AI digital operation and maintenance method based on LLM-RAG fusion

Abstract

The invention discloses an AI digital operation and maintenance method based on LLM-RAG fusion, and belongs to the field of operation and maintenance, and the method comprises the following steps: S1, obtaining a standardized data set and a multi-modal enhanced representation set after quality calibration; s2, identifying an intention by using the trained neural symbol LLM model, and outputting an intention set; s3, calling a neural symbol LLM model to complement missing knowledge to form a complete knowledge graph, and outputting an enhanced context set and the complemented knowledge graph; s4, generating a test case evaluation command execution coverage rate through Code Lma, and outputting an executable operation and maintenance scheme; s5, through multi-dimensional security management and control, outputting an operation and maintenance scheme passing security verification and a threat level report; and S6, performing feedback adjustment. By the adoption of the AI digital operation and maintenance method based on LLM-RAG fusion, full-link intelligent operation and maintenance upgrading with more accurate operation and maintenance intention recognition, safer and more adaptive scheme generation and self-adaptive evolution of the system is achieved.

Description

Technical Field

[0001] This invention relates to the field of operation and maintenance technology, and in particular to an AI-based digital operation and maintenance method based on LLM-RAG fusion. Background Technology

[0002] As digital transformation deepens, enterprise IT architectures are becoming increasingly complex, and operational scenarios are characterized by heterogeneous multi-source data, dynamic business needs, and real-time fault handling. Traditional operational methods and existing intelligent operational solutions are gradually revealing insurmountable bottlenecks, as follows: 1. Traditional operation and maintenance (O&M) models heavily rely on the experience of O&M personnel, requiring manual and synchronous analysis of multiple sources of information such as monitoring metrics, heterogeneous logs, work order data, and user queries. This process is not only cumbersome and slow to respond, but also prone to escalation of faults due to human error. Even rudimentary intelligent O&M systems suffer from excessively long mean time to repair (MTTR) (generally over 40 minutes in the industry) and high labor costs, making them difficult to adapt to the O&M needs of large-scale distributed architectures.

[0003] 2. Existing intelligent operation and maintenance solutions mostly use ordinary LLM models for intent recognition, lacking symbolic rule constraints and multimodal feature fusion capabilities: On the one hand, there are biases in the semantic understanding of unstructured data, and the accuracy of intent recognition is generally lower than 85%; on the other hand, when facing new business scenarios, due to the lack of small sample expansion and confidence correction mechanisms, the rate of missed and false judgments in new intent recognition is high, and it is unable to effectively handle the priority determination of multi-intent conflict scenarios, resulting in a disconnect between operation and maintenance instructions and actual needs.

[0004] 3. Traditional RAG architecture relies on static knowledge bases and simple vector retrieval, which has incomplete knowledge coverage. The recall rate of key related knowledge such as fault handling and command adaptation is only about 60%, which cannot provide accurate support for the generation of operation and maintenance solutions, thus affecting the feasibility of the solutions.

[0005] 4. The existing operation and maintenance system's knowledge base and model are mostly statically configured, lacking dynamic update and incremental optimization mechanisms: when a new business goes online, rules need to be rewritten manually and the knowledge base needs to be reconstructed, which usually takes more than 8 hours to adapt and is extremely costly. Summary of the Invention

[0006] The purpose of this invention is to provide an AI-based digital operation and maintenance method based on LLM-RAG fusion to solve the above-mentioned technical problems.

[0007] To achieve the above objectives, this invention provides an AI-based digital operation and maintenance method based on LLM-RAG fusion, comprising the following steps: S1. Synchronously collect monitoring indicators, log data, work order data and user natural language query data to obtain multi-source raw datasets. Extract log triples through Stanza parsing and log parsing rule base. After preprocessing, fuse cross-source association features, text features, structural features and time series features to generate multimodal enhanced representations. Output a standardized dataset after quality calibration, a set of multimodal enhanced representations and a data quality report. S2. Based on the multimodal enhanced representation set output by S1, the neural symbol LLM model is trained by combining the neural symbol rule base and LoRA to adjust the parameters, and the trained neural symbol LLM model is used to identify the intent and output the intent set. S3. Based on the intent set output by S2, combined with the enterprise's private operation and maintenance knowledge base and operation and maintenance knowledge graph, the core entity subgraph is extracted by weighted BFS and the TransE algorithm is used to detect knowledge gaps. The neural symbolic LLM model is called to complete the missing knowledge to form a complete knowledge graph. Then, after structure-semantic dual retrieval and fusion scoring and ranking, and knowledge confidence filtering, the enhanced context set, the completed knowledge graph and knowledge relevance ranking report are output. S4. Based on the enhanced context set output by S3, an initial solution is generated by combining the neural symbolic LLM model. Test cases are generated using Code Llama to evaluate command execution coverage. After symbolic execution verification and sandbox simulation, an executable operation and maintenance solution and a command execution simulation report are output. S5, based on the executable operation and maintenance solution output by S4, calculates the dynamic threat level by combining the STRIDE threat model and the business importance level, and completes multi-dimensional security control through syntax verification, permission verification, and vulnerability pre-detection, and outputs the operation and maintenance solution and threat level report that have passed security verification; S6. Based on the security operation and maintenance solution execution results and human feedback output by S5, the feedback data is structured into triples to update the enterprise private operation and maintenance knowledge base and dynamically adjust the knowledge weights. The LoRA incremental adjustment neural symbolic LLM model is adopted, and the evolution effect is evaluated by quantitative evaluation of indicators. The evolved enterprise private operation and maintenance knowledge base, multi-version model set and new business adaptation model are output.

[0008] Therefore, the beneficial effects of the AI ​​digital operation and maintenance method based on LLM-RAG fusion adopted in this invention are as follows: 1. More accurate intent recognition: By integrating neural symbol reasoning and few-sample expansion, the accuracy of intent recognition for new businesses is improved to over 94%, solving the problem of insufficient coverage of new scenarios by traditional methods; 2. More comprehensive knowledge retrieval: Through dynamic knowledge graph completion and dual retrieval optimization, the knowledge relevance recall rate is improved by 30%, avoiding the shortcomings of traditional RAG knowledge gaps and insufficient connections; 3. Safer execution of the plan: Combining STRIDE threat modeling and sandbox simulation, the risk of high-risk operations is reduced by 99%, and the success rate of plan execution is increased to 98%; 4. More efficient business adaptation: Fine-tuning with fewer samples + multi-version model management reduces the adaptation cost of new business systems by 75% and eliminates the need to rewrite rules; 5. Improved operational efficiency: Seamless CI / CD integration and multi-environmental adaptability of the solution reduce the mean time to repair (MTTR) by 40% and lower operational labor costs by 50%.

[0009] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0010] Figure 1 This is a flowchart of the AI ​​digital operation and maintenance method based on LLM-RAG fusion of the present invention. Detailed Implementation

[0011] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are merely illustrative of the embodiments of the present invention and are not intended to limit the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of this application. Examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout.

[0012] It should be noted that the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion, such as a process, method, system, product, or server that includes a series of steps or units, not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such process, method, product, or device.

[0013] The embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0014] like Figure 1 As shown, the AI-based digital operations and maintenance method based on LLM-RAG fusion includes the following steps: S1. Synchronously collect monitoring indicators, log data, work order data and user natural language query data to obtain multi-source raw datasets. Extract log triples through Stanza parsing and log parsing rule base. After preprocessing, fuse cross-source association features, text features, structural features and time series features to generate multimodal enhanced representations. Output a standardized dataset after quality calibration, a set of multimodal enhanced representations and a data quality report. Step S1 specifically includes the following steps: S11. Multi-source data structured parsing and noise filtering: Simultaneously collect monitoring metrics, log data, work order data, and user natural language query data to obtain a multi-source raw dataset. Then, use the Stanza parsing tool in conjunction with the log parsing rule base to extract entity-attribute-value triples from unstructured logs, resulting in a set of structured log triples. , This indicates a function that invokes the Stanza parsing tool; This represents unstructured log data from multiple source raw datasets; This represents the log parsing rule base; These represent the lists of fields associated with intent, knowledge, and faults, respectively. Then calculate the quality score for each data point. : ; In the formula, This indicates the integrity score of the field associated with the intended association; This indicates the accuracy score of the knowledge association field; This indicates the integrity score of the fault-related fields; Indicates the cross-source data consistency score; Finally, determine whether the condition is satisfied. If so, the single data entry is determined to be noise and is removed; otherwise, it is retained, resulting in filtered structured data. ; S12. Cross-source data alignment: Based on the correlation field mapping table, establish the correlation relationship between multi-source data and generate a correlation graph. To obtain aligned structured data ; S13. Multimodal Enhanced Representation Generation: Extract text features, structural features, temporal features, and cross-source association features respectively, and generate enhanced representations through attention-weighted fusion. ; in, ; In the formula, Represents a set of multimodal enhanced representations; Indicates attention weights, These represent the indexes for text features, structural features, temporal features, and cross-source association features, respectively. Indicates the first Class feature vector and intent seed vector semantic similarity; Indicates the first Class feature vector and intent seed vector semantic similarity, These represent the indices for text features, structural features, temporal features, and cross-source association features, respectively. , , , , This represents a function for extracting text features. Represents text data, This represents the parameters of the pre-trained CodeBERT model. This represents the abstract syntax tree processed by a graph neural network. and control flow graph Encode the fused data. This represents the model parameters of the graph neural network. This indicates the processing of time-series data through the Long Short-Term Memory network. Encode, These represent the model parameters of the Long Short-Term Memory (LSTM) network. This represents the computation function of a graph attention network. This represents the training parameters of the graph attention network; S14. Statistically analyze the distribution of quality scores, noise ratio, and correlation coverage of each data source to generate a visual quality report.

[0015] S2. Based on the multimodal enhanced representation set output by S1, the neural symbol LLM model is trained by combining the neural symbol rule base and LoRA to adjust the parameters, and the trained neural symbol LLM model is used to identify the intent and output the intent set. Step S2 specifically includes the following steps: S21. Construct parameter adjustment data: Pair the multimodal representations of historical work orders with intent tags to obtain a parameter adjustment data set. , They represent the first Multimodal representation and intent labeling of historical work order samples; S22. Insert a LoRA low-rank matrix and a symbolic rule adaptation layer into the Transformer layer of the LLM model to obtain a neural symbolic LLM model, whose weights... The expression is as follows: ; In the formula, This represents the pre-training weights of the neural symbolic LLM model; This represents the weight increment of the LoRA low-rank matrix, and , and These represent the input low-rank matrix and the output low-rank matrix, respectively. This represents the weights of the symbol rule adaptation layer; S23. Employ a fusion loss function and adjust the dataset using parameters. The fusion loss function expression for training the neural symbolic LLM model is as follows: ; in, ; In the formula, Indicates the total loss; Represents cross-entropy loss; This indicates a loss of consistency. Indicates the balance coefficient; This represents the total number of historical work order samples; This indicates that, given a multimodal augmentation representation and neural symbolic LLM model weights At that time, the model predicts the intent corresponding to the sample. The logarithm of the probability; S24. Intent Sample Expansion: Determine whether the intent corresponding to the current data belongs to a known intent type in the historical intent type list. If it does, output the known intent type; otherwise, determine it as a new business intent. In this case, input zero samples into the neural symbolic LLM model to obtain the new business intent and its confidence level, and determine whether the confidence level of the new business intent is lower than 0.7. If not, retain it directly; if so, use a few-sample prompt to optimize the recognition result. ; In the formula, This represents a candidate set of new business intentions. This indicates the enhancement of multimodal characterization. and a small sample set Embedded prompts Input a neural symbolic LLM model and output an optimized new business intent; S25. Correct the confidence level using the temperature scaling method: ; In the formula, Indicates the corrected confidence level; Indicates the original confidence level; Represents the temperature coefficient, and ; Number of categories representing intent; Indicates the first The original confidence level of the class intent; It then determines whether the same data matches multiple intents. If so, it uses symbol rules to determine priority and takes the intent type with the highest priority as the final intent type for the corresponding data. The priority calculation formula is as follows: ; In the formula, Indicates the type of final intent; Represents a set of conflicting intentions; Indicates intent priority (fault handling > risk warning > alarm analysis > command generation); Indicates the first The revised confidence level of the class intent.

[0016] S3. Based on the intent set output by S2, combined with the enterprise's private operation and maintenance knowledge base and operation and maintenance knowledge graph, the core entity subgraph is extracted by weighted BFS and the TransE algorithm is used to detect knowledge gaps. The neural symbolic LLM model is called to complete the missing knowledge to form a complete knowledge graph. Then, after structure-semantic dual retrieval and fusion scoring and ranking, and knowledge confidence filtering, the enhanced context set, the completed knowledge graph and knowledge relevance ranking report are output. Step S3 specifically includes the following steps: S31. Constructing an Operations and Maintenance Knowledge Graph: First, build a private enterprise operations and maintenance knowledge base based on historical work orders, operations and maintenance manuals, and command libraries. Then, assign an initial weight to each piece of operations and maintenance knowledge. The system uses a triplet extraction algorithm to extract operation and maintenance triplets from the enterprise's private operation and maintenance knowledge base. , Represent the head entity, relation, and tail entity of the operation and maintenance triple respectively; then, the operation and maintenance triple... Add attributes to entities (such as "permission level" and "applicable scenarios" for commands, and "scope of impact" and "processing priority" for faults) to form an operations and maintenance knowledge graph. ; S32, Dynamic completion of knowledge graph; S321. Subgraph localization optimization: A bidirectional breadth-first traversal combined with importance weighting is used to prioritize the extraction of highly important entities. ; In the formula, Represents the intent-related subgraph; This represents a weighted bidirectional breadth-first traversal function; This represents the core entity of intent during a bidirectional breadth-first traversal process. This represents the number of jumps during a bidirectional breadth-first traversal. Indicates the importance weight of entities; S322. Knowledge Gap Detection: Detecting missing entities or relationships in the located subgraph using the TransE algorithm. ; In the formula, This indicates the head entity detected by the TransE algorithm. Correspondence Missing tail entity; , and These represent the embedding vectors of the head entity, relation, and tail entity, respectively. Indicates type; S323. Use the neural symbolic LLM model to generate missing entity or relation completion content: ; In the formula, Indicates the completion of the set of triples; Indicates targeting the head entity and relationships Design prompts; S324. Verify the generated completed content using symbol rules, and add the verified completed content to the operations and maintenance knowledge graph. In the process, the completed operation and maintenance knowledge graph is obtained. ; S33, Based on the Completed Operations and Maintenance Knowledge Graph Extracting intent-related triples to generate structured knowledge And calculate the knowledge confidence level. : ; In the formula, Represents a triple verified by the symbol rules; This represents the total number of triples retrieved; At the same time, the latest operation and maintenance data is synchronized through the real-time data update interface to update the vector database; S34. Calculate the fusion score: ; In the formula, Indicates the fusion result; Indicates the confidence level of the knowledge structure; Indicating multimodal enhancement characterization With knowledge Semantic similarity between them; Indicates the historical frequency of knowledge use; And Sort the results in descending order and use the top 5 results as the enhanced context. ; S35. Determine if the condition is met. , This indicates the confidence threshold; if so, it is marked as low confidence and deleted; otherwise, it is retained.

[0017] S4. Based on the enhanced context set output by S3, an initial solution is generated by combining the neural symbolic LLM model. Test cases are generated using Code Llama to evaluate command execution coverage. After symbolic execution verification and sandbox simulation, an executable operation and maintenance solution and a command execution simulation report are output. Step S4 specifically includes the following steps: S41. Based on the enhanced context set output by S3, and combined with environmental configuration information and the neural symbolic LLM model, an initial scheme for multi-environment adaptation is generated. : ; In the formula, Indicates environment configuration prompts; For the generated initial scheme Perform symbolic execution to verify the feasibility of the execution path: ; In the formula, express; express; If the verification passes, the initial plan will be retained. Otherwise, the feedback is sent to the neural symbolic LLM model for regeneration until the validation is successful; S42, Initial Plan Input the Code Llama model, generate test cases, and verify the initial solution. Simultaneously calculate coverage : ; In the formula, This indicates the number of operation and maintenance solution execution paths actually covered by the test cases; This indicates the total number of execution paths of the operation and maintenance plan actually covered by the test cases; Verify whether it is satisfied , This indicates the test coverage threshold; if so, execute the solution optimization logic and calculate whether the optimized solution meets the coverage verification conditions, until verification is passed, and output the solution that meets the verification. ; S43, Based on the verified solution Based on the interface parameters, an access script is generated to obtain an executable operation and maintenance solution. ; S44. Simulate the execution plan in the sandbox, verify the execution effect and compatibility, and generate a command execution simulation report.

[0018] The specific steps of the command optimization logic described in step S42 are as follows: S421. Based on the test cases and symbolic execution results generated by the Code Llama model, locate the execution paths not covered by the commands, and calculate the priority score of the uncovered paths by combining business importance and path risk ranking: ; In the formula, Indicates the first Priority score of each uncovered path; , and These represent the path risk weight, business-related weight, and path execution frequency weight, respectively. Indicates the first Risk level of each route; Indicates the first The relevance of each path to the core business; Indicates the first The historical execution frequency of each path; S422. Sort the priority scores of the uncovered paths in descending order, and perform the following logical optimizations on the commands according to the sorting results: Additional parameter validation logic: Perform parameter validity validation for incorrect or uncovered paths; Anomaly detection and degradation handling: For paths with resource exhaustion or insufficient permissions, new anomaly detection logic and degradation schemes have been added; Enhanced multi-environment adaptation logic: For paths that fail to adapt across environments, the environment configuration information is invoked to generate conditional branch logic; S423. Verify the optimized command using a neural symbol rule base; S424. Use the Code Llama model to generate supplementary test cases, simulate execution in a sandbox environment, and recalculate the test coverage until the test coverage threshold is met. .

[0019] S5, based on the executable operation and maintenance solution output by S4, calculates the dynamic threat level by combining the STRIDE threat model and the business importance level, and completes multi-dimensional security control through syntax verification, permission verification, and vulnerability pre-detection, and outputs the operation and maintenance solution and threat level report that have passed security verification; Step S5 specifically includes the following steps: S51, STRIDE Threat Modeling and Assessment: Targeting actionable operational solutions The commands or steps in the solution are examined one by one using the STRIDE threat model across six dimensions: deception, tampering, denial, information disclosure, denial of service, and privilege escalation, and the dynamic threat level is calculated. : ; In the formula, Indicates the basic threat level; Indicates the importance weight of business operations; S52, Level 3 Security Verification: Syntax validation: A syntax parser is used to verify the correctness of the command format. When any syntax error is detected, the erroneous command and its specific error type are marked, and the marking information is fed back to the neural symbolic LLM model to trigger regeneration until the syntax validation is passed. Permission verification: The degree to which the permission level of the query command matches the current user's permissions. And when If a permission mismatch is detected, a permission escalation request or command adjustment process is triggered, where the matching degree... The calculation formula is as follows: ; In the formula, Indicate execution The set of permissions required for commands in the command; This represents the set of actual permissions of the executing entity; Indicates the weight of permission override; Represents the complete set of system permissions; Vulnerability verification: Matching vulnerability signature database Detect hidden vulnerabilities after command execution and calculate vulnerability risk scores. And determine whether it satisfies , This indicates the vulnerability risk score threshold. If it is, the vulnerability verification is completed; otherwise, a rollback plan is generated and a data backup is created. The vulnerability risk score is used to determine the threshold. The calculation formula is as follows: ; In the formula, This indicates the first vulnerability in the CWE vulnerability signature database. The risk weight corresponding to each vulnerability; Indicates operation and maintenance commands With the Feature vector of each vulnerability Semantic similarity between them; S53. Simulate the execution of the scheme and rollback scheme verified in step S52 in a sandbox environment to verify the execution effect and rollback feasibility, and output the operation and maintenance scheme that has passed security verification when the simulation pass rate is ≥99%. .

[0020] S6. Based on the security operation and maintenance solution execution results and human feedback output by S5, the feedback data is structured into triples to update the enterprise private operation and maintenance knowledge base and dynamically adjust the knowledge weights. The LoRA incremental adjustment neural symbolic LLM model is adopted, and the evolution effect is evaluated by quantitative evaluation of indicators. The evolved enterprise private operation and maintenance knowledge base, multi-version model set and new business adaptation model are output.

[0021] Step S6 specifically includes the following steps: S61, Execute the operation and maintenance plan The results of manual feedback are transformed into a feedback triplet of problem-cause-solution; S62. Add the feedback triples to the operations and maintenance knowledge graph, update the vector database, and update the knowledge weights based on the execution success rate: ; In the formula, This represents the updated knowledge weights; and These represent the reward coefficient and the penalty coefficient, respectively. This indicates that the operation and maintenance plan has been successfully executed. This indicates a failure flag indicating the execution of the operation and maintenance plan; S63. Adjust the weights of the neural symbolic LLM model using LoRA increments: ; In the formula, This represents the weights of the neural symbolic LLM model after incremental adjustment; and Represents the incremental low-rank output and input matrices; This represents the weight increment of the symbol rule adaptation layer; S64. Using intent recognition accuracy, knowledge retrieval relevance, and fault repair time as evaluation indicators, evaluate the evolution results and compare them with historical data to generate an effectiveness improvement report.

[0022] Simulation Experiment Data set: 6 months of real operation and maintenance data from an internet company (including 100,000 monitoring metrics, 50,000 heterogeneous logs, and 20,000 work orders); Environment: CentOS 7 / 8, MySQL 8.0, Jenkins CI / CD pipeline; Model configuration: Neural Symbolic LLM (LoRA rank 256), Code Llama7B, Milvus 2.4 vector library.

[0023] Comparative example: Traditional intelligent operation and maintenance system (ordinary LLM + basic RAG, without neural symbol fusion and knowledge graph completion functions).

[0024] Table 1 Experimental Results

[0025] As shown in Table 1, the present invention has the following advantages over traditional methods: 1. Improved accuracy of intent recognition: By leveraging neural symbol fusion, the synergy between data pattern learning and symbolic rule constraints is achieved, solving the rule deviation problem in traditional LLM intent recognition; 2. Optimization of knowledge retrieval recall: Dynamic completion of knowledge graphs fills the knowledge gaps in traditional RAG, while dual retrieval enhances the correlation between knowledge and intent.

[0026] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit them. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the technical solutions of the present invention, and these modifications or equivalent substitutions cannot cause the modified technical solutions to deviate from the spirit and scope of the technical solutions of the present invention.

Claims

1. An AI digital operation and maintenance method based on LLM-RAG fusion, characterized in that: Comprise the following steps: S1, synchronously collect monitoring indicators, log data, work order data and user natural language query data to obtain a multi-source original data set, extract log triples through Stanza syntax analysis and log analysis rule library, and after preprocessing, fuse cross-source association features, text features, structure features and time sequence features to generate multi-modal enhanced representation, output standardized data set after quality calibration, multi-modal enhanced representation set and data quality report; S2, based on the multi-modal enhanced representation set output by S1, combine the neural symbolic rule library and LoRA adjustment parameters to train the neural symbolic LLM model, and use the trained neural symbolic LLM model to identify intent, and output an intent set; S3, based on the intent set output by S2, combine the enterprise private operation and maintenance knowledge base and the operation and maintenance knowledge graph, extract the core entity subgraph through weighted BFS and detect the missing knowledge using the TransE algorithm, call the neural symbolic LLM model to complete the missing knowledge to form a complete knowledge graph, then perform structure-semantic double retrieval and fusion scoring and sorting, knowledge confidence filtering, output enhanced context set, completed knowledge graph and knowledge relevance sorting report; S4, based on the enhanced context set output by S3, combine the neural symbolic LLM model to generate an initial scheme, generate test cases through CodeLlama to evaluate command execution coverage, and output executable operation and maintenance scheme and command execution simulation report through symbolic execution verification and sandbox simulation execution; S5, based on the executable operation and maintenance scheme output by S4, combine the STRIDE threat model and business importance level to calculate the dynamic threat level, complete multi-dimensional security management and control through syntax checking, permission checking and vulnerability pre-detection, and output the operation and maintenance scheme that passes the security verification and the threat level report; S6, based on the security operation and maintenance scheme execution result output by S5 and the artificial feedback, structure the feedback data into triples to update the enterprise private operation and maintenance knowledge base and dynamically adjust the knowledge weight, use LoRA to incrementally adjust the neural symbolic LLM model, combine the index quantitative evaluation to evolve the effect, and output the evolved enterprise private operation and maintenance knowledge base, multi-version model set and new business adaptation model.

2. The AI digital operation and maintenance method based on LLM-RAG fusion according to claim 1, characterized in that: Step S1 specifically comprises the following steps: S11, multi-source data structured analysis and noise filtering: synchronously collecting monitoring indicators, log data, work order data and user natural language query data to obtain a multi-source raw data set, then calling a Stanza syntax analysis tool combined with a log analysis rule library to perform entity-attribute-value triple extraction on unstructured logs to obtain a log structured triple set , represents a function of calling the Stanza syntax analysis tool; represents unstructured log data in the multi-source raw data set; represents a log analysis rule library; respectively represent an intent associated field list, a knowledge associated field list and a fault associated field list; Then a single data quality score is calculated : ； wherein represents an intent correlation field integrity score; represents a knowledge correlation field accuracy score; represents a fault correlation field integrity score; represents a cross-source data consistency score; Finally, it is determined whether the condition is met , if yes, it is determined that the single data is noise data and is removed, otherwise, it is reserved to obtain filtered structured data ; S12, cross-source data alignment: based on the association field mapping table, the association relationship between the multi-source data is established, and an association graph is generated , to obtain aligned structured data ; S13, multi-modal enhanced representation generation: extract text features, structure features, time sequence features and cross-source association features respectively, and generate enhanced representation through attention weighted fusion ； Wherein, ； In the formula, denotes a multi-modal enhanced representation set; denotes an attention weight, denotes an index of a text feature, a structure feature, a time sequence feature and a cross-source association feature, respectively; denotes a semantic similarity between a class feature vector and an intent seed vector denotes a semantic similarity between a class feature vector and an intent seed vector denotes an index of a text feature, a structure feature, a time sequence feature and a cross-source association feature, respectively, , , , , , , , , denotes a function for extracting a text feature, denotes text data, denotes a pre-training model parameter of CodeBERT, denotes encoding of fusion data of an abstract syntax tree and a control flow graph by a graph neural network, denotes a model parameter of the graph neural network, denotes encoding of time sequence data by a long short-term memory network, denotes a model parameter of the long short-term memory network; denotes a calculation function of a graph attention network, denotes a training parameter of the graph attention network; S14, statistics of data source quality score distribution, noise proportion and correlation coverage to form a visual quality report.

3. The AI digital operation and maintenance method based on LLM-RAG fusion according to claim 2, characterized in that: Step S2 specifically comprises the following steps: S21. Construct parameter adjustment data: Pair the multimodal representations of historical work orders with intent tags to obtain a parameter adjustment data set. , They represent the first Multimodal representation and intent labeling of historical work order samples; S22, inserting the LoRA low-rank matrix and the sign rule adaptation layer into the Transformer layer of the LLM model to obtain a neural sign LLM model, the weights of which are The expression is as follows: ； In the formula, denotes the pre-training weight of the neural symbol LLM model; denotes the weight increment of the LoRA low-rank matrix, and and denote the input low-rank matrix and the output low-rank matrix, respectively; denotes the symbol rule adaptation layer weight;​ S23, adopt fusion loss function, use parameter adjustment data set The neural symbolic LLM model is trained, and the expression of the fusion loss function is as follows: ； Wherein, ； wherein, denotes the total loss; denotes the cross-entropy loss; denotes the consistency loss; denotes the balancing coefficient; denotes the total number of historical work order samples; denotes the probability of the model predicting the intent corresponding to the sample given the multi-modal enhanced representation and the neural-symbolic LLM model weights ; S24, intent sample expansion: determine whether the current data corresponds to a known intent type in the historical intent type list, if it belongs to, output the known intent type; otherwise, it is determined as a new business intent, at this time, the zero sample is input into the neural symbolic LLM model to obtain the new business intent and its confidence, and it is judged whether the new business intent confidence is lower than 0.7, if not, it is directly retained; if yes, use few-shot prompt to optimize the recognition result: ； In the formula, represent a new business intent candidate set; represent a multimodal enhanced representation and a few-shot example set embedding a prompt word , input a neural symbol LLM model, and output an optimized new business intent; S25, use temperature scaling method to correct confidence: ； In the formula, denotes the corrected confidence; denotes the original confidence; denotes the temperature coefficient; denotes the number of intent classes; denotes the original confidence of the class intent; And determine whether there is the same data matching multiple intents, if there is, then through the symbol rule priority determination, and take the highest priority intent type as the final intent type of the corresponding data, wherein the priority calculation formula is as follows: ； In the formula, Indicates the type of final intent; Represents a set of conflicting intentions; Indicates the priority of intent; Indicates the first The revised confidence level of the class intent.

4. The AI digital operation and maintenance method based on LLM-RAG fusion according to claim 3, characterized in that: Step S3 specifically includes the following steps: S31, Constructing operation and maintenance knowledge graph: First, based on historical work order, operation and maintenance manual and command library, an enterprise private operation and maintenance knowledge base is constructed, and then an initial weight is given to each operation and maintenance knowledge , and a triple extraction algorithm is used to extract operation and maintenance triples from the enterprise private operation and maintenance knowledge base , respectively represent the head entity, relationship and tail entity of the operation and maintenance triple; then attributes are added to the entities in the operation and maintenance triple to form an operation and maintenance knowledge graph ; S32, dynamic completion of knowledge graph; S321, subgraph positioning optimization: high importance entities are preferentially extracted by using bidirectional breadth-first traversal combined with importance weighting: ； wherein, represents an intent-related subgraph; represents a weighted bidirectional breadth-first traversal function; represents an intent core entity in a bidirectional breadth-first traversal process; represents a hop count in a bidirectional breadth-first traversal process; represents an entity importance weight; S322, knowledge missing detection: missing entities or relationships in the positioned subgraph are detected by the TransE algorithm: ； In the formula, denotes the head entity detected by the TransE algorithm corresponding relationship missing tail entity , and denote the embedding vectors of the head entity, the relationship and the tail entity respectively denotes the type S323, call the neural symbol LLM model to generate the missing entity or relationship completion content: ； In the formula, denotes a set of completed triples; denotes a head entity and a relation a prompt word designed; S324, verify the generated completion content according to the symbol rule, and add the completion content passing the verification to the operation and maintenance knowledge graph In this way, the operation and maintenance knowledge graph is obtained ; S33, based on the completed operation and maintenance knowledge graph , extract the intent-related triplets to generate structured knowledge , and calculate the knowledge confidence : ； wherein denotes a triple that is verified by the symbol rule; denotes the total number of triples retrieved; At the same time, through the real-time data update interface, the latest operation and maintenance data are synchronized, and the vector database is updated; S34, calculate the fusion score: ; In the formula, represents the fusion result; represents the knowledge structure confidence; represents the multi-modal enhanced representation semantic similarity between the knowledge ; and represents the historical usage frequency of the knowledge; And will Descending order, take the first five results as enhanced context ; S35, judge whether to meet , denotes the confidence threshold; if yes, mark as low confidence and delete; otherwise, keep.

5. The AI digital operation and maintenance method based on LLM-RAG fusion according to claim 4, characterized in that: Step S4 Specifically includes the following steps: S41, based on the enhanced context set output in S3, combine the environmental configuration information with the neural symbolic LLM model to generate an initial solution adapted to multiple environments : ； In the formula, represents an environmental configuration prompt word; The generated initial scheme Symbolic execution is performed to verify the feasibility of the execution path. ； In the formulae, denotes; denotes; If the verification passes, the initial solution is retained Otherwise, feedback to the neural symbolic LLM model is regenerated until the verification passes. S42, the initial solution is validated inputting the Code Llama model, generating test cases, validating the initial solution while calculating coverage : ； In the formula, represents the number of operation and maintenance scheme execution paths actually covered by the test case; represents the total number of execution paths of the operation and maintenance scheme actually covered by the test case; Verify if the conditions are met , represents the test coverage threshold; if yes, execute the scheme optimization logic and calculate whether the optimized scheme meets the coverage verification conditions until it passes the verification, output the scheme that meets the verification ; S43, generating an access script based on the interface parameters to obtain an executable operation and maintenance scheme , according to the interface parameters ; S44, simulate the execution scheme in the sandbox, verify the execution effect and compatibility, and generate a command execution simulation report.

6. The AI digital operation and maintenance method based on LLM-RAG fusion according to claim 5, characterized in that: The command optimization logic of step S42 has the following specific steps: S421, based on the test cases and symbolic execution results generated by the Code Llama model, locate the execution paths not covered by the command, and combine business importance and path risk ranking to calculate the priority score of the uncovered paths: ； wherein, represents the priority score of the th uncovered path; , and respectively represent the path risk weight, the service relevance weight, and the path execution frequency weight; represents the risk level of the th path; represents the relevance of the th path to the core service; represents the historical execution frequency of the th path; S422, sort the priority scores of the uncovered paths in descending order, and optimize the command according to the sorting results as follows: Parameter verification logic supplement: for parameter error uncovered paths, perform parameter legality verification; Exception capture and degradation processing: for resource depletion and insufficient permission paths, add exception capture logic and degradation scheme; Multi-environment adaptation logic enhancement: for cross-environment adaptation failure paths, call environment configuration information to generate conditional branch logic; S423, verify the optimized command using the neural symbol rule library; S424, generate supplementary test cases using the Code Llama model, simulate execution in combination with a sandbox environment, recalculate test coverage until the test coverage threshold is met .

7. The AI digital operation and maintenance method based on LLM-RAG fusion according to claim 5, characterized in that: Step S5 specifically includes the following steps: S51, STRIDE threat modeling evaluation: for executable operation and maintenance scheme , check the threat of each scheme step in the six dimensions of spoofing, tampering, denial, information disclosure, denial of service, and privilege escalation using the STRIDE threat model, and calculate the dynamic threat level : ； In the formula, represents a base threat level; represents a business importance weight; S52, three-level security verification: Syntax checking: use a syntax parser to verify the correctness of the command format. When any syntax error is detected, mark the error command and the specific error type, and feed back the marking information to the neural symbol LLM model to trigger regeneration until the syntax checking is passed: Permission check: query command's permission level matches current user's permission level and when the permission does not match, a permission escalation request or command adjustment process is triggered, wherein the match degree is calculated as follows: ； In the formula, represents the permission set required to execute the command in ; represents the actual permission set of the execution subject; represents the permission coverage weight; represents the system total permission set; Vulnerability check: match vulnerability feature library , detect hidden vulnerabilities after command execution, calculate vulnerability risk score , and determine whether to meet , , the vulnerability risk score threshold, if yes, complete the vulnerability check, otherwise, generate a rollback plan Generate backup data, where the vulnerability risk score The calculation formula is as follows: ； In the formula, represents the risk weight corresponding to the first vulnerability in the CWE vulnerability feature library; represents the semantic similarity between the operation and maintenance command and the feature vector of the first vulnerability; represents the semantic similarity between the operation and maintenance command S53, simulate the scheme checked through by the step S52 and the rollback scheme in the sandbox environment, verify the execution effect and the rollback feasibility, and output the operation and maintenance scheme of the security verification pass when the simulation pass rate is ≥99% .

8. The AI digital operation and maintenance method based on LLM-RAG fusion according to claim 7, characterized in that: Step S6 specifically includes the following steps: S61, execute the operation and maintenance scheme transform the execution result of the artificial feedback into a problem-cause-solution feedback triple; S62, add the feedback triplets to the operation and maintenance knowledge graph, update the vector database, and update the knowledge weight based on the execution success rate: ； In the formula, represents the updated knowledge weight; and respectively represent a reward coefficient and a penalty coefficient; represents an execution success mark of the operation and maintenance scheme; represents an execution failure mark of the operation and maintenance scheme; S63, adjust the weight of the neural symbol LLM model using LoRA incrementally: ； wherein, denotes the incrementally adjusted neural symbolic LLM model weights; and denotes the incrementally low-rank output and input matrices; denotes the weight increment for the symbolic rule adaptation layer. S64, take the intent recognition accuracy, knowledge retrieval relevance, and fault repair time as evaluation indicators to evaluate the evolution results, and compare them with historical data to generate an effect improvement report.

Images