiments of the present invention can execute the model training method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects for executing the model training method.
[0111] Example 4
[0112] Figure 4 A schematic diagram of a model training device 410, which can be used to implement embodiments of the present invention, is shown. The model training device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The model training device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (such as helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.
[0113] like Figure 4As shown, the model training device 410 includes at least one processor 411 and a memory, such as a read-only memory (ROM) 412 or a random access memory (RAM) 413, communicatively connected to the at least one processor 411. The memory stores computer programs executable by the at least one processor. The processor 411 can perform various appropriate actions and processes based on the computer program stored in the ROM 412 or loaded from storage unit 418 into the RAM 413. The RAM 413 can also store various programs and data required for the operation of the model training device 410. The processor 411, ROM 412, and RAM 413 are interconnected via a bus 414. An input / output (I / O) interface 415 is also connected to the bus 414.
[0114] Multiple components in the model training device 410 are connected to the I / O interface 415, including: an input unit 416, such as a keyboard, mouse, etc.; an output unit 417, such as various types of displays, speakers, etc.; a storage unit 418, such as a disk, optical disk, etc.; and a communication unit 419, such as a network card, modem, wireless transceiver, etc. The communication unit 419 allows the model training device 410 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.
[0115] Processor 411 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 411 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 411 performs the various methods and processes described above, such as model training methods.
[0116] In some embodiments, the model training method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 418. In some embodiments, part or all of the computer program may be loaded and / or installed on the model training device 410 via ROM 412 and / or communication unit 419. When the computer program is loaded into RAM 413 and executed by processor 411, one or more steps of the model training method described above may be performed. Alternatively, in other embodiments, processor 411 may be configured to execute the model training method by any other suitable means (e.g., by means of firmware).
[0117] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations may include: implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.
[0118] Computer programs used to implement the methods of the present invention can be written in any combination of one or more programming languages. These computer programs can be provided to the processor of a general-purpose computer, a special-purpose computer, or other programmable model training device, such that when executed by the processor, the functions / operations specified in the flowcharts and / or block diagrams are implemented. The computer programs can be executed entirely on the machine, partially on the machine, as a standalone software package partially on the machine and partially on a remote machine, or entirely on a remote machine or server.
[0119] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.
[0120] To provide user interaction, the systems and techniques described herein can be implemented on a model training device having: a display device for displaying information to the user (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the model training device. Other types of devices can also be used to provide user interaction; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).
[0121] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.
[0122] A computing system can include clients and servers. Clients and servers are generally geographically separated and typically interact via communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system. It addresses the shortcomings of traditional physical hosts and VPS (Virtual Private Server) services, such as high management difficulty and weak business scalability.
[0123] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.
[0124] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.
Claims
1. A model training method, characterized in that, The method comprises the following steps: obtaining at least one business system failure log and a true label of each business system failure log; for each business system failure log, extracting a failure entity causal chain corresponding to the business system failure log; training an initial teacher model according to each business system failure log, the failure entity causal chain corresponding to each business system failure log, and the true label, to obtain a trained teacher model; distilling the trained teacher model to a student model to obtain a trained root cause positioning model.
2. The method of claim 1, wherein, The extraction of the failure entity causal chain corresponding to the business system failure log comprises the following steps: extracting a failure component entity, a failure index entity, and a time entity from the business system failure log, and determining the relationship between the failure component entity and the failure index entity; combining the failure component entity and the failure index entity that are associated with each other to obtain a failure phenomenon entity; for each failure phenomenon entity, performing dependency syntax analysis on a log segment to which the failure phenomenon entity belongs to obtain a failure entity causal relationship pair; the log segment is a text segment in the business system failure log; constructing a failure entity causal chain according to each failure entity causal relationship pair through a graph network model.
3. The method of claim 2, wherein, The construction of the failure entity causal chain according to each failure entity causal relationship pair through the graph network model comprises the following steps: performing graph modeling on each failure entity causal relationship pair through the graph network model to obtain a failure entity causal relationship directed graph; constructing a failure entity causal chain according to the failure entity causal relationship directed graph.
4. The method of claim 3, wherein, The construction of the failure entity causal chain according to the failure entity causal relationship directed graph comprises the following steps: determining at least one starting node according to the direction of the edges of each node in the failure entity causal relationship directed graph and the connection relationship between the nodes; determining at least one first node pointed to by the starting node; for each first node, determining whether there is a node pointed to by the first node according to the direction of the edges of the first node; if there is no node pointed to by the first node, the first node is determined as a terminal node; constructing a failure entity causal chain according to the starting node and the terminal node and the pointing relationship between the starting node and the terminal node; if there is a node pointed to by the first node, the first node is determined as an intermediate node, and a node pointed to by the intermediate node is determined as a second node; determining whether there is a node pointed to by the second node according to the direction of the edges of the second node; if there is no node pointed to by the second node, the second node is determined as a terminal node; constructing a failure entity causal chain according to the starting node, the intermediate node, and the terminal node and the pointing relationship between the starting node, the intermediate node, and the terminal node; If the node pointed to by the second node exists, the second node is determined as an intermediate node, and the node pointed to by the intermediate node is determined as a second node, and the step of determining whether the node pointed to by the second node exists according to the direction of the edge of the second node is returned to execute until the node pointed to by the second node does not exist.
5. The method of claim 1, wherein, The distilling the trained teacher model to the student model to obtain the trained root cause positioning model comprises: For each business system failure log, the business system failure log is input into the trained teacher model to obtain an inference thinking text output by the teacher model and a soft label; the inference thinking text comprises at least one conclusion inference sentence; and the soft label comprises a probability of an inference result in each conclusion inference sentence. The initial student model is trained according to the soft label, the inference result in each conclusion inference sentence and a true label of the business system failure log to obtain the trained root cause positioning model.
6. The method of claim 5, wherein, The initial student model is trained according to the soft label, the inference result in each conclusion inference sentence and a true label of the business system failure log to obtain the trained root cause positioning model, which comprises: A probability weight of the inference result in each conclusion inference sentence is obtained. The soft label is weighted according to the probability weight of each inference result to obtain a weighted soft label. The initial student model is trained according to the weighted soft label and the true label of the business system failure log to obtain the trained root cause positioning model.
7. A model training apparatus characterized by comprising: The apparatus comprises: An acquisition module configured to acquire at least one business system failure log; An extraction module configured to extract, for each business system failure log, a failure entity causal chain corresponding to the business system failure log; A training module configured to train an initial teacher model according to each business system failure log and the failure entity causal chain corresponding to each business system failure log to obtain a trained teacher model; A distillation module configured to distill the trained teacher model to a student model to obtain a trained root cause positioning model.
8. An electronic device, comprising: The electronic device comprises: at least one processor; and a memory connected to the at least one processor in communication; wherein The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to execute the model training method of any one of claims 1-6.
9. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer instructions for enabling the processor to execute the model training method of any one of claims 1-6 when executed.
10. A computer program product, characterised in that, The computer program product comprises a computer program, which, when executed by the processor, implements the model training method of any one of claims 1-6.