Information display method and device, equipment and medium

Abstract

The embodiment of the invention relates to an information display method and device, equipment and a medium, and the method comprises the steps: obtaining input information, and determining a planning task according to the input information; in the process of analyzing the input information by using the alarm analysis model, an analysis link diagram corresponding to analysis process information is aggregated and displayed according to the planning task, and the key nodes are highlighted by the analysis link diagram; displaying a target confirmation card corresponding to a target interaction node in response to display of the target interaction node in the analysis link diagram; and in response to a selection operation of a user on a target option in the target confirmation card, continuing the analysis process based on the target option until an end node of the analysis link diagram is displayed according to output information of the alarm analysis model. According to the method, the analysis process information planning task of the model is subjected to aggregation visual display, and the reasoning logic can be quickly understood when the analysis process is relatively long, so that a user can quickly know key nodes, and the reasoning efficiency and the reasoning effect are effectively improved.

Description

Technical Field

[0001] This disclosure relates to the field of computer technology, and in particular to an information display method, apparatus, device, and medium. Background Technology

[0002] In security operations scenarios, models can automatically analyze and handle alarms. The model's thought process can be presented in text form, but the content is lengthy and the logic is difficult to understand immediately. Related technologies can simplify the presentation of the model's thought process using diagrams, but when the thought process is long, the diagrams become complex, leading to poor readability and still failing to meet users' needs for quick understanding of the logic. Summary of the Invention

[0003] To address the aforementioned technical problems, this disclosure provides an information display method, apparatus, device, and medium.

[0004] This disclosure provides an information display method, the method comprising: Obtain input information and determine the planning task based on the input information; During the analysis of input information using the alarm analysis model, the analysis link diagram corresponding to the analysis process information is aggregated and displayed according to the planned task, wherein the analysis link diagram highlights key nodes; In response to the display of the target interaction node in the analysis link diagram, the target confirmation card corresponding to the target interaction node is displayed; In response to the user's selection of a target option in the target confirmation card, the analysis process continues based on the target option until the end node of the analysis link diagram is displayed according to the output information of the alarm analysis model.

[0005] This disclosure also provides an information display device, the device comprising: The acquisition module is used to acquire input information and determine the planning task based on the input information; The link module is used to aggregate and display the analysis link diagram corresponding to the analysis process information according to the planned task during the analysis of input information using the alarm analysis model. The analysis link diagram highlights key nodes. The display module is used to respond to the display of target interaction nodes in the analysis link diagram and display the target confirmation card corresponding to the target interaction node; The operation module is used to respond to the user's selection of a target option in the target confirmation card, and continue the analysis process based on the target option until the end node of the analysis link diagram is displayed according to the output information of the alarm analysis model.

[0006] This disclosure also provides an electronic device, the electronic device comprising: a processor; a memory for storing executable instructions of the processor; the processor being configured to read the executable instructions from the memory and execute the executable instructions to implement the information display method provided in this disclosure.

[0007] This disclosure also provides a computer-readable storage medium storing a computer program for executing the information display method provided in this disclosure.

[0008] Compared with the prior art, the technical solution provided in this disclosure has the following advantages: The information display scheme provided in this disclosure acquires input information and determines the planning task based on the input information; during the analysis of the input information using the alarm analysis model, the analysis link diagram corresponding to the analysis process information is aggregated and displayed according to the planning task, wherein the analysis link diagram highlights key nodes; in response to the display of target interaction nodes in the analysis link diagram, the target confirmation card corresponding to the target interaction node is displayed; in response to the user's selection operation of the target option in the target confirmation card, the analysis process continues based on the target option until the end node of the analysis link diagram is displayed according to the output information of the alarm analysis model. By adopting the above technical solution, the planning task is first determined based on the user's input information. During the analysis of the input information by the alarm analysis model, the analysis process information corresponding to the analysis link diagram is aggregated and displayed according to the planning task. The analysis process information of the model is visualized through the analysis link diagram and aggregated according to the planning task. Even when the analysis process is long, the reasoning logic can be quickly understood, and key nodes are highlighted so that users can quickly understand the key nodes. Furthermore, when the target interaction node is displayed, the corresponding target confirmation card is displayed. Based on the user's selection of target options in the target confirmation card, the analysis process continues until the analysis is completed. This realizes the goal of guiding the user to participate in the selection of some content during the display of the analysis link diagram, effectively improving the reasoning efficiency and reasoning effect. Attached Figure Description

[0009] The above and other features, advantages, and aspects of the embodiments of this disclosure will become more apparent from the accompanying drawings and the following detailed description. Throughout the drawings, the same or similar reference numerals denote the same or similar elements. It should be understood that the drawings are schematic, and the originals and elements are not necessarily drawn to scale.

[0010] Figure 1 A flowchart illustrating an information display method provided in an embodiment of this disclosure; Figure 2 A schematic diagram of a first model page provided for an embodiment of this disclosure; Figure 3A schematic diagram of a second model page provided in an embodiment of this disclosure; Figure 4 A schematic diagram of a third model page provided in an embodiment of this disclosure; Figure 5 A schematic diagram of the fourth model page provided in an embodiment of this disclosure; Figure 6 A schematic diagram of the fifth model page provided in an embodiment of this disclosure; Figure 7 A schematic diagram of the sixth model page provided in an embodiment of this disclosure; Figure 8 A schematic diagram of the seventh model page provided in an embodiment of this disclosure; Figure 9 A schematic diagram of the eighth model page provided in an embodiment of this disclosure; Figure 10 A schematic diagram of the ninth model page provided in an embodiment of this disclosure; Figure 11 This is a schematic diagram of the structure of an information display device provided in an embodiment of the present disclosure; Figure 12 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this disclosure. Detailed Implementation

[0011] Embodiments of this disclosure will now be described in more detail with reference to the accompanying drawings. While some embodiments of this disclosure are shown in the drawings, it should be understood that this disclosure can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of this disclosure. It should be understood that the accompanying drawings and embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of protection of this disclosure.

[0012] It should be understood that the steps described in the method embodiments of this disclosure may be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of this disclosure is not limited in this respect.

[0013] The term "comprising" and its variations as used herein are open-ended inclusions, meaning "including but not limited to". The term "based on" means "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". Definitions of other terms will be given in the description below.

[0014] It should be noted that the concepts of "first" and "second" mentioned in this disclosure are used only to distinguish different devices, modules or units, and are not used to limit the order of functions performed by these devices, modules or units or their interdependencies.

[0015] It should be noted that the terms "a" and "a plurality of" used in this disclosure are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".

[0016] The names of messages or information exchanged between multiple devices in the embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of such messages or information.

[0017] Most users lack basic trust in models, and are unsure how the model arrives at its conclusions or what its analysis process entails. Therefore, they need to make the model's thought process transparent to build trust. Currently, most of these thought processes are presented in text form, which is lengthy and difficult to understand immediately. In related technologies, the thought process of a model can be simplified by presenting it in the form of diagrams. However, when the thought process is long, the diagrams are also complex and lead to poor readability, which still cannot meet users' demand for quick understanding of the logic.

[0018] To address the aforementioned problems, this disclosure provides an information display method, which will be described below with reference to specific embodiments.

[0019] Figure 1 This is a flowchart illustrating an information display method provided in an embodiment of this disclosure. The method can be executed by an information display device, which can be implemented using software and / or hardware, and is generally integrated into an electronic device. Figure 1 As shown, the method includes: Step 101: Obtain input information and determine the planning task based on the input information.

[0020] The information display method provided in this disclosure can be applied to security tools. These security tools can be data processing tools based on analysis models. The analysis model in this disclosure can be an alarm analysis model, which can be a pre-trained large model. Through the alarm analysis model, functions such as automatic alarm analysis and alarm handling can be quickly realized based on the user's natural language, effectively improving the efficiency and accuracy of alarm handling.

[0021] Input information can be information obtained in response to user input operations. This input information can describe the alarm analysis requirements that the user needs to achieve. For example, the input information could be "help me analyze whether a host has been attacked." Planned tasks can be suggestions for execution steps generated by parsing and processing the input information. These tasks can be generated by calling task planning tools or utilizing alarm analysis models. There can be multiple planned tasks. Planned tasks instruct the alarm analysis model on the next steps and can be dynamically changed during execution. Dynamic changes refer to generating new planned tasks or adjusting the execution order of multiple planned tasks. Task planning tools can be tools that perform goal setting, task breakdown, task sequencing, and progress tracking based on an understanding of the input information.

[0022] Specifically, after obtaining the user's input information, the information display device can call the task planning tool to generate multiple planning tasks and display these multiple planning tasks so that the user can understand the planning of the subsequent model analysis.

[0023] For example, Figure 2 A schematic diagram of the first model page provided in an embodiment of this disclosure, as shown below. Figure 2 As shown in the figure, the first model page 200 is displayed. This first model page 200 generates 5 planning tasks based on the input information, which are shown in area 201 of the figure. The figure is only an example.

[0024] Step 102: During the analysis of input information using the alarm analysis model, the analysis link diagram corresponding to the analysis process information is aggregated and displayed according to the planned tasks. The analysis link diagram highlights key nodes.

[0025] The alarm analysis model can be a model that automatically analyzes and handles alarms based on the user's natural language description. For example, it can analyze whether a website has been attacked, simplifying the user's alarm analysis costs and effectively improving the efficiency and accuracy of alarm handling. Analysis process information can include the alarm analysis model's thought process when processing input information, tool usage records, and generated outputs, reflecting the complete analysis process. The analysis link diagram can be a reasoning link diagram constructed by building corresponding nodes according to the execution of planned tasks and the execution of multiple sub-tasks included in the planned tasks. The analysis link diagram is continuously built and displayed as the analysis process information is continuously presented. When a planned task or a sub-task of a planned task is completed, the corresponding node can be generated and displayed, and the nodes are aggregated and displayed according to the planning task dimension. In this embodiment, the analysis link diagram uses a tree structure as an example. A key node can be a node in the analysis link diagram where alarm evidence is detected during the analysis process. Key nodes can include the result node corresponding to the planned task and the sub-nodes corresponding to the sub-tasks of the planned task. When a sub-node is a key node, the result node containing that sub-node is also a key node. Highlighting can be a special display method that uses a different style from other nodes to distinguish them, allowing users to see them quickly.

[0026] Specifically, the information display device can input information into the alarm analysis model, and use the alarm analysis model to analyze and process the input information. The processing can execute multiple planning tasks in sequence. When each planning task is completed, the next planning task to be executed is dynamically determined or a new planning task is generated. During the execution of the planning task, the analysis process information is continuously displayed. The corresponding analysis link diagram is generated and displayed according to the planning task. The analysis link diagram is continuously updated, and when a node in the analysis link diagram is a key node, it is highlighted.

[0027] In some embodiments, the analysis link diagram corresponding to the analysis process information is aggregated and displayed according to the planning tasks, including: displaying the input information as the root node of the analysis link diagram; displaying each planning task as an analysis node in the next layer of the root node in the analysis link diagram; in response to the output of the analysis process information of the process information of a subtask in a planning task, generating and displaying the sub-node of the subtask in the next layer of the analysis node corresponding to the planning task in the analysis link diagram; in response to the completion of the execution of a planning task in the analysis process information, aggregating at least one sub-node included in the next layer of the analysis node of the planning task into a result node for display; and in response to the completion of the execution of multiple planning tasks, displaying the output information as the end node of the analysis link diagram.

[0028] The root node can be the starting node of the analysis link diagram. Analysis nodes can be nodes generated for planning tasks, or nodes at the next level of the root node. The number of analysis nodes is the same as the number of planning tasks; these analysis nodes are built and displayed following the display of planning tasks. Subtasks can be smaller steps included in a planning task. A planning task can include multiple subtasks, the specific number of which is determined based on the actual situation. Subtask process information can include the subtask's thought process during execution, tool usage records, etc. Child nodes can be nodes generated for subtasks, or nodes at the next level of the analysis node corresponding to the subtask. The number of child nodes is the same as the number of subtasks corresponding to the current planning task; these child nodes are built and displayed following the display of the subtask's process information. Result nodes can be nodes that aggregate and display at least one child node corresponding to at least one subtask included in the planning task. When a planning task is completed, the corresponding at least one child node is hidden and replaced by the result node, which represents at least one child node; that is, the result node includes at least one child node. Output information can be the information obtained after the alarm analysis model has processed the input information, or it can be output after all planning tasks have been executed. The end node can be the last node in the analyzed link graph, and there are no nodes after the end node.

[0029] When the information display device aggregates and displays the analysis link diagram corresponding to the analysis process information according to the planned tasks, it can use the input information as the root node. When multiple planned tasks are generated and displayed in the analysis process information, an analysis node corresponding to each planned task is generated and displayed at the next level below the root node. Then, during the execution of each planned task, when the process information of a subtask of the planned task begins to be displayed, a child node of the subtask is generated and displayed at the next level below the analysis node of the planned task. The child node displays important information in the process information of the subtask. Different styles can be used to display the subtask during execution and after the subtask is completed, allowing users to quickly obtain the execution status through the child nodes. For each planned task, when all subtasks of the planned task are completed, all child nodes corresponding to all subtasks can be aggregated and displayed through a result node. Finally, a result node corresponds to the next level below the analysis node of each planned task. Until all planned tasks are completed and the output information of the alarm analysis model is obtained, an end node representing the output information is constructed, and the analysis link diagram is completed and displayed.

[0030] In the above solution, during the alarm analysis process, the analysis process information is not only visualized through the analysis link diagram, but also the sub-nodes are displayed sequentially according to the planned tasks and aggregated after all sub-nodes are displayed. Users can not only view the specific sub-nodes of each step, but also avoid reading difficulties caused by a large number of nodes when the reasoning process is complex through aggregation, thereby improving the display effect of process information.

[0031] In some embodiments, the information display method may further include: in response to the determination of alarm evidence in the subtask corresponding to the target sub-node, determining that the target sub-node is a key node, highlighting the target sub-node using a first style; in response to the inclusion of the target sub-node in the target result node, determining that the target result node is a key node, highlighting the target result node using a second style and displaying the number of target sub-nodes in the target result node.

[0032] Key nodes can include target sub-nodes and target result nodes. Target sub-nodes can be sub-nodes whose process information confirms the existence of alarm evidence within their sub-tasks. Alarm evidence can be objective data or information related to anomalies or faults found by the alarm analysis model through data analysis, used to prove the rationality of the alarm and determine the source of the problem. Target result nodes can be result nodes that include target sub-nodes. The first style can be a special style set for the target sub-node to distinguish it from other sub-nodes; for example, the first style can be a red background. The second style can be a special style set for the target result node to distinguish it from other result nodes; for example, the second style can be a red box or a bold box. The first style can be the same as or different from the second style, depending on the actual situation.

[0033] When the information display device is showing and analyzing the link diagram, if an alarm is confirmed for a subtask, the corresponding sub-node can be identified as the target sub-node. Since the target sub-node is a critical node, it can be highlighted using the first style, as shown in the example below. Figure 2 In area 202 of the first model page 200, an exemplary analysis chain diagram including five analysis nodes is displayed. Evidence is found for the second child node 203 of the second analysis node, i.e., alarm evidence is found. This second child node 203 is a key node, and it is highlighted using a first style. In the figure, the first style is a bold box and a gray background, which is only an example. When a result node includes at least one target child node, the result node is determined to be a target result node among the key nodes. The target result node is displayed using a second style, and the number of target child nodes is displayed in the target result node, for example, see [link to example]. Figure 2The result node of the first analysis node is not the target result node, while the second child node 203 included in the result node of the second analysis node is the target child node. This result node is the target result node, and when displayed, it can adopt a second style different from other result nodes, such as a thick border (not shown in the figure).

[0034] In the above solution, key nodes for which alarm evidence is detected in the analysis link graph can be distinguished from other nodes by special styles during display, thereby achieving the effect of extracting key nodes and enabling users to quickly obtain key logic and key alarm evidence, thus improving information acquisition efficiency.

[0035] Step 103: During the display of the analysis link diagram, in response to the display of the target interaction node in the analysis link diagram, display the target confirmation card corresponding to the target interaction node.

[0036] In this embodiment, the target interaction node can be a node in the analysis link diagram that requires user collaboration through interactive operations. The target interaction node can include at least one of task-related nodes, authorization-related sub-nodes, and alarm handling sub-nodes. The task-related node can be a node related to a planned task, and may include multiple analysis nodes corresponding to multiple planned tasks. The authorization-related sub-node can be a sub-node where authorization is required during the analysis process of a sub-task; authorization can be for calling a tool or platform, and whether the user authorizes it affects the execution of the sub-task. The alarm handling sub-node can be a sub-node where the analysis of a sub-task discovers an alarm and generates a corresponding handling strategy that requires user intervention; whether the user intervenes does not affect the subsequent analysis process. By setting various types of interaction nodes, the display of confirmation cards can be automatically and quickly triggered, guiding users to participate in the analysis process from multiple dimensions, providing assistance for the analysis, and effectively improving the analysis results. The target confirmation card can be a card set for the target interaction node to guide users to perform interactive operations for collaborative processing. The target confirmation card can include multiple options and prompts. Multiple options are available for the user to choose from, and the prompts indicate the operation that needs to be performed. Different target interaction nodes may correspond to different target confirmation cards.

[0037] Specifically, as the analysis link diagram is constantly updated, the information display device determines whether each displayed node is a target interaction node during the display process of the analysis link diagram. If so, the target interaction node is determined to be displayed, and the target confirmation card corresponding to the target interaction node is displayed.

[0038] Step 104: In response to the user's selection of the target option in the target confirmation card, continue the analysis process based on the target option until the end node of the analysis link diagram is displayed according to the output information of the alarm analysis model.

[0039] The target option can be the option corresponding to the user's selection operation among multiple options in the target confirmation card. The selection operation can be a gesture control operation such as clicking or double-clicking the option in the target confirmation card.

[0040] Specifically, after the information display device displays the target confirmation card corresponding to the target interaction node, when the user selects one of the options, the option can be identified as the target option. The alarm analysis model continues the analysis process based on the target option and updates the analysis link diagram until the output information of the alarm analysis model is obtained, the analysis process is determined to be complete, and the analysis link diagram is updated and displayed to the end node corresponding to the output information.

[0041] For example, Figure 3 A schematic diagram of the second model page provided in this embodiment of the disclosure, as shown below. Figure 3 As shown in the figure, the second model page 300 includes a complete analysis chain diagram, and the summary report is the end node representing the output information of the alarm analysis model. Figure 3 Compared to Figure 2 When the analysis process is completed and the end node is displayed, area 201 can be collapsed to hide the task process information. Each analysis node of the planning task corresponds to a result node at the next level. The second and third result nodes in the figure are target result nodes in the key nodes. The second and third result nodes adopt a second style different from other result nodes. The second style in the figure is a thick border. Each result node in the figure includes the number of target child nodes. The second result node includes 2 target child nodes, the third result node includes 1 target child node, and the number of target child nodes in other result nodes is zero.

[0042] In some embodiments, the target interaction node includes a task association node, and the target confirmation card includes a confirmation option and a change option. In response to the user's selection of the target option in the target confirmation card, the analysis process continues based on the target option, which may include: in response to the user's selection of the confirmation option, continuing the analysis process based on the planned task; or, in response to the user's selection of the change option, displaying multiple alternative analysis models, and in response to the user's triggering operation on the target analysis model among the multiple alternative analysis models, replacing the alarm analysis model with the target analysis model to generate a new planned task for analysis.

[0043] Task-related nodes can be nodes associated with planning tasks, and may include multiple analysis nodes corresponding to multiple planning tasks. Confirmation options allow users to confirm and continue the analysis process based on the integration of multiple currently generated planning tasks using the current alarm analysis model. Change options allow users to modify the current planning task, which can be achieved by changing the alarm analysis model. Alternative analysis models can be pre-set models with functions such as automatic alarm analysis and handling. Unlike the alarm analysis models mentioned above, there can be multiple alternative analysis models, each with a different focus. For example, alternative analysis models may include event investigation models, policy rule optimization models, data collection and analysis models, and report output models, depending on the specific situation. The target analysis model can be the model corresponding to the user-triggered operation among the multiple alternative analysis models; that is, when the user is dissatisfied with the planning task and wants to switch to the target analysis model to generate a new planning task failure analysis process.

[0044] Specifically, when task-related nodes are displayed in the analysis link diagram, the information display device can pause the analysis process and display a target confirmation card including confirmation and change options. If a user selects a confirmation option, it confirms that the user does not need to change the planned task, and the analysis process can continue based on multiple planned tasks. If a user selects a change option, multiple alternative analysis models are displayed. If a user triggers a target analysis model among the alternative models, the alarm analysis model can be replaced with the target analysis model. Input information is then input into the target analysis model to generate a new planned task for analysis. The analysis process simultaneously displays analysis process information and the corresponding analysis link diagram, as described in the above embodiment. By providing confirmation cards with confirmation and change options for the analysis nodes of the planned tasks, users can be guided to confirm the current planned task or change to a new planned task, improving the accuracy of the planned tasks and preventing inaccurate analysis results due to the focus of the planned task deviating from the core objective.

[0045] For example, Figure 4 A schematic diagram of the third model page provided in the embodiments of this disclosure, as shown below. Figure 4As shown in the figure, the third model page 400 is displayed. The analysis chain diagram on the third model page 400 shows the analysis nodes of the planning task. A target confirmation card 401 can be displayed, which includes a confirmation prompt, a confirmation option 403, and a change option 402. When the user selects the confirmation option 403, the analysis process can continue based on the current planning task. The arrow of the change option 402 in the figure indicates the user's selection operation. After that, a card 404 can be displayed, which includes multiple alternative analysis models. The arrow of the third alternative analysis model in the figure indicates that it has been triggered by the user. This third alternative analysis model is the target analysis model. The alarm analysis model is replaced with this target analysis model. Input information is input into the target analysis model to generate a new planning task to analyze the input information.

[0046] In other embodiments, when the target interaction node includes an authorization-related sub-node and the target confirmation card includes an authorization option and an abandonment option, in response to the user's selection of the target option in the target confirmation card, the analysis process continues based on the target option. This may include: in response to the user's selection of the authorization option, displaying an authorization page, obtaining authentication information based on the authorization page, and calling the corresponding tool to continue the analysis process based on the authentication information; or, in response to the user's selection of the abandonment option, displaying analysis failure prompt information for the sub-task corresponding to the authorization-related sub-node, and continuing or stopping the analysis process based on the user's action on the analysis failure prompt information.

[0047] Authorization-related sub-nodes can be sub-nodes that require authorization during the analysis process of a subtask. There can be one or more authorization-related sub-nodes. Authorization operations can involve authorizing the calling tool or platform; whether the user grants authorization affects the execution of the subtask. Authorization options can be options for authorizing the tool or platform required by the subtask corresponding to the authorization-related sub-node. A waiver option can be an option for waiving authorization for the tool or platform required by the subtask corresponding to the authorization-related sub-node, i.e., the user does not agree to the call or the user does not have permission to call. The authorization page can be a page provided to the user to obtain authentication information. Authentication information can be data or credentials used to verify the caller's identity and confirm whether they have the necessary access rights to the tool. When the model carries authentication information, the calling tool is allowed to make the call. Analysis failure messages can be messages sent to authorized sub-nodes when a user relinquishes authorization, indicating that the tool cannot be used for analysis due to lack of authorization. These messages can include a message text, a termination option, and a continuation option. The message text can be customized; for example, it could be "Current node action failed, continue remaining tasks?" The termination option can terminate the current analysis process, while the continuation option can skip the steps in the sub-tasks of the currently authorized sub-node that require authorization to call the tool and continue with subsequent analysis processes.

[0048] Specifically, when the analysis link diagram displays authorized associated sub-nodes, the information display device can pause the analysis process and display a target confirmation card including authorization and abort options. When a user selects an authorization option, an authorization page can be displayed. The authorization page can include tool information and various functional controls corresponding to the sub-tasks of the authorized associated sub-nodes. In response to the user's editing operation on the authorization page, authentication information can be obtained, and based on this authentication information, the corresponding tool can be called to execute the sub-tasks of the authorized associated sub-nodes to continue the analysis process. When a user triggers an abort option, an analysis failure message can be displayed. This analysis failure message can be displayed in the form of a prompt card, and the prompt text in the analysis failure message can also be displayed in the target confirmation card. Subsequently, in response to the user triggering an end option in the prompt card, the current analysis process can be terminated, or in response to the user triggering an continue option in the prompt card, the sub-tasks of the authorized associated sub-nodes can be controlled to skip the step of calling the corresponding tool and continue the analysis process. By setting confirmation cards for authorized sub-nodes, users are guided to authorize or abandon the process when analysis is blocked. Once the user authorizes, the corresponding tool is invoked for analysis, avoiding tool call failures due to lack of authorization and improving the success rate of tool calls. Furthermore, after the user abandons authorization, the analysis can be flexibly continued or stopped based on the user's actions, allowing the user to continue or terminate the analysis process according to the importance of the authorization, further improving the analysis effect.

[0049] For example, Figure 5 A schematic diagram of the fourth model page provided in this embodiment of the disclosure, as shown below. Figure 5 As shown in the figure, the fourth model page 500 is displayed. The third child node of the second analysis node in the analysis link diagram of the fourth model page 500 is the authorization association child node. After the authorization association child node is displayed, the target confirmation card 501 can be displayed. The figure shows the target confirmation card 501 covering the authorization association child node as an example, but it can also be displayed near the authorization association child node. The target confirmation card 501 can include authorization prompt information, authorization option 502, and abandonment option 503. The arrow of authorization option 502 in the figure indicates the user's selection operation. Then, the authorization page 504 can be displayed. The user enters authentication information through the input box in the authorization page 504. In response to the user's trigger operation of the encrypted storage key control in the authorization page 504, the authentication information can be encrypted and stored. In response to the user's trigger operation of the refuse to fill in control in the authorization page 504, the authorization can be abandoned. Then, the same operation as after the user selects the abandonment option 503 is performed. After the user selects the "abandon" option (503) or triggers the "reject fill" control on the authorization page (504), an analysis failure message can be displayed. See [link / reference]. Figure 6 .

[0050] For example, Figure 6 A schematic diagram of the fifth model page provided in this embodiment of the disclosure, as shown below. Figure 6 As shown in the figure, the fifth model page 600 is displayed. The arrow indicating that the "Refuse to Fill in" control on the fifth model page 600 has been triggered is displayed. Then, a prompt card 601 is displayed, which includes an analysis failure message. The analysis failure message includes a prompt text, a termination option 602, and a continue option 603. The target confirmation card 604 also displays part of the prompt text, as shown in the figure, "Action Failed". After the user triggers the termination option 602, the entire analysis process can be terminated. When the user selects the continue option 603, the step of calling the corresponding tool can be skipped and the analysis process can continue.

[0051] In some other embodiments, when the target interaction node includes an alarm handling sub-node and the target confirmation card includes a confirm handling option and a cancel handling option, in response to the user's selection of the target option in the target confirmation card, the analysis process continues based on the target option. This may include: in response to the user's selection of the confirm handling option, handling is performed based on the handling strategy generated by the alarm handling sub-node and then the analysis process continues; or, in response to the user's selection of the cancel handling option, an unhandled prompt message is displayed and the analysis process continues.

[0052] Alarm handling sub-nodes can be sub-tasks that generate corresponding handling strategies for detected alarms, guiding users to take action. There can be one or more alarm handling sub-nodes, and whether the user takes action does not affect subsequent analysis. The "Confirm Handling" option confirms the adoption of the handling strategy generated by the sub-task of the alarm handling sub-node, while the "Cancel Handling" option ignores the handling strategy and does not take action. The handling strategy is a systematic and comprehensive action plan generated by the sub-task of the alarm handling sub-node to resolve the detected alarm. For example, the handling strategy may include restrictions on users, devices, addresses, or prohibition of access to specific resources, services, or systems. The "Unhandled" message indicates that no handling strategy has been adopted for the current alarm handling process.

[0053] Specifically, when the alarm handling sub-node is displayed in the analysis link diagram, the information display device can pause the analysis process and display a target confirmation card including a confirm handling option and a cancel handling option. When a user selects the confirm handling option, the device can obtain the handling strategy generated by the corresponding sub-task of the alarm handling sub-node and use the handling strategy to handle the alarm before continuing the analysis process. Conversely, when a user selects the cancel handling option, an unhandled prompt message can be displayed on the target confirmation card before the analysis process continues. In the above scheme, when an alarm is detected and a corresponding handling strategy is generated during the sub-task processing of a sub-node, the confirmation card guides the user to handle the alarm promptly to quickly resolve the corresponding problem. Users can also ignore alarms based on their importance, improving the flexibility of alarm handling.

[0054] For example, Figure 7 A schematic diagram of the sixth model page provided in this embodiment of the disclosure, as shown below. Figure 7As shown in the diagram, the fifth model page 700 contains an alarm handling sub-node, which is the third child node of the second analysis node in the analysis link diagram. After this alarm handling sub-node is displayed, a target confirmation card 701 can be shown. The diagram shows the target confirmation card 701 displayed over the alarm handling sub-node, but it can also be displayed near the alarm handling sub-node. The target confirmation card 701 can include handling prompts, a confirm handling option 702, and a cancel handling option 703. The arrow indicating the confirm handling option 702 in the diagram shows that the user has made a selection. Afterwards, the handling strategy can be applied. After handling, the authorization prompt in the target confirmation card 701 replaces the unhandled prompt, and the analysis process continues. Conversely, if the user selects the cancel handling option 703, the authorization prompt in the target confirmation card 701 can be replaced with an unhandled prompt, ignoring the handling strategy and continuing the analysis process.

[0055] In some embodiments, the information display method may further include: if no user selection operation is detected within a preset time period during which the target confirmation card is displayed, the preset option corresponding to the target interaction node in the target confirmation card shall be used as the target option.

[0056] The preset time can be the waiting period for user action set for the target confirmation card. The specific setting depends on the actual situation; for example, a preset time of 10 seconds. Preset options can be the default selection automatically chosen when the user does not trigger an action on the target confirmation card, or options that do not require further user action. Different target interaction nodes can have different preset options. For example, when the target interaction node is a task-related node, the preset option is the confirmation option. Figure 4 Confirm option 403; when the target interaction node is an authorized associated child node, the default option is to abandon, such as... Figure 5 Option 503 is abandoned; when the target interaction node is an alarm handling sub-node, the default option is to cancel the handling option, such as... Figure 7Option 703 is cancelled. After displaying the target confirmation card, the information display device starts a timer. If no user selection is detected on the target confirmation card after a preset time, the preset option corresponding to the current target interaction node in the target confirmation card can be directly used as the target option for subsequent analysis. For example, if the preset time is 10 seconds, the confirmation option is used as the target option for task-related nodes, meaning automatic confirmation after 10 seconds; the abandonment option is used as the target option for authorization-related sub-nodes, meaning automatic abandonment after 10 seconds; and the cancellation option is used as the target option for alarm handling sub-nodes, meaning automatic cancellation after 10 seconds. By setting the confirmation card time and preset options, analysis process delays caused by prolonged user inactivity are avoided, implementing a fallback strategy. Even when the user is not active, the analysis process continues based on the default option, improving the robustness of alarm analysis.

[0057] The information display scheme provided in this embodiment acquires input information and determines a planning task based on the input information. During the analysis of the input information using an alarm analysis model, an analysis link diagram corresponding to the analysis process information is aggregated and displayed according to the planning task. The analysis link diagram highlights key nodes. In response to the display of target interaction nodes in the analysis link diagram, a target confirmation card corresponding to the target interaction node is displayed. In response to the user's selection operation of the target option in the target confirmation card, the analysis process continues based on the target option until the end node of the analysis link diagram is displayed according to the output information of the alarm analysis model. By adopting the above technical solution, the planning task is first determined based on the user's input information. During the analysis of the input information by the alarm analysis model, the analysis process information corresponding to the analysis link diagram is aggregated and displayed according to the planning task. The analysis process information of the model is visualized through the analysis link diagram and aggregated according to the planning task. Even when the analysis process is long, the reasoning logic can be quickly understood, and key nodes are highlighted so that users can quickly understand the key nodes. Furthermore, when the target interaction node is displayed, the corresponding target confirmation card is displayed. Based on the user's selection of target options in the target confirmation card, the analysis process continues until the analysis is completed. This realizes the goal of guiding the user to participate in the selection of some content during the display of the analysis link diagram, effectively improving the reasoning efficiency and reasoning effect.

[0058] In some embodiments, the information display method may further include: in response to an expansion operation on a target result node, highlighting the target child nodes included in the target result node using a first style, and displaying the other child nodes included in the target result node, excluding the target child nodes, using a third style.

[0059] The first style can be a special style set for the target child node to distinguish it from other child nodes; for example, the first style could be a red background. The third style can be a display style set for other child nodes besides the target child node, and the first style is different from the third style. During the display of the analysis link diagram or after the complete analysis link diagram display is completed, for the target result node, when a user's expansion operation on the target result node is detected (expansion operation can include gesture control operations such as single click and double click), all child nodes included in the target result node can be displayed to replace the target result node. Specifically, the target child node is highlighted in the first style, while other child nodes are displayed in the third style. For other result nodes besides the target result node, all included child nodes can also be displayed in response to the expansion operation, and all child nodes are displayed in the third style. By supporting the expansion of included child nodes of the aggregated result node as needed, the user's flexible traceability needs are met. Users can expand the aggregated nodes as needed during and at the end of the analysis to view them, and highlight the target child nodes, allowing users to quickly obtain key nodes.

[0060] For example, Figure 8 A schematic diagram of the seventh model page provided in the embodiments of this disclosure, as shown below. Figure 8 As shown in the figure, the seventh model page 800 is displayed. This seventh model page 800 can be in... Figure 3 The second model page 300 displays the complete analysis chain diagram when a user triggers an operation on the second result node 301 of the second analysis node. Since the second result node 301 is the target result node, such as... Figure 8 In region 801, all child nodes included in the second result node 301 are displayed. Since there are two target child nodes, the two target child nodes in the first row are displayed using the first style, which is a gray background in the figure. The three child nodes in the second row are displayed using the third style, which is a white background. Users can not only quickly view all child nodes included in the aggregated result node, but also quickly view the key child nodes that reveal evidence.

[0061] Optionally, the information display method may also include: in response to a trigger operation on the target sub-node, jumping to the process information of the target sub-node for display or extracting the process information of the target sub-node from the analysis process information for display.

[0062] The process information of a target sub-node can be a portion of the process information corresponding to the subtask of the target sub-node that was triggered in the complete analysis process information. During the display of the analysis link diagram, or after the complete analysis link diagram has been displayed, when a user triggers an operation on the target sub-node, the information display device can jump from the currently ongoing analysis process information to the process information of that target sub-node, or extract the process information of that target sub-node from the analysis process information and display it separately. This means that for other sub-nodes besides the target sub-node, the device can respond to the user's trigger operation and display the corresponding process information, allowing the user to quickly trace the thought process of a specific sub-node in the link diagram and thus quickly resolve the corresponding alarm issues.

[0063] For example, Figure 9 A schematic diagram of the eighth model page provided in this embodiment of the disclosure, as shown below. Figure 9 As shown in the figure, the eighth model page 900 is displayed. The arrow of the target child node 901 in the eighth model page 900 indicates that it has been triggered by the user. Afterwards, the process information corresponding to the target child node 901 can be displayed in area 902 for the user to view.

[0064] In some embodiments, the information display method may further include: in response to the display of the target result node, generating a new planning task, and adding a new analysis node corresponding to the new planning task after the analysis node corresponding to the target result node in the analysis link diagram for display.

[0065] New planning tasks can be generated for target result nodes in key nodes to verify alarm evidence of target child nodes included in the target result node. New planning tasks can be generated for each target result node, or only for the target result node with the largest number of target child nodes. The number of new planning tasks can be one or more. New analysis nodes can be nodes generated for new planning tasks and are also nodes at the next level below the root node of the analysis link diagram. During the display of the analysis link diagram, after the target result node is displayed, the information display device can generate corresponding new planning tasks based on the alarm evidence of the target result node. Subsequently, the new planning task is executed, and a new analysis node for the new planning task is generated and added after the analysis node corresponding to the target result node in the analysis link diagram for display. By guiding the generation of new planning tasks and updating the analysis link diagram based on discovered alarm evidence, dynamic updates of planning tasks and inference links are achieved, avoiding the fixation of the model's inference path and ensuring the flexibility of the analysis process and the model's processing effect.

[0066] For example, Figure 10A schematic diagram of the ninth model page provided in this embodiment of the disclosure, as shown below. Figure 10 As shown in the figure, the ninth model page 1000 is displayed. The second result node 1001 of the second analysis node in the ninth model page 1000 is the target result node. When the target result node is displayed, a new planning task can be generated, and then a new analysis node 1002 can be generated after the target result node corresponds to the second analysis node in the analysis link diagram. The figure takes one new analysis node as an example, but multiple nodes can also be generated.

[0067] Figure 11 This is a schematic diagram of the structure of an information display device provided in an embodiment of this disclosure. The device can be implemented by software and / or hardware, and is generally integrated into an electronic device. Figure 11 As shown, the device includes: The acquisition module 1101 is used to acquire input information and determine the planning task based on the input information; Link module 1102 is used to aggregate and display the analysis link diagram corresponding to the analysis process information according to the planned task during the analysis of input information using the alarm analysis model, wherein the analysis link diagram highlights key nodes. The display module 1103 is used to display the target confirmation card corresponding to the target interaction node in response to the display of the target interaction node in the analysis link diagram; The operation module 1104 is used to respond to the user's selection of the target option in the target confirmation card, and continue the analysis process based on the target option until the end node of the analysis link diagram is displayed according to the output information of the alarm analysis model.

[0068] Optionally, the number of planning tasks is multiple, and the link module 1102 is specifically used for: The input information is displayed as the root node of the analysis link graph; Each of the planning tasks is displayed as an analysis node at the next level below the root node in the analysis link diagram; In response to the analysis process information, output process information of a subtask in the planning task, generate a sub-node of the subtask in the next layer of the analysis node corresponding to the planning task in the analysis link diagram, and display the sub-node. In response to the completion of a planning task in the analysis process information, at least one child node in the next layer of the analysis node of the planning task is aggregated into a result node for display. In response to the completion of multiple planning tasks, the output information is displayed as the end node of the analysis link graph.

[0069] Optionally, the device further includes a highlighting module, which is specifically used for: In response to the existence of alarm evidence in the subtask corresponding to the target sub-node, the target sub-node is determined to belong to the key node, and the target sub-node is highlighted using the first style. In response to the inclusion of target child nodes in the target result node, it is determined that the target result node belongs to the key node, and the target result node is highlighted using the second style, and the number of target child nodes is displayed in the target result node.

[0070] Optionally, the device further includes a deployment module, which is specifically used for: In response to the expansion operation of the target result node, the target child node included in the target result node is highlighted using the first style, and the other child nodes included in the target result node besides the target child node are displayed using the third style.

[0071] Optionally, the device further includes a process display module, which is specifically used for: In response to a trigger operation on the target sub-node, the analysis process information is either jumped to the process information of the target sub-node for display or the process information of the target sub-node is extracted from the analysis process information for display.

[0072] Optionally, the device further includes a new module, which is specifically used for: In response to the display of the target result node, a new planning task is generated, and a new analysis node corresponding to the new planning task is added after the analysis node corresponding to the target result node in the analysis link diagram for display.

[0073] Optionally, the target interaction node includes at least one of a task association node, an authorization association sub-node, and an alarm handling sub-node.

[0074] Optionally, when the target interaction node includes a task-related node, and the target confirmation card includes a confirmation option and a change option, the operation module 1104 is specifically used for: In response to the user's selection of the confirmation option, the analysis process continues based on the planned task; Alternatively, in response to the user's selection of the change option, multiple alternative analysis models are displayed, and in response to the user's triggering operation on the target analysis model among the multiple alternative analysis models, the alarm analysis model is replaced with the target analysis model to generate a new planning task for the analysis process.

[0075] Optionally, when the target interaction node includes the authorized associated sub-node, and the target confirmation card includes an authorization option and a cancellation option, the operation module 1104 is specifically used for: In response to the user's selection of the authorization option, an authorization page is displayed, authentication information is obtained based on the authorization page, and the corresponding tool is invoked based on the authentication information to continue the analysis process; Alternatively, in response to the user's selection of the abandon option, the system displays an analysis failure message for the subtask corresponding to the authorized associated sub-node, and continues or stops the analysis process based on the user's action on the analysis failure message.

[0076] Optionally, when the target interaction node includes the alarm handling sub-node, and the target confirmation card includes a confirm handling option and a cancel handling option, the operation module 1104 is specifically used for: In response to the user's selection of the confirmation and handling options, the analysis process continues after handling the situation based on the handling strategy generated by the alarm handling sub-node. Alternatively, in response to the user's selection of the cancel disposal option, an unprocessed prompt message is displayed and the analysis process continues.

[0077] Optionally, the device further includes a backstop module, which is specifically used for: If no user selection operation is detected within the preset time period of the target confirmation card display, the preset option corresponding to the target interaction node in the target confirmation card will be used as the target option.

[0078] The information display device provided in this disclosure can execute the information display method provided in any embodiment of this disclosure, and has the corresponding functional modules and beneficial effects of the method execution.

[0079] This disclosure also provides a computer program product, including a computer program / instruction. When executed by a processor, the computer program / instruction implements the information display method provided in any embodiment of this disclosure, and has the corresponding functional modules and beneficial effects of the execution method.

[0080] Figure 12 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this disclosure.

[0081] The following is a detailed reference. Figure 12The diagram illustrates a structural schematic suitable for implementing the electronic device 1200 in the embodiments of this disclosure. The electronic device 1200 in the embodiments of this disclosure may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, personal digital assistants (PDAs), tablet computers (PADs), portable media players (PMPs), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 12 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments disclosed herein.

[0082] like Figure 12 As shown, the electronic device 1200 may include a processing unit 1201 (e.g., a central processing unit, a graphics processor, etc.) that can perform various appropriate actions and processes according to a program stored in read-only memory (ROM) 1202 or a program loaded from storage device 1208 into random access memory (RAM) 1203. The RAM 1203 also stores various programs and data required for the operation of the electronic device 1200. The processing unit 1201, ROM 1202, and RAM 1203 are interconnected via a bus 1204. An input / output (I / O) interface 1205 is also connected to the bus 1204.

[0083] Typically, the following devices can be connected to I / O interface 1205: input devices 1206 including, for example, a touchscreen, touchpad, keyboard, mouse, camera, microphone, accelerometer, gyroscope, etc.; output devices 1207 including, for example, a liquid crystal display (LCD), speaker, vibrator, etc.; storage devices 1208 including, for example, magnetic tape, hard disk, etc.; and communication devices 1209. Communication device 1209 allows electronic device 1200 to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 12 An electronic device 1200 with various devices is shown; however, it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed alternatively.

[0084] In particular, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication device 1209, or installed from storage device 1208, or installed from ROM 1202. When the computer program is executed by processing device 1201, it performs the functions defined in the information display method of embodiments of this disclosure.

[0085] It should be noted that the computer-readable medium described above in this disclosure can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, a random access memory, a read-only memory, an electrically erasable programmable read-only memory (EPROM), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In this disclosure, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this disclosure, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. The transmitted data signal can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The computer-readable signal medium can also be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wires, optical fibers, radio frequency (RF), etc., or any suitable combination thereof.

[0086] In some implementations, clients and servers can communicate using any currently known or future-developed network protocol, such as Hypertext Transfer Protocol (HTTP), and can interconnect with digital data communication (e.g., communication networks) of any form or medium. Examples of communication networks include Local Area Networks (LANs), Wide Area Networks (WANs), the Internet (e.g., the Internet), and peer-to-peer networks (e.g., ad hoc peer-to-peer networks), as well as any currently known or future-developed networks.

[0087] The aforementioned computer-readable medium may be included in the aforementioned electronic device; or it may exist independently and not assembled into the electronic device.

[0088] The aforementioned computer-readable medium carries one or more programs that, when executed by the electronic device, cause the electronic device to: acquire input information and determine a planned task based on the input information; during the analysis of the input information using an alarm analysis model, aggregate and display an analysis link diagram corresponding to the analysis process information according to the planned task, wherein the analysis link diagram highlights key nodes; during the display of the analysis link diagram, in response to the display of a target interaction node in the analysis link diagram, display a target confirmation card corresponding to the target interaction node; and in response to the user's selection of a target option in the target confirmation card, continue the analysis process based on the target option until the end node of the analysis link diagram is displayed according to the output information of the alarm analysis model.

[0089] Computer program code for performing the operations of this disclosure can be written in one or more programming languages ​​or a combination thereof, including but not limited to object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including local area networks (LANs) or wide area networks (WANs), or it can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0090] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0091] The units described in the embodiments of this disclosure can be implemented in software or hardware. The names of the units are not, in some cases, intended to limit the specific unit.

[0092] The functions described above in this document can be performed at least in part by one or more hardware logic components. For example, exemplary types of hardware logic components that can be used, without limitation, include: Field-Programmable Gate Array (FPGA), Application Specific Integrated Circuit (ASIC), Application Specific Standard Parts (ASSP), System on Chip (SOC), Complex Programmable Logic Device (CPLD), and so on.

[0093] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory, read-only memory, erasable programmable read-only memory, flash memory, optical fiber, portable compact disk read-only memory, optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0094] It is understood that before using the technical solutions disclosed in the various embodiments of this disclosure, users should be informed of the types, scope of use, and usage scenarios of the information involved in this disclosure in an appropriate manner in accordance with relevant laws and regulations, and user authorization should be obtained.

[0095] The above description is merely a preferred embodiment of this disclosure and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of this disclosure is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features disclosed in this disclosure that have similar functions.

[0096] Furthermore, while the operations are described in a specific order, this should not be construed as requiring these operations to be performed in the specific order shown or in a sequential order. In certain environments, multitasking and parallel processing may be advantageous. Similarly, while several specific implementation details are included in the above discussion, these should not be construed as limiting the scope of this disclosure. Certain features described in the context of individual embodiments may also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment may also be implemented individually or in any suitable sub-combination in multiple embodiments.

[0097] Although the subject matter has been described using language specific to structural features and / or methodological logic, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. Rather, the specific features and actions described above are merely illustrative examples of implementing the claims.

Claims

1. An information display method, characterized in that, include: Obtain input information and determine the planning task based on the input information; During the analysis of input information using the alarm analysis model, the analysis link diagram corresponding to the analysis process information is aggregated and displayed according to the planned task, wherein the analysis link diagram highlights key nodes; During the display of the analysis link diagram, in response to the display of the target interaction node in the analysis link diagram, the target confirmation card corresponding to the target interaction node is displayed; In response to the user's selection of a target option in the target confirmation card, the analysis process continues based on the target option until the end node of the analysis link diagram is displayed according to the output information of the alarm analysis model.

2. The method according to claim 1, characterized in that, The number of planning tasks is multiple, and the analysis link diagram corresponding to the analysis process information is aggregated and displayed according to the planning tasks, including: The input information is displayed as the root node of the analysis link graph; Each of the planning tasks is displayed as an analysis node at the next level below the root node in the analysis link diagram; In response to the analysis process information, output process information of a subtask in the planning task, generate a sub-node of the subtask in the next layer of the analysis node corresponding to the planning task in the analysis link diagram, and display the sub-node. In response to the completion of a planning task in the analysis process information, at least one child node in the next layer of the analysis node of the planning task is aggregated into a result node for display. In response to the completion of multiple planning tasks, the output information is displayed as the end node of the analysis link graph.

3. The method according to claim 2, characterized in that, The method further includes: In response to the existence of alarm evidence in the subtask corresponding to the target sub-node, the target sub-node is determined to belong to the key node, and the target sub-node is highlighted using the first style. In response to the inclusion of target child nodes in the target result node, it is determined that the target result node belongs to the key node, and the target result node is highlighted using the second style, and the number of target child nodes is displayed in the target result node.

4. The method according to claim 3, characterized in that, The method further includes: In response to the expansion operation of the target result node, the target child node included in the target result node is highlighted using the first style, and the other child nodes included in the target result node besides the target child node are displayed using the third style.

5. The method according to claim 4, characterized in that, The method further includes: In response to a trigger operation on the target sub-node, the analysis process information is either jumped to the process information of the target sub-node for display or the process information of the target sub-node is extracted from the analysis process information for display.

6. The method according to claim 3, characterized in that, The method further includes: In response to the display of the target result node, a new planning task is generated, and a new analysis node corresponding to the new planning task is added after the analysis node corresponding to the target result node in the analysis link diagram for display.

7. The method according to claim 1, characterized in that, The target interaction node includes at least one of the following: task association node, authorization association sub-node, and alarm handling sub-node.

8. The method according to claim 7, characterized in that, When the target interaction node includes a task-related node, and the target confirmation card includes a confirmation option and a change option, in response to the user's selection of a target option in the target confirmation card, the analysis process continues based on the target option, including: In response to the user's selection of the confirmation option, the analysis process continues based on the planned task; Alternatively, in response to the user's selection of the change option, multiple alternative analysis models are displayed, and in response to the user's triggering operation on the target analysis model among the multiple alternative analysis models, the alarm analysis model is replaced with the target analysis model to generate a new planning task for the analysis process.

9. The method according to claim 7, characterized in that, When the target interaction node includes the authorized associated sub-node, and the target confirmation card includes an authorization option and a cancel option, in response to the user's selection operation of the target option in the target confirmation card, the analysis process continues based on the target option, including: In response to the user's selection of the authorization option, an authorization page is displayed, authentication information is obtained based on the authorization page, and the corresponding tool is invoked based on the authentication information to continue the analysis process; Alternatively, in response to the user's selection of the abandon option, the system displays an analysis failure message for the subtask corresponding to the authorized associated sub-node, and continues or stops the analysis process based on the user's action on the analysis failure message.

10. The method according to claim 7, characterized in that, When the target interaction node includes the alarm handling sub-node, and the target confirmation card includes a confirm handling option and a cancel handling option, in response to the user's selection operation of the target option in the target confirmation card, the analysis process continues based on the target option, including: In response to the user's selection of the confirmation and handling options, the analysis process continues after handling the situation based on the handling strategy generated by the alarm handling sub-node. Alternatively, in response to the user's selection of the cancel disposal option, an unprocessed prompt message is displayed and the analysis process continues.

11. The method according to claim 1, characterized in that, The method further includes: If no user selection operation is detected within the preset time period of the target confirmation card display, the preset option corresponding to the target interaction node in the target confirmation card will be used as the target option.

12. An information display device, characterized in that, include: The acquisition module is used to acquire input information and determine the planning task based on the input information; The link module is used to aggregate and display the analysis link diagram corresponding to the analysis process information according to the planned task during the analysis of input information using the alarm analysis model. The analysis link diagram highlights key nodes. The display module is used to respond to the display of target interaction nodes in the analysis link diagram and display the target confirmation card corresponding to the target interaction node; The operation module is used to respond to the user's selection of a target option in the target confirmation card, and continue the analysis process based on the target option until the end node of the analysis link diagram is displayed according to the output information of the alarm analysis model.

13. An electronic device, characterized in that, The electronic device includes: processor; Memory used to store the processor's executable instructions; The processor is configured to read the executable instructions from the memory and execute the executable instructions to implement the information display method according to any one of claims 1-11.

14. A computer-readable storage medium, characterized in that, The storage medium stores a computer program, which is used to execute the information display method according to any one of claims 1-11.

Images