Virtual machine operating system inspection method, device and equipment based on large model and medium

Abstract

The invention discloses a virtual machine operating system inspection method, device and equipment based on a large model and a medium, and relates to the technical field of system operation and maintaining.The method comprises the steps that a target node of a target virtual machine operating system is continuously monitored through a preset dynamic probe cluster, data processing and time-space alignment operation are executed, and structured data are obtained; constructing an entity relationship network map based on the structured data, and performing anomaly diagnosis when an anomaly is monitored to generate an anomaly processing plan; analyzing the exception handling plan to perform grammar review based on the abstract syntax tree, and after the review is passed, constructing a sandbox verification environment for the production environment of the current operating system to perform effect verification on the exception handling plan; and if the effect verification is passed, executing an exception handling plan in the production environment, updating a preset historical case database after monitoring that the exception is successfully handled, and optimizing the target large model by using a target reinforcement learning algorithm and the historical case database.

Description

Technical Field

[0001] This invention relates to the field of system operation and maintenance technology, and in particular to a method, apparatus, equipment and medium for inspecting virtual machine operating systems based on large models. Background Technology

[0002] With the rapid evolution of cloud computing technology, most enterprises and organizations choose to adopt hybrid cloud architectures, combining the advantages of private and public clouds to achieve a balance between flexibility and cost control. However, due to the existence of hybrid cloud architectures, during system inspections, scripts based on regular expressions can only identify predefined patterns, resulting in limited rule coverage and a high rate of missed detections of new or unprocessed faults. Logs, performance metrics, and configuration data are processed in a scattered manner, lacking cross-source correlation analysis capabilities, leading to severe data silos. In hybrid cloud scenarios, different systems and platforms use completely different monitoring data formats and collection protocols, and the field definitions and storage structures of log systems differ significantly, making it difficult for operations and maintenance personnel to interpret logs and resulting in low response efficiency. Consequently, when facing dynamic load scenarios, false alarms or missed alarms are prone to occur, leading to delayed fault response, insufficient automation, and low inspection efficiency.

[0003] In summary, how to solve the problem of low inspection efficiency caused by slow response, insufficient coverage, and high false alarm rate of traditional inspection methods in complex system environments is a technical problem that urgently needs to be solved. Summary of the Invention

[0004] In view of this, the purpose of this invention is to provide a method, apparatus, device, and medium for inspecting virtual machine operating systems based on a large model, which can solve the problems of low inspection efficiency caused by slow response, insufficient coverage, and high false alarm rate of traditional inspection methods in complex system environments. The specific solution is as follows: Firstly, this application provides a virtual machine operating system inspection method based on a large model, applied to a preset target large model, wherein the target large model is deployed in a target virtual machine operating system; wherein the method includes: A preset dynamic probe cluster is used to continuously monitor the target node of the target virtual machine operating system, so as to identify the protocol of the monitoring data obtained from the target node, and perform corresponding data processing operations based on the identification results, and perform spatiotemporal alignment operations on the processed multi-dimensional data to obtain corresponding structured data; the multi-dimensional data includes log data, performance index data, and configuration change data. Based on the structured data, an entity relationship network graph is constructed. When an anomaly is detected in the target virtual machine operating system, a preset multi-level decision-making mechanism is used to diagnose the anomaly based on the entity relationship network graph and generate a corresponding anomaly handling plan. The exception handling plan is parsed to generate a corresponding abstract syntax tree. The exception handling plan is then subjected to a syntax review based on the abstract syntax tree. After passing the syntax review, a corresponding sandbox verification environment is built for the production environment of the current target virtual machine operating system. The sandbox verification environment is used to verify the effectiveness of the exception handling plan and obtain the corresponding verification results. If the verification result indicates that the anomaly handling plan has passed the effectiveness verification, then the anomaly handling plan is executed in the production environment. After the anomaly is detected to have been successfully handled, the preset historical case database is updated based on this anomaly handling case, and the target large model is optimized using the target reinforcement learning algorithm and the historical case database.

[0005] Optionally, the step of continuously monitoring the target node of the target virtual machine operating system using a preset dynamic probe cluster, performing protocol identification on the monitoring data obtained from the target node, executing corresponding data processing operations based on the identification results, and performing spatiotemporal alignment operations on the processed multi-dimensional data to obtain corresponding structured data, including: The system continuously acquires monitoring data from the target node of the target virtual machine operating system through a preset dynamic probe cluster, and parses the monitoring data based on several parsing templates in a preset protocol fingerprint library to identify the corresponding protocol type. For the monitoring data whose protocol type is the target log protocol type, log parsing is performed to obtain the corresponding log data; for the monitoring data whose protocol type is the target performance indicator collection protocol type, indicator extraction is performed to obtain the corresponding performance indicator data; and for the monitoring data whose protocol type is the target configuration management protocol type, configuration tracking is performed to obtain the corresponding configuration change data. The multi-dimensional data is standardized, and context labels are added to the standardized multi-dimensional data. Time alignment is also performed based on the data timestamps to perform spatiotemporal alignment on the multi-dimensional data, resulting in corresponding structured data. The multi-dimensional data includes the log data, the performance indicator data, and the configuration change data. Correspondingly, the step of parsing the monitoring data based on several parsing templates in a preset protocol fingerprint database to identify the corresponding protocol type also includes: If new monitoring data exists in the monitoring data, a corresponding new parsing template is generated for the new monitoring data, and the new parsing template is used to parse the new monitoring data to obtain the corresponding new protocol type; the new monitoring data is monitoring data that cannot be parsed by the preset protocol fingerprint database. Based on the data parsing results of the newly added parsing template, the newly added parsing template is optimized using a preset machine learning model, and then the newly added parsing template is saved to the preset protocol fingerprint database.

[0006] Optionally, constructing an entity relationship network graph based on the structured data includes: Identify several entities corresponding to the structured data and analyze the structured data to extract the entity relationships between the entities. The entity relationships are transformed into a directed graph structure to construct an entity relationship network graph.

[0007] Optionally, when an anomaly is detected in the target virtual machine operating system, a preset multi-level decision-making mechanism is used to perform anomaly diagnosis based on the entity relationship network graph, and a corresponding anomaly handling plan is generated, including: When an anomaly is detected in the target virtual machine operating system, the preset regular expression rule base is traversed to determine whether there is a target regular expression rule in the preset regular expression rule base that matches the entity relationship network graph, and the corresponding determination result is obtained. If the determination result indicates that the target regular expression rule exists, then the target regular expression rule is used to generate a corresponding anomaly handling plan; if the determination result indicates that the target regular expression rule does not exist, then based on the preset similarity matching technology and the entity relationship network graph, the target historical anomaly handling cases are matched from the preset vectorized case library to obtain the corresponding matching results. If the matching result indicates that the target historical anomaly handling case is matched, then an experience reuse analysis is performed on the target historical anomaly handling case to generate the anomaly handling plan; if the matching result indicates that the target historical anomaly handling case is not matched, then the current anomaly type is determined, and the weights of each dimension of data are determined according to the anomaly type. Based on a preset multimodal attention mechanism and the weights, a weighted comprehensive analysis is performed on several data in the entity relationship network graph to generate the anomaly handling plan.

[0008] Optionally, parsing the exception handling plan to generate a corresponding abstract syntax tree, and performing a syntax review on the exception handling plan based on the abstract syntax tree, includes: The operation commands in the aforementioned exception handling plan are parsed to generate the corresponding abstract syntax tree; The abstract syntax tree is identified and matched using a preset high-risk operation mode rule base. If a target high-risk operation mode is matched, it is determined that the syntax review has failed and the target high-risk operation mode is blocked. If the target high-risk operation mode is not matched, semantic analysis is performed on the abstract syntax tree based on the runtime context, and the syntax review is determined based on the analysis results.

[0009] Optionally, the step of constructing a corresponding sandbox verification environment for the current production environment of the target virtual machine operating system, and using the sandbox verification environment to verify the effectiveness of the exception handling plan and obtain corresponding verification results, includes: Determine the target service process tree related to the exception handling plan, and use a preset process checkpoint tool to create checkpoints for the target service process tree, and freeze the target service process tree in the production environment of the current target virtual machine operating system; Within a preset container or namespace, the root file system of the production environment and a newly created blank writable directory are mounted through a preset stacked file system to build an initial sandbox environment. The process files in the checkpoint are read based on the preset process checkpoint tool to build a corresponding sandbox verification environment for the production environment. The exception handling plan is executed in the sandbox verification environment to obtain the corresponding execution results; If the execution result indicates that the exception handling plan was executed successfully and the exception in the sandbox verification environment was successfully handled, then the verification result of the exception handling plan passing the effect verification is obtained.

[0010] Optionally, the step of updating the preset historical case database based on the current anomaly handling case, and optimizing the target large model using the target reinforcement learning algorithm and the historical case database, includes: The current exception handling cases are structured and converted into case vectors, which are then stored in a preset historical case database. Based on the target reinforcement learning algorithm, the manually corrected schemes in the historical case database are used as positive samples and the original output is used as negative samples to optimize the decision preference of the target large model.

[0011] Secondly, this application provides a virtual machine operating system inspection device based on a large model, applied to a preset target large model, wherein the target large model is deployed in a target virtual machine operating system; wherein the device includes: The spatiotemporal alignment module is used to continuously monitor the target nodes of the target virtual machine operating system using a preset dynamic probe cluster, to identify the protocol of the monitoring data obtained from the target nodes, to perform corresponding data processing operations based on the identification results, and to perform spatiotemporal alignment operations on the processed multi-dimensional data to obtain corresponding structured data; the multi-dimensional data includes log data, performance index data, and configuration change data. An anomaly diagnosis module is used to construct an entity relationship network graph based on the structured data, and when an anomaly is detected in the target virtual machine operating system, it uses a preset multi-level decision-making mechanism to perform anomaly diagnosis based on the entity relationship network graph and generate a corresponding anomaly handling plan. The environment building module is used to parse the exception handling plan to generate a corresponding abstract syntax tree, perform a syntax review on the exception handling plan based on the abstract syntax tree, and after passing the syntax review, build a corresponding sandbox verification environment for the production environment of the current target virtual machine operating system, so as to use the sandbox verification environment to verify the effect of the exception handling plan and obtain the corresponding verification results. The model optimization module is used to execute the anomaly handling plan in the production environment if the verification result indicates that the anomaly handling plan has passed the effectiveness verification, and after detecting that the anomaly has been successfully handled, update the preset historical case database based on the current anomaly handling case, and optimize the target large model using the target reinforcement learning algorithm and the historical case database.

[0012] Thirdly, this application provides an electronic device, comprising: Memory, used to store computer programs; A processor is used to execute the computer program to implement the aforementioned virtual machine operating system inspection method based on a large model.

[0013] Fourthly, this application provides a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned virtual machine operating system inspection method based on a large model.

[0014] In this application, a preset dynamic probe cluster is used to continuously monitor the target node of the target virtual machine operating system. Protocol identification is performed on the monitoring data obtained from the target node, and corresponding data processing operations are executed based on the identification results. Spatiotemporal alignment is also performed on the processed multi-dimensional data to obtain corresponding structured data. The multi-dimensional data includes log data, performance indicator data, and configuration change data. An entity relationship network graph is constructed based on the structured data. When an anomaly is detected in the target virtual machine operating system, a preset multi-level decision-making mechanism is used to diagnose the anomaly based on the entity relationship network graph and generate a corresponding anomaly handling plan. The exception handling plan is parsed to generate a corresponding abstract syntax tree. Based on the abstract syntax tree, the exception handling plan is subjected to syntax review. After passing the syntax review, a corresponding sandbox verification environment is built for the production environment of the current target virtual machine operating system to verify the effectiveness of the exception handling plan and obtain the corresponding verification results. If the verification results indicate that the exception handling plan has passed the effectiveness verification, the exception handling plan is executed in the production environment. After detecting that the exception has been successfully handled, the preset historical case database is updated based on the current exception handling case, and the target large model is optimized using the target reinforcement learning algorithm and the historical case database. As can be seen from the above, this application first uses a preset dynamic probe cluster to continuously monitor the target nodes of the target virtual machine operating system. After acquiring the monitoring data, it first performs protocol identification, and then performs corresponding data processing operations based on the identification results. Subsequently, it performs spatiotemporal alignment on the processed log data, performance index data, configuration change data, and other multi-dimensional data to form structured data. Then, it constructs an entity relationship network graph based on the structured data. When an anomaly is detected in the target virtual machine operating system, it uses a preset multi-level decision-making mechanism and combines the entity relationship network graph to perform anomaly diagnosis and generate a corresponding anomaly handling plan. Then, it parses the anomaly handling plan to generate an abstract syntax tree, and performs a syntax review on the plan through the abstract syntax tree. After the review is passed, a sandbox verification environment is built for the production environment of the target virtual machine operating system. The effect of the plan is verified in this environment and the verification results are obtained. If the verification results show that the plan is passed, the plan is executed in the production environment. After the anomaly is successfully handled, the current anomaly handling case is updated to a preset historical case database. At the same time, the target reinforcement learning algorithm and the historical case database are used to optimize the target large model.In this way, through the above-described process of this application, the continuous monitoring of the dynamic probe cluster and the spatiotemporal alignment of multi-dimensional data ensure the comprehensiveness, accuracy, and consistency of the monitoring data, avoiding diagnostic biases caused by data fragmentation or misalignment. The entity relationship network graph constructed based on structured data can clearly present the relationships between various entities in the system. Combined with a multi-level decision-making mechanism, it can quickly locate the root cause of anomalies, improving the efficiency and accuracy of anomaly diagnosis. The combination of sandbox verification environment construction and syntax review can effectively test the feasibility and security of anomaly handling plans without affecting the stability of the production environment, reducing the risk to the system caused by plan execution failure. The case library update and reinforcement learning algorithm optimization of the target large model after anomaly handling enable the large model to continuously learn from historical cases, improve its system inspection capabilities, and continuously enhance the fault self-healing capability and stability of the target virtual machine operating system. This solves the problems of low inspection efficiency caused by slow response, insufficient coverage, and high false alarm rate of traditional inspection methods in complex system environments. Attached Figure Description

[0015] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0016] Figure 1 This is a flowchart of a virtual machine operating system inspection method based on a large model disclosed in this application; Figure 2 This is a flowchart illustrating the timing of a virtual machine operating system inspection method based on a large model disclosed in this application. Figure 3 This is a schematic diagram of the process sequence for obtaining structured data as disclosed in this application; Figure 4 This is a flowchart illustrating the process sequence of a pre-defined multi-level decision-making mechanism disclosed in this application; Figure 5 This is a sequence diagram of the security verification process for an exception handling plan disclosed in this application. Figure 6 This is a timing diagram of a model self-learning process disclosed in this application; Figure 7 This is a schematic diagram of the structure of a virtual machine operating system inspection device based on a large model disclosed in this application; Figure 8 This is a structural diagram of an electronic device disclosed in this application. Detailed Implementation

[0017] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0018] Due to the hybrid cloud architecture, during system inspections, scripts based on regular expressions can only identify predefined patterns, resulting in limited rule coverage and a high rate of missed detections for new or unprocessed faults. Logs, performance metrics, and configuration data are processed in a fragmented manner, lacking cross-source correlation analysis capabilities, leading to severe data silos. In hybrid cloud scenarios, different systems and platforms use completely different monitoring data formats and collection protocols, and the field definitions and storage structures of log systems differ significantly, making log interpretation difficult for operations and maintenance personnel and resulting in low response efficiency. Consequently, in dynamic load scenarios, false alarms or missed alarms are prone to occur, leading to delayed fault response, insufficient automation, and low inspection efficiency.

[0019] To overcome the aforementioned technical problems, this application provides a virtual machine operating system inspection method based on a large model, which can solve the problems of low inspection efficiency caused by slow response, insufficient coverage, and high false alarm rate of traditional inspection methods in complex system environments.

[0020] See Figure 1 As shown, this embodiment of the invention discloses a virtual machine operating system inspection method based on a large model, applied to a preset target large model, wherein the target large model is deployed in a target virtual machine operating system; wherein, the method includes: Step S11: Continuously monitor the target node of the target virtual machine operating system using a preset dynamic probe cluster, identify the protocol of the monitoring data obtained from the target node, perform corresponding data processing operations based on the identification results, and perform spatiotemporal alignment operations on the processed multi-dimensional data to obtain corresponding structured data; the multi-dimensional data includes log data, performance index data, and configuration change data.

[0021] In this embodiment, a preset dynamic probe cluster is used to continuously monitor the target nodes of the target virtual machine operating system. After acquiring the monitoring data of the target nodes, a preset deep packet inspection engine is first used to identify the protocol of the monitoring data. Then, based on the identification results, specific data processing operations are performed accordingly. Subsequently, the processed log data, performance index data, configuration change data, and other multi-dimensional data are spatiotemporally aligned to finally generate well-structured data. The preset deep packet inspection engine can identify various log formats in real time, such as Syslog (a logging protocol for recording system messages), JSON (a lightweight text data exchange format), and Protobuf (a data exchange format), while being compatible with mainstream monitoring protocols such as Prometheus (a monitoring and alarm system), SNMP (Simple Network Management Protocol), and IPMI (Intelligent Platform Management Interface). The configuration change data includes changes to the cloud server configuration. Figure 2 The diagram shown is a flowchart of a virtual machine operating system inspection method based on a large model provided in this application.

[0022] Specifically, such as Figure 3The diagram illustrates the sequence of a structured data acquisition process provided in this application. A preset dynamic probe cluster continuously acquires monitoring data from the target node of the target virtual machine operating system. Based on several parsing templates in a preset protocol fingerprint library, the monitoring data is parsed to identify the corresponding protocol type. For monitoring data with the target log protocol type, log parsing is performed to obtain the corresponding log data. For monitoring data with the target performance indicator acquisition protocol type, indicator extraction is performed to obtain the corresponding performance indicator data. For monitoring data with the target configuration management protocol type, configuration tracking is performed to obtain the corresponding configuration change data. Multi-dimensional data is standardized, and context labels are added to the standardized multi-dimensional data. Time alignment is performed based on data timestamps to achieve spatiotemporal alignment of the multi-dimensional data, resulting in the corresponding structured data. The multi-dimensional data includes the log data, the performance indicator data, and the configuration change data. In other words, firstly, monitoring data of the target node is continuously acquired through a preset dynamic probe cluster. Then, the monitoring data is parsed based on multiple parsing templates in a preset protocol fingerprint library to identify the protocol type corresponding to the data. Subsequently, the data is classified and processed according to the protocol type: monitoring data of the target log protocol type is parsed to obtain log data; monitoring data of the target performance metric collection protocol type is extracted to obtain performance metric data; and monitoring data of the target configuration management protocol type is tracked to obtain configuration change data. Next, the acquired multi-dimensional data is standardized, context labels are added to the standardized multi-dimensional data, and time alignment is performed based on the data timestamp to complete the spatiotemporal alignment of the multi-dimensional data, ultimately obtaining structured data.

[0023] It should be noted that the processing flow for parsing the monitoring data based on several parsing templates in the preset protocol fingerprint database is as follows: If new monitoring data exists in the monitoring data, a corresponding new parsing template is generated for the new monitoring data, and the new parsing template is used to parse the new monitoring data to obtain the corresponding new protocol type; the new monitoring data is monitoring data that cannot be parsed by the preset protocol fingerprint database; based on the data parsing result of the new parsing template, the new parsing template is optimized using a preset machine learning model, and the new parsing template is saved to the preset protocol fingerprint database. In other words, this embodiment adopts a dynamic update mechanism for the protocol fingerprint database. When there is new monitoring data in the monitoring data that cannot be parsed by the preset protocol fingerprint database, that is, data with a new log format, a corresponding new parsing template is automatically generated for the new monitoring data. The new parsing template is used to parse the new monitoring data to determine its corresponding new protocol type. Then, based on the actual data parsing results of the new monitoring data using the new parsing template, the new parsing template is continuously optimized with the help of a preset machine learning model to improve its parsing accuracy and adaptability. Finally, the optimized new parsing template is saved to the preset protocol fingerprint database to complete the database update. In this way, this embodiment can capture the operational status of target nodes in real time through continuous monitoring of the dynamic probe cluster, avoiding the loss of key information due to monitoring interruption and ensuring the real-time and continuous nature of monitoring data. Based on the protocol fingerprint database, it identifies and classifies protocol types using parsing templates, allowing for targeted parsing and extraction of monitoring data, preventing data processing deviations caused by protocol incompatibility. Standardization and context labeling of multi-dimensional data eliminate data format differences and information ambiguity, making the data easier to understand and analyze. Time-stamp-based spatiotemporal alignment eliminates differences in time and space between different types of data, avoiding data fragmentation, improving data analysis efficiency, and more accurately uncovering potential relationships between data. New parsing templates are generated and optimized for new types of monitoring data, ensuring the comprehensiveness of monitoring data collection and parsing, and avoiding monitoring blind spots caused by the inability to parse new data. Using machine learning models to optimize templates based on actual parsing results continuously corrects the template parsing logic, improving its parsing accuracy for new protocol data and reducing parsing errors. Storing the optimized templates in the protocol fingerprint database enables dynamic iteration of protocol parsing capabilities, eliminating the need for repeated development and improving the adaptability and scalability of the monitoring system.

[0024] Step S12: Construct an entity relationship network graph based on the structured data, and when an anomaly is detected in the target virtual machine operating system, use a preset multi-level decision-making mechanism to perform anomaly diagnosis based on the entity relationship network graph and generate a corresponding anomaly handling plan.

[0025] In this embodiment, firstly, based on the structured data, an entity relationship network graph (such as a topology mapping of processes → resources → configurations) is constructed to clearly represent the relationships between elements within the system. When an anomaly is detected in the target virtual machine operating system, a preset multi-level decision-making mechanism is activated. Based on the relationship logic of each entity in the entity relationship network graph, anomaly diagnosis of the system is carried out, and finally, a targeted anomaly handling plan is generated. The multi-level decision-making mechanism is a three-level progressive analysis architecture, including a rule layer, a retrieval layer, and an analysis layer.

[0026] It should be noted that the processing flow for constructing an entity relationship network graph based on the structured data is as follows: First, identify several entities corresponding to the structured data and analyze the structured data to extract the entity relationships between these entities; then, transform the entity relationships into a directed graph structure to construct the entity relationship network graph. That is, firstly, identify several entities corresponding to the structured data, such as processes, resources, configuration items, and log events in the target virtual machine operating system; then, conduct in-depth analysis of the structured data to mine and extract the relationships between these entities, such as the relationship between processes and CPU resource usage, and the relationship between configuration item changes and log event triggering; finally, transform the extracted entity relationships into a directed graph structure to construct a complete entity relationship network graph, enabling the system to identify hidden fault associations that traditional methods cannot discover.

[0027] It should be further pointed out that, such as Figure 4The diagram shown is a flowchart illustrating a pre-defined multi-level decision-making mechanism provided in this application. The anomaly diagnosis process when an anomaly is detected in the target virtual machine operating system is as follows: When an anomaly is detected in the target virtual machine operating system, a preset regular expression rule library is traversed to determine whether there is a target regular expression rule in the preset regular expression rule library that matches the entity relationship network graph, and a corresponding determination result is obtained; if the determination result indicates that the target regular expression rule exists, a corresponding anomaly handling plan is generated using the target regular expression rule; if the determination result indicates that the target regular expression rule does not exist, a target historical anomaly handling case is matched from a preset vectorized case library based on a preset similarity matching technology and the entity relationship network graph, and a corresponding matching result is obtained; if the matching result indicates that the target historical anomaly handling case is matched, an experience reuse analysis is performed on the target historical anomaly handling case to generate the anomaly handling plan; if the matching result indicates that the target historical anomaly handling case is not matched, the current anomaly type is determined, and the weights of each dimension of data are determined according to the anomaly type, so that a weighted comprehensive analysis is performed on several data in the entity relationship network graph based on a preset multimodal attention mechanism and the weights to generate the anomaly handling plan. The preset regular expression rule base includes known and verified fault rules. That is, when an anomaly is detected in the target virtual machine operating system, the rule layer acts as the first line of defense, traversing the preset regular expression rule base to determine if a target regular expression rule matching the entity relationship network graph exists. If it does, an anomaly handling plan is directly generated using the target regular expression rule; if it does not, it indicates an anomaly not covered by the rule base, and the retrieval layer is automatically activated. Based on preset similarity matching technology and combined with the entity relationship network graph, it matches the target's historical anomaly handling cases from the preset vectorized case base—that is, the most relevant ones. Three historical solutions are used to obtain matching results. If a match is found with the target historical anomaly handling case, the anomaly handling plan is generated by performing experience reuse analysis on the case. If no match is found, it indicates that an extremely complex unknown fault has been encountered. The analysis layer initiates multimodal fusion analysis to first determine the current anomaly type, then set weights for various dimensions of data such as log text, performance indicator curves, and configuration change records according to the anomaly type, and finally, with the help of a preset multimodal attention mechanism and the weights, a weighted comprehensive analysis is performed on several data in the entity relationship network graph to generate the anomaly handling plan.In this way, this embodiment accurately identifies entities and extracts relationships from structured data. Based on this, it transforms entity relationships into a directed graph structure and then constructs an entity relationship network graph. This fully utilizes the regularity and correlation of structured data, transforming scattered system operation data into a visualized and logically structured network of relationships. This provides an intuitive and comprehensive analytical basis for anomaly diagnosis, helping to quickly trace related entities, locate the root cause of problems, and improve the efficiency of management and troubleshooting of the target virtual machine operating system. The preset multi-level decision-making mechanism, combined with the graph, performs diagnosis by prioritizing the rapid matching of known anomaly scenarios through regular expression rules, ensuring that common anomalies can be responded to efficiently and reducing processing time. When there are no matching rules, historical case experience is reused to avoid redundant development of contingency plans and improve processing efficiency. For new anomaly types, a multimodal attention mechanism combined with anomaly type weighted analysis data is used to accurately focus on key information, ensuring that the generated contingency plan fits the essence of the anomaly. This not only guarantees the efficiency of anomaly handling but also improves the adaptability and reliability of the contingency plan. The anomaly handling contingency plan generated based on accurate diagnosis can avoid the contingency plan being out of touch with the actual problem and reduce the impact of anomalies on the continuity of virtual machine operating system services.

[0028] Step S13: Parse the exception handling plan to generate a corresponding abstract syntax tree. Perform a syntax review on the exception handling plan based on the abstract syntax tree. After passing the syntax review, build a corresponding sandbox verification environment for the production environment of the current target virtual machine operating system. Use the sandbox verification environment to verify the effect of the exception handling plan and obtain the corresponding verification results.

[0029] In this embodiment, the exception handling plan is first parsed and transformed into a structured abstract syntax tree. Then, based on this abstract syntax tree, the plan undergoes a syntax review to ensure that it is free of grammatical errors and logical contradictions. After the plan passes the syntax review, a corresponding sandbox verification environment is built for the current production environment of the target virtual machine operating system. Finally, the exception handling plan is executed in the sandbox verification environment to verify its effectiveness and obtain the corresponding verification results. Figure 5 The diagram shown is a sequence diagram of the security verification process for an exception handling plan provided in this application.

[0030] It should be noted that the syntax review process for the exception handling plan is as follows: The operation commands in the exception handling plan are parsed to generate a corresponding abstract syntax tree; the abstract syntax tree is then identified and matched using a preset high-risk operation mode rule base. If a target high-risk operation mode is matched, the syntax review is deemed unsuccessful, and the target high-risk operation mode is blocked; if the target high-risk operation mode is not matched, semantic analysis is performed on the abstract syntax tree based on the runtime context to determine whether the syntax review has passed based on the analysis results. That is, firstly, the operation commands in the exception handling plan are parsed to generate a corresponding abstract syntax tree; then, the abstract syntax tree is identified and matched using a preset high-risk operation mode rule base. If a match is found, such as "rm -rf", the syntax review is deemed unsuccessful, and the target high-risk operation mode is blocked. If the target high-risk operation mode is "{EMPTY_VAR}", the contingency plan is determined to have failed the syntax review, and the target high-risk operation mode is blocked; if no high-risk operation mode is matched, semantic analysis is performed on the abstract syntax tree in combination with the runtime context, and the contingency plan is determined to have passed the syntax review based on the analysis results.

[0031] It should be further noted that the process of constructing the sandbox verification environment and verifying the effectiveness of the exception handling plan is as follows: The target service process tree related to the exception handling plan is determined, and a checkpoint is created on the target service process tree using a preset process checkpoint tool, freezing the target service process tree in the production environment of the current target virtual machine operating system; within a preset container or namespace, the root file system of the production environment and a newly created blank writable directory are mounted using a preset stacked file system to construct an initial sandbox environment, and the process files in the checkpoint are read based on the preset process checkpoint tool to construct a corresponding sandbox verification environment for the production environment; the exception handling plan is executed in the sandbox verification environment to obtain the corresponding execution result; if the execution result indicates that the exception handling plan is executed successfully and the exception in the sandbox verification environment is successfully handled, then the verification result that the exception handling plan has passed the effectiveness verification is obtained. That is, firstly, the target service process tree related to the exception handling plan is determined. Then, a checkpoint is created for the target service process tree using a preset process checkpointing tool, such as CRIU (a user-space level process checkpointing and recovery tool), and the target service process tree currently running in the production environment of the target virtual machine operating system is frozen in real time. Next, in a preset container or namespace, the root file system of the production environment and a newly created blank writable directory are mounted using the copy-on-write technology of a preset stacked file system, such as OverlayFS (a stacked file system), to build an initial sandbox environment. Then, the process files in the checkpoint are read using the preset process checkpointing tool, thereby constructing a sandbox verification environment that is highly consistent with the production environment. Subsequently, the exception handling plan is executed in the sandbox verification environment, and the execution result is obtained. If the execution result shows that the plan is executed successfully and the exception in the sandbox verification environment is successfully resolved, then the exception handling plan is determined to have passed the effect verification. In this way, this embodiment uses an abstract syntax tree for syntax review, which can accurately identify hidden syntax errors or logical vulnerabilities in the contingency plan, avoiding execution failure due to syntax problems in the contingency plan; the matching step of the pre-set high-risk operation mode rule base can quickly identify and intercept high-risk operations that may endanger the system, ensuring system security; combined with semantic analysis of runtime context, it can avoid semantic contradictions that may be overlooked by relying solely on syntax review, improving the comprehensiveness and accuracy of the review; by creating a target service process tree checkpoint and freezing the production environment process, it can accurately replicate the process state related to the contingency plan, while avoiding interference from the production environment process running on the sandbox construction; the construction of the sandbox verification environment achieves complete isolation between the contingency plan verification and the production environment, making the contingency plan execution effect closer to the actual production scenario, avoiding the distortion of verification results due to environmental differences; verification is only judged as passed when the contingency plan is successfully executed and the exception is resolved, which greatly reduces the risk of directly executing the contingency plan in the production environment and ensures the stable operation of the target virtual machine operating system in the production environment.

[0032] Step S14: If the verification result indicates that the anomaly handling plan has passed the effectiveness verification, then the anomaly handling plan is executed in the production environment. After the anomaly is detected to have been successfully handled, the preset historical case database is updated based on the current anomaly handling case, and the target large model is optimized using the target reinforcement learning algorithm and the historical case database.

[0033] In this embodiment, when the verification result shows that the anomaly handling plan has passed the effectiveness verification, the plan is actually executed in the production environment. After the system anomaly is detected as successfully handled, the current anomaly handling case is updated to a preset historical case database. Simultaneously, a target reinforcement learning algorithm is used, combined with the updated historical case database, to train and optimize the target large model, improving its performance. The anomaly handling case includes key dimension data such as fault type, root cause analysis, and handling plan; the target reinforcement learning algorithm can be a DPO (Direct Preference Optimization) algorithm. Figure 6 The diagram shown is a timing illustration of a model self-learning process provided in this application. It is understood that if an anomaly is detected during the execution of the anomaly handling plan in the production environment, a preset rollback plan will be automatically triggered to ensure system stability.

[0034] It should be noted that the process of updating the preset historical case database and optimizing the target large model is as follows: The current anomaly handling cases are structured and converted into case vectors, which are then stored in the preset historical case database. Based on a target reinforcement learning algorithm, the manually corrected solutions in the historical case database are used as positive samples, and the original outputs are used as negative samples to optimize the decision preferences of the target large model. That is, firstly, the current anomaly handling cases are structured and converted into case vectors, such as vectors with a structure of type-root cause-solution. Finally, the case vectors are stored in the preset historical case database. Subsequently, based on a target reinforcement learning algorithm, the manually corrected solutions of the cases in the historical case database are used as positive samples, and the original outputs corresponding to the cases are used as negative samples. Through comparative training with positive and negative samples, the decision preferences of the target large model are adjusted and optimized. In this way, this embodiment only executes the contingency plan in the production environment after it has passed sandbox verification, minimizing the impact of contingency plan execution failures on the stability of the production environment and ensuring that anomalies can be resolved under safe and controllable conditions. The cases are structured and converted into case vectors for storage, improving the efficiency of subsequent case retrieval and retrieval, and facilitating the rapid extraction of effective information for model training. The reinforcement learning training method, which uses manually corrected solutions as positive samples and original outputs as negative samples, allows the target large model to clearly identify the differences in decision-making, gradually adjust preferences towards better decision directions, improve the model's decision quality, reduce the cost of manual intervention, ensure the continuous and stable operation of the system, and improve the reliability of the system's self-healing capabilities.

[0035] As can be seen from the above, the embodiments of this application first continuously monitor the target nodes of the target virtual machine operating system through a preset dynamic probe cluster. After acquiring the monitoring data, protocol identification is performed first, and then corresponding data processing operations are carried out based on the identification results. Subsequently, spatiotemporal alignment is performed on the processed log data, performance index data, configuration change data, and other multi-dimensional data to form structured data. Then, an entity relationship network graph is constructed based on the structured data. When an anomaly is detected in the target virtual machine operating system, anomaly diagnosis is performed by using a preset multi-level decision-making mechanism combined with the entity relationship network graph, and a corresponding anomaly handling plan is generated. Then, the anomaly handling plan is parsed to generate an abstract syntax tree. The plan is then subjected to syntax review through the abstract syntax tree. After the review is passed, a sandbox verification environment is built for the production environment of the target virtual machine operating system. The effectiveness of the plan is verified in this environment and the verification results are obtained. If the verification results show that the plan is passed, the plan is executed in the production environment. After the anomaly is successfully handled, the current anomaly handling case is updated to a preset historical case database. At the same time, the target reinforcement learning algorithm and the historical case database are used to optimize the target large model. In this way, through the above-described process of this application embodiment, the continuous monitoring of the dynamic probe cluster and the spatiotemporal alignment of multi-dimensional data ensure the comprehensiveness, accuracy, and consistency of the monitoring data, avoiding diagnostic biases caused by data fragmentation or misalignment; the entity relationship network graph constructed based on structured data can clearly present the associations between various entities in the system, and combined with a multi-level decision-making mechanism, it can quickly locate the root cause of anomalies, improving the efficiency and accuracy of anomaly diagnosis; the combination of sandbox verification environment construction and syntax review can effectively test the feasibility and security of anomaly handling plans without affecting the stability of the production environment, reducing the risk to the system caused by plan execution failure; the case library update and reinforcement learning algorithm optimization of the target large model after anomaly handling enable the large model to continuously learn from historical cases, improve its system inspection capabilities, continuously enhance the fault self-healing capability and stability of the target virtual machine operating system, and thus solve the problems of low inspection efficiency caused by slow response, insufficient coverage, and high false alarm rate of traditional inspection methods in complex system environments.

[0036] Accordingly, see Figure 7 As shown in the illustration, this application also provides a virtual machine operating system inspection device based on a large model, applied to a preset target large model, wherein the target large model is deployed in a target virtual machine operating system; wherein, the device includes: The spatiotemporal alignment module 11 is used to continuously monitor the target node of the target virtual machine operating system using a preset dynamic probe cluster, to identify the protocol of the monitoring data obtained from the target node, and to perform corresponding data processing operations based on the identification results, as well as to perform spatiotemporal alignment operations on the processed multi-dimensional data to obtain corresponding structured data; the multi-dimensional data includes log data, performance index data, and configuration change data. The anomaly diagnosis module 12 is used to construct an entity relationship network graph based on the structured data, and when an anomaly is detected in the target virtual machine operating system, it uses a preset multi-level decision-making mechanism to perform anomaly diagnosis based on the entity relationship network graph and generate a corresponding anomaly handling plan. The environment building module 13 is used to parse the exception handling plan to generate a corresponding abstract syntax tree, perform a syntax review on the exception handling plan based on the abstract syntax tree, and after passing the syntax review, build a corresponding sandbox verification environment for the production environment of the current target virtual machine operating system, so as to use the sandbox verification environment to verify the effect of the exception handling plan and obtain the corresponding verification results. The model optimization module 14 is used to execute the anomaly handling plan in the production environment if the verification result indicates that the anomaly handling plan has passed the effect verification, and after detecting that the anomaly has been successfully handled, update the preset historical case database based on the current anomaly handling case, and optimize the target large model using the target reinforcement learning algorithm and the historical case database.

[0037] In some specific embodiments, the spatiotemporal alignment module 11 may specifically include: The data parsing submodule is used to continuously acquire monitoring data from the target node of the target virtual machine operating system through a preset dynamic probe cluster, and parse the monitoring data based on several parsing templates in a preset protocol fingerprint library to identify the corresponding protocol type. The configuration tracking unit is used to perform log parsing on the monitoring data whose protocol type is the target log protocol type to obtain the corresponding log data, and to extract indicators on the monitoring data whose protocol type is the target performance indicator collection protocol type to obtain the corresponding performance indicator data, and to perform configuration tracking on the monitoring data whose protocol type is the target configuration management protocol type to obtain the corresponding configuration change data. The time alignment unit is used to standardize multi-dimensional data, add context labels to the standardized multi-dimensional data, and perform time alignment operations based on data timestamps to perform spatiotemporal alignment operations on the multi-dimensional data to obtain corresponding structured data; the multi-dimensional data includes the log data, the performance indicator data, and the configuration change data; Correspondingly, the data parsing submodule may further include: The data parsing unit is used to generate a corresponding new parsing template for the new monitoring data if new monitoring data exists in the monitoring data, and to parse the new monitoring data using the new parsing template to obtain the corresponding new protocol type; the new monitoring data is monitoring data that cannot be parsed by the preset protocol fingerprint database. The template saving unit is used to optimize the newly added parsing template using a preset machine learning model based on the data parsing results of the newly added parsing template, and save the newly added parsing template to the preset protocol fingerprint database.

[0038] In some specific embodiments, the anomaly diagnosis module 12 may specifically include: A data analysis unit is used to identify several entities corresponding to the structured data and analyze the structured data to extract the entity relationships between the several entities. The relation transformation unit is used to transform the entity relations into a directed graph structure to construct an entity relation network graph.

[0039] In some specific embodiments, the anomaly diagnosis module 12 may specifically include: The rule base traversal unit is used to traverse the preset regular expression rule base when an anomaly is detected in the target virtual machine operating system, in order to determine whether there is a target regular expression rule in the preset regular expression rule base that matches the entity relationship network graph, and to obtain the corresponding determination result. The case matching unit is used to generate a corresponding anomaly handling plan using the target regular expression rule if the determination result indicates that the target regular expression rule exists; if the determination result indicates that the target regular expression rule does not exist, it matches target historical anomaly handling cases from a preset vectorized case library based on preset similarity matching technology and the entity relationship network graph to obtain the corresponding matching result. The weight determination unit is used to perform experience reuse analysis on the target historical anomaly handling case if the matching result indicates that the target historical anomaly handling case is matched, so as to generate the anomaly handling plan; if the matching result indicates that the target historical anomaly handling case is not matched, the current anomaly type is determined, and the weights of each dimension of data are determined according to the anomaly type, so as to perform weighted comprehensive analysis on several data in the entity relationship network graph based on a preset multimodal attention mechanism and the weights, and generate the anomaly handling plan.

[0040] In some specific embodiments, the environment construction module 13 may specifically include: The command parsing unit is used to parse the operation commands in the exception handling plan to generate the corresponding abstract syntax tree; The semantic analysis unit is used to identify and match the abstract syntax tree using a preset high-risk operation mode rule base. If a target high-risk operation mode is matched, it is determined that the syntax review has failed and the target high-risk operation mode is blocked. If the target high-risk operation mode is not matched, semantic analysis is performed on the abstract syntax tree according to the runtime context, and the syntax review is determined based on the analysis results.

[0041] In some specific embodiments, the environment construction module 13 may specifically include: The process tree freezing unit is used to determine the target service process tree related to the exception handling plan, and to create a checkpoint for the target service process tree using a preset process checkpoint tool, and to freeze the target service process tree in the production environment of the current target virtual machine operating system. The file reading unit is used to mount the root file system of the production environment and a newly created blank writable directory in a preset container or namespace through a preset stacked file system to build an initial sandbox environment, and read the process files in the checkpoint based on the preset process checkpoint tool to build a corresponding sandbox verification environment for the production environment. The contingency plan execution unit is used to execute the exception handling contingency plan in the sandbox verification environment to obtain the corresponding execution results; The result acquisition unit is used to obtain the verification result that the exception handling plan has passed the effect verification if the execution result indicates that the exception handling plan has been successfully executed and the exception in the sandbox verification environment has been successfully handled.

[0042] In some specific embodiments, the model optimization module 14 may specifically include: The case conversion unit is used to perform structured processing on the current exception handling cases and convert the processed exception handling cases into case vectors, so as to store the case vectors in a preset historical case database. The preference optimization unit is used to optimize the decision preference of the target large model based on the target reinforcement learning algorithm, using the manually corrected schemes in the historical case database as positive samples and the original output as negative samples.

[0043] Furthermore, embodiments of this application also disclose an electronic device, Figure 8 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application. Specifically, the electronic device 20 may include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the large-model-based virtual machine operating system inspection method disclosed in any of the foregoing embodiments. Furthermore, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0044] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0045] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored thereon can include operating system 221, computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0046] The operating system 221 is used to manage and control the various hardware devices on the electronic device 20 and the computer program 222, which may be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program capable of performing the large-model-based virtual machine operating system inspection method executed by the electronic device 20 as disclosed in any of the foregoing embodiments, the computer program 222 may further include computer programs capable of performing other specific tasks.

[0047] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned disclosed virtual machine operating system inspection method based on a large model. Specific steps of this method can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.

[0048] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0049] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0050] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0051] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0052] The technical solutions provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A virtual machine operating system inspection method based on a large model, characterized in that, The method is applied to a pre-defined target large model, which is deployed in a target virtual machine operating system; wherein the method includes: A preset dynamic probe cluster is used to continuously monitor the target node of the target virtual machine operating system, so as to identify the protocol of the monitoring data obtained from the target node, and perform corresponding data processing operations based on the identification results, and perform spatiotemporal alignment operations on the processed multi-dimensional data to obtain corresponding structured data; the multi-dimensional data includes log data, performance index data, and configuration change data. Based on the structured data, an entity relationship network graph is constructed. When an anomaly is detected in the target virtual machine operating system, a preset multi-level decision-making mechanism is used to diagnose the anomaly based on the entity relationship network graph and generate a corresponding anomaly handling plan. The exception handling plan is parsed to generate a corresponding abstract syntax tree. The exception handling plan is then subjected to a syntax review based on the abstract syntax tree. After passing the syntax review, a corresponding sandbox verification environment is built for the production environment of the current target virtual machine operating system. The sandbox verification environment is used to verify the effectiveness of the exception handling plan and obtain the corresponding verification results. If the verification result indicates that the anomaly handling plan has passed the effectiveness verification, then the anomaly handling plan is executed in the production environment. After the anomaly is detected to have been successfully handled, the preset historical case database is updated based on this anomaly handling case, and the target large model is optimized using the target reinforcement learning algorithm and the historical case database.

2. The virtual machine operating system inspection method based on a large model according to claim 1, characterized in that, The method involves continuously monitoring the target node of the target virtual machine operating system using a preset dynamic probe cluster, identifying the protocol of the monitoring data obtained from the target node, performing corresponding data processing operations based on the identification results, and performing spatiotemporal alignment operations on the processed multi-dimensional data to obtain corresponding structured data, including: The system continuously acquires monitoring data from the target node of the target virtual machine operating system through a preset dynamic probe cluster, and parses the monitoring data based on several parsing templates in a preset protocol fingerprint library to identify the corresponding protocol type. For the monitoring data whose protocol type is the target log protocol type, log parsing is performed to obtain the corresponding log data; for the monitoring data whose protocol type is the target performance indicator collection protocol type, indicator extraction is performed to obtain the corresponding performance indicator data; and for the monitoring data whose protocol type is the target configuration management protocol type, configuration tracking is performed to obtain the corresponding configuration change data. The multi-dimensional data is standardized, and context labels are added to the standardized multi-dimensional data. Time alignment is also performed based on the data timestamps to perform spatiotemporal alignment on the multi-dimensional data, resulting in corresponding structured data. The multi-dimensional data includes the log data, the performance indicator data, and the configuration change data. Correspondingly, the step of parsing the monitoring data based on several parsing templates in a preset protocol fingerprint database to identify the corresponding protocol type also includes: If new monitoring data exists in the monitoring data, a corresponding new parsing template is generated for the new monitoring data, and the new parsing template is used to parse the new monitoring data to obtain the corresponding new protocol type; the new monitoring data is monitoring data that cannot be parsed by the preset protocol fingerprint database. Based on the data parsing results of the newly added parsing template, the newly added parsing template is optimized using a preset machine learning model, and then the newly added parsing template is saved to the preset protocol fingerprint database.

3. The virtual machine operating system inspection method based on a large model according to claim 1, characterized in that, The construction of the entity relationship network graph based on the structured data includes: Identify several entities corresponding to the structured data and analyze the structured data to extract the entity relationships between the entities. The entity relationships are transformed into a directed graph structure to construct an entity relationship network graph.

4. The virtual machine operating system inspection method based on a large model according to claim 1, characterized in that, When an anomaly is detected in the target virtual machine operating system, a preset multi-level decision-making mechanism is used to diagnose the anomaly based on the entity relationship network graph, and a corresponding anomaly handling plan is generated, including: When an anomaly is detected in the target virtual machine operating system, the preset regular expression rule base is traversed to determine whether there is a target regular expression rule in the preset regular expression rule base that matches the entity relationship network graph, and the corresponding determination result is obtained. If the determination result indicates that the target regular expression rule exists, then the target regular expression rule is used to generate a corresponding anomaly handling plan; if the determination result indicates that the target regular expression rule does not exist, then based on the preset similarity matching technology and the entity relationship network graph, the target historical anomaly handling cases are matched from the preset vectorized case library to obtain the corresponding matching results. If the matching result indicates that the target historical anomaly handling case is matched, then an experience reuse analysis is performed on the target historical anomaly handling case to generate the anomaly handling plan; if the matching result indicates that the target historical anomaly handling case is not matched, then the current anomaly type is determined, and the weights of each dimension of data are determined according to the anomaly type. Based on a preset multimodal attention mechanism and the weights, a weighted comprehensive analysis is performed on several data in the entity relationship network graph to generate the anomaly handling plan.

5. The virtual machine operating system inspection method based on a large model according to claim 1, characterized in that, The step of parsing the exception handling plan to generate a corresponding abstract syntax tree, and then performing a syntax review on the exception handling plan based on the abstract syntax tree, includes: The operation commands in the aforementioned exception handling plan are parsed to generate the corresponding abstract syntax tree; The abstract syntax tree is identified and matched using a preset high-risk operation mode rule base. If a target high-risk operation mode is matched, it is determined that the syntax review has failed and the target high-risk operation mode is blocked. If the target high-risk operation mode is not matched, semantic analysis is performed on the abstract syntax tree based on the runtime context, and the syntax review is determined based on the analysis results.

6. The virtual machine operating system inspection method based on a large model according to claim 1, characterized in that, The step involves constructing a corresponding sandbox verification environment for the current production environment of the target virtual machine operating system, and using the sandbox verification environment to verify the effectiveness of the exception handling plan and obtain corresponding verification results, including: Determine the target service process tree related to the exception handling plan, and use a preset process checkpoint tool to create checkpoints for the target service process tree, and freeze the target service process tree in the production environment of the current target virtual machine operating system; Within a preset container or namespace, the root file system of the production environment and a newly created blank writable directory are mounted through a preset stacked file system to build an initial sandbox environment. The process files in the checkpoint are read based on the preset process checkpoint tool to build a corresponding sandbox verification environment for the production environment. The exception handling plan is executed in the sandbox verification environment to obtain the corresponding execution results; If the execution result indicates that the exception handling plan was executed successfully and the exception in the sandbox verification environment was successfully handled, then the verification result of the exception handling plan passing the effect verification is obtained.

7. The virtual machine operating system inspection method based on a large model according to any one of claims 1 to 6, characterized in that, The process of updating the pre-set historical case database based on the current anomaly handling case, and optimizing the target large model using a target reinforcement learning algorithm and the historical case database, includes: The current exception handling cases are structured and converted into case vectors, which are then stored in a preset historical case database. Based on the target reinforcement learning algorithm, the manually corrected schemes in the historical case database are used as positive samples and the original output is used as negative samples to optimize the decision preference of the target large model.

8. A virtual machine operating system inspection device based on a large model, characterized in that, The device is applied to a pre-defined target large model, which is deployed in a target virtual machine operating system; wherein, the device includes: The spatiotemporal alignment module is used to continuously monitor the target nodes of the target virtual machine operating system using a preset dynamic probe cluster, to identify the protocol of the monitoring data obtained from the target nodes, to perform corresponding data processing operations based on the identification results, and to perform spatiotemporal alignment operations on the processed multi-dimensional data to obtain corresponding structured data; the multi-dimensional data includes log data, performance index data, and configuration change data. An anomaly diagnosis module is used to construct an entity relationship network graph based on the structured data, and when an anomaly is detected in the target virtual machine operating system, it uses a preset multi-level decision-making mechanism to perform anomaly diagnosis based on the entity relationship network graph and generate a corresponding anomaly handling plan. The environment building module is used to parse the exception handling plan to generate a corresponding abstract syntax tree, perform a syntax review on the exception handling plan based on the abstract syntax tree, and after passing the syntax review, build a corresponding sandbox verification environment for the production environment of the current target virtual machine operating system, so as to use the sandbox verification environment to verify the effect of the exception handling plan and obtain the corresponding verification results. The model optimization module is used to execute the anomaly handling plan in the production environment if the verification result indicates that the anomaly handling plan has passed the effectiveness verification, and after detecting that the anomaly has been successfully handled, update the preset historical case database based on the current anomaly handling case, and optimize the target large model using the target reinforcement learning algorithm and the historical case database.

9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the virtual machine operating system inspection method based on a large model as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, Used to store computer programs; wherein, when the computer programs are executed by a processor, they implement the virtual machine operating system inspection method based on a large model as described in any one of claims 1 to 7.

Images