Root cause analysis method based on improved Qwen3-14B large language model
By constructing a dataset for the domestic operations and maintenance field and fine-tuning the Qwen3-14B large language model using LoRA lightweight technology, combined with operations and maintenance knowledge base and graph, the problems of computational resource consumption and insufficient practicality of general large language models in domestic scenarios are solved, and efficient and targeted root cause analysis and operations and maintenance suggestions are realized.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- GUANGZHOU CITY UNIV OF TECH
- Filing Date
- 2025-12-04
- Publication Date
- 2026-04-14
AI Technical Summary
Traditional root cause analysis methods based on general large language models lack professional knowledge in the field of domestic operation and maintenance, resulting in insufficient practicality of output suggestions; if full fine-tuning is used to adapt to domestic operation and maintenance scenarios, there are problems such as high consumption of computing resources and high training costs.
A dataset targeting the domestic operations and maintenance (O&M) field was constructed, and the Qwen3-14B large language model was fine-tuned using LoRA lightweight technology. The model was trained using the dataset targeting the domestic O&M field, and an O&M knowledge base was constructed by combining knowledge content from dual channels. An abnormal root cause analysis was performed using a hybrid retrieval strategy and an O&M knowledge graph.
While reducing computing resource consumption, it improves the relevance and practicality of the model's root cause analysis results and operation and maintenance suggestions, and can effectively identify professional terms in the domestic operation and maintenance field and quickly locate the core of the problem.
Smart Images
Figure CN121858338A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of intelligent operation and maintenance technology, specifically a root cause analysis method based on an improved Qwen3-14B large language model. Background Technology
[0002] Intelligent operation and maintenance (O&M), as a core supporting technology for ensuring the stable operation of modern IT systems, has been widely researched and applied on a large scale both domestically and internationally. However, with the increasing complexity of IT system architectures, especially in specific deployment environments adapted to domestically produced hardware and software, the traditional O&M model relying on manual intervention has gradually exposed prominent problems such as slow response times, insufficient fault location accuracy, and poor adaptability, making it difficult to meet the demands for high reliability and high efficiency. Therefore, the industry is actively exploring the construction of an intelligent O&M system based on artificial intelligence technology, covering the entire process from fault discovery and root cause localization to automatic repair. Among the current mainstream root cause analysis solutions, the method of generating O&M suggestions based on a general-purpose large language model is widely used. However, general-purpose large language models lack the professional knowledge accumulated in the field of domestically produced O&M, resulting in suggestions that are often insufficiently practical; adapting to domestically produced O&M scenarios through full-scale fine-tuning presents problems such as high computational resource consumption and high training costs. Summary of the Invention
[0003] To address the aforementioned shortcomings, this invention proposes a root cause analysis method based on an improved Qwen3-14B large language model. The aim is to solve the problems of insufficient practicality of output suggestions in traditional root cause analysis methods based on general large language models, which lack adaptation to domestic operation and maintenance domain knowledge; and the high computational load and training cost if full-scale fine-tuning is used to adapt to domestic operation and maintenance scenarios.
[0004] To achieve this objective, the present invention adopts the following technical solution: A root cause analysis method based on an improved Qwen3-14B large language model includes the following steps: Step S1: Construct a dataset for the domestic operation and maintenance field; Step S2: Construct the Qwen3-14B large language model and fine-tune the Qwen3-14B large language model using LoRA lightweight technology to obtain the fine-tuned Qwen3-14B large language model; Step S3: Train the fine-tuned Qwen3-14B large language model using a dataset for domestic operation and maintenance fields to obtain the trained fine-tuned Qwen3-14B large language model. Step S4: Obtain knowledge content from both channels and preprocess it to obtain effective knowledge content from both channels; Step S5: Store the valid dual-channel source knowledge content in the preset PGVector vector database to build an operation and maintenance knowledge base; Step S6: Collect real-time anomaly data, and based on the real-time anomaly data, use a hybrid retrieval strategy to retrieve the corresponding knowledge fragments from the operation and maintenance knowledge base; Step S7: Filter the retrieved knowledge fragments to obtain valid knowledge fragments; Step S8: Input real-time anomaly data and effective knowledge fragments into the trained fine-tuned Qwen3-14B large language model for anomaly root cause analysis, and output an anomaly root cause analysis report and operation and maintenance suggestions.
[0005] Preferably, in step S2, the LoRA lightweight technique is used to fine-tune the Qwen3-14B large language model, specifically including the following sub-steps: training the two low-rank decomposition matrices A and B of the Qwen3-14B large language model to update the weights of the Qwen3-14B large language model; wherein, the weight update formula of the Qwen3-14B large language model is as follows:
[0006] Where W represents the updated weight matrix, This represents the original weight matrix.
[0007] Preferably, in step S4, the knowledge content from the dual-channel sources is preprocessed, specifically including the following sub-steps: performing text segmentation and vectorization processing on the knowledge content from the dual-channel sources.
[0008] Preferably, in step S6, based on real-time anomaly data, a hybrid retrieval strategy is used to retrieve the corresponding knowledge fragments from the operation and maintenance knowledge base, specifically including the following sub-steps: Step S61: Vectorize the real-time anomaly data to obtain a high-dimensional vector, and calculate the cosine similarity between this high-dimensional vector and the vectors of each knowledge fragment in the operation and maintenance knowledge base. ; Step S62: Extract target keywords from real-time anomaly data, and use the target keywords as search conditions to retrieve candidate knowledge fragments containing the target keywords from the operation and maintenance knowledge base. Calculate the keyword matching score based on the completeness of the target keyword matching. ; Step S63: According to and Calculate the comprehensive similarity of candidate knowledge fragments. The specific calculation formula is as follows:
[0009] in, Indicates the weighting factor; Step S64: Set a filtering threshold and determine the overall similarity of candidate knowledge fragments. If the similarity of the candidate knowledge fragment is less than or equal to the filtering threshold, and if not, the candidate knowledge fragment is output as the search result; if so, the candidate knowledge fragment is filtered out, and steps S62-S64 are re-executed until the overall similarity of the retrieved candidate knowledge fragments is less than or equal to the filtering threshold.
[0010] Preferably, the method further includes the following steps: constructing an operation and maintenance knowledge graph based on the source analysis results in the anomaly root cause analysis report; wherein, the operation and maintenance knowledge graph includes problem entities, several cause entities, and causal relationships between entities; performing multi-level confidence assessment on each cause entity and causal relationship between entities in the knowledge operation and maintenance graph to obtain the confidence level corresponding to each cause entity and causal relationship between entities; constructing a causal inference chain, in which the confidence level of each cause entity and causal relationship between entities is sequentially determined to be greater than or equal to a preset confidence threshold. If so, the corresponding cause entity and causal relationship between entities are included in the causal inference chain; otherwise, the inclusion operation of the causal inference chain is not performed.
[0011] Preferably, the method further includes the following steps: calling the extended Berkeley Package Filter (eBPF) tool; determining whether the trained fine-tuned Qwen3-14B large language model requires underlying data support; if so, collecting underlying data using the eBPF tool; otherwise, not performing data collection.
[0012] The technical solution provided by this invention may include the following beneficial effects: Compared to traditional root cause analysis methods based on general large language models, this solution optimizes the Qwen3-14B large language model using LoRA lightweight technology. While preserving the core performance of the Qwen3-14B large language model, it effectively reduces the computational resource consumption during the training and inference phases. Furthermore, the finely tuned Qwen3-14B large language model is trained using a dataset specific to the domestic operations and maintenance (O&M) field. This allows the model to grasp general knowledge within the O&M domain, thereby improving the relevance and practicality of the model's output root cause analysis results and O&M recommendations. Attached Figure Description
[0013] Figure 1 This is a flowchart illustrating the steps of a root cause analysis method based on an improved Qwen3-14B large language model. Detailed Implementation
[0014] Embodiments of the present invention are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and should not be construed as limiting the present invention.
[0015] A root cause analysis method based on an improved Qwen3-14B large language model includes the following steps: Step S1: Construct a dataset for the domestic operation and maintenance field; Step S2: Construct the Qwen3-14B large language model and fine-tune the Qwen3-14B large language model using LoRA lightweight technology to obtain the fine-tuned Qwen3-14B large language model; Step S3: Train the fine-tuned Qwen3-14B large language model using a dataset for domestic operation and maintenance fields to obtain the trained fine-tuned Qwen3-14B large language model. Step S4: Obtain knowledge content from both channels and preprocess it to obtain effective knowledge content from both channels; Step S5: Store the valid dual-channel source knowledge content in the preset PGVector vector database to build an operation and maintenance knowledge base; Step S6: Collect real-time anomaly data, and based on the real-time anomaly data, use a hybrid retrieval strategy to retrieve the corresponding knowledge fragments from the operation and maintenance knowledge base; Step S7: Filter the retrieved knowledge fragments to obtain valid knowledge fragments; Step S8: Input real-time anomaly data and effective knowledge fragments into the trained fine-tuned Qwen3-14B large language model for anomaly root cause analysis, and output an anomaly root cause analysis report and operation and maintenance suggestions.
[0016] This scheme employs a root cause analysis method based on an improved Qwen3-14B large language model, such as... Figure 1As shown, the first step is to construct a dataset for the domestic operations and maintenance (O&M) field. In this embodiment, by constructing a dataset for the domestic O&M field, domain-specific data is provided for the subsequent training of the fine-tuned Qwen3-14B large language model, ensuring that the knowledge learned by the fine-tuned Qwen3-14B large language model aligns with the actual needs of domestic O&M and reducing interference from irrelevant information. Further, the dataset for the domestic O&M field includes Hugging Face open-source data, data from Alibaba's cluster tracking program, and the core dataset from the intelligent O&M large language model project jointly launched by Cloudwise Intelligent Research Institute and Beijing University of Aeronautics and Astronautics. The second step is to construct the Qwen3-14B large language model and fine-tune it using LoRA lightweight technology to obtain the fine-tuned Qwen3-14B large language model. In this embodiment, by constructing the Qwen3-14B large language model and performing lightweight fine-tuning, the Qwen3-14B large language model is equipped with the ability to handle complex tasks such as root cause analysis in the domestic O&M field. The third step is to train the fine-tuned Qwen3-14B large language model using a dataset oriented towards the domestic operations and maintenance (O&M) field. This results in a trained, fine-tuned Qwen3-14B large language model. In this embodiment, training the fine-tuned Qwen3-14B large language model using a dataset oriented towards the domestic O&M field enables it to accurately identify professional terms within the domestic O&M field, reducing comprehension bias. The fourth step is to acquire knowledge content from dual-channel sources and preprocess it to obtain effective dual-channel knowledge content. In this embodiment, the dual-channel knowledge content includes high-value solutions validated in practice and authoritative open-source knowledge collection libraries. Acquiring dual-channel knowledge content provides rich data support for the subsequent construction of the O&M knowledge base. Preprocessing the dual-channel knowledge content improves the quality of the subsequent O&M knowledge base. The fifth step is to store the effective dual-channel knowledge content in a pre-defined PGVector vector database to construct the O&M knowledge base. In this embodiment, the PGVector vector database supports efficient vector similarity retrieval, enabling rapid matching of knowledge semantically similar to real-time abnormal data. By storing valid dual-channel knowledge content in a pre-defined PGVector vector database, it is beneficial to centrally manage valid dual-channel knowledge content. The sixth step is to collect real-time anomaly data and, based on the real-time anomaly data, use a hybrid retrieval strategy to retrieve corresponding knowledge fragments from the operation and maintenance knowledge base. In this embodiment, the hybrid retrieval strategy can take into account both semantic relevance and precise matching, avoiding both missing key information in single vector retrieval and being limited to literal matching in single keyword retrieval, thereby improving the hit rate and accuracy of knowledge fragment retrieval.The seventh step is to filter the retrieved knowledge fragments to obtain valid ones. In this embodiment, filtering the retrieved knowledge fragments reduces the interference of invalid knowledge fragments on the root cause analysis of the fine-tuned Qwen3-14B large language model after training. The eighth step is to input real-time anomaly data and valid knowledge fragments into the fine-tuned Qwen3-14B large language model after training for anomaly root cause analysis, and output an anomaly root cause analysis report and operation and maintenance suggestions. In this embodiment, combining real-time data and domain knowledge ensures that the root cause analysis of the fine-tuned Qwen3-14B large language model after training is based on both factual evidence and experience. By directly outputting the anomaly root cause analysis report and operation and maintenance suggestions, it can help operation and maintenance personnel quickly locate the core of the problem and take corresponding measures to fix it in a timely manner.
[0017] Compared to traditional root cause analysis methods based on general large language models, this solution optimizes the Qwen3-14B large language model using LoRA lightweight technology. While preserving the core performance of the Qwen3-14B large language model, it effectively reduces the computational resource consumption during the training and inference phases. Furthermore, the finely tuned Qwen3-14B large language model is trained using a dataset specific to the domestic operations and maintenance (O&M) field. This allows the model to grasp general knowledge within the O&M domain, thereby improving the relevance and practicality of the model's output root cause analysis results and O&M recommendations.
[0018] Preferably, in step S2, the LoRA lightweight technique is used to fine-tune the Qwen3-14B large language model, specifically including the following sub-steps: training the two low-rank decomposition matrices A and B of the Qwen3-14B large language model to update the weights of the Qwen3-14B large language model; wherein, the weight update formula of the Qwen3-14B large language model is as follows:
[0019] Where W represents the updated weight matrix, This represents the original weight matrix.
[0020] In this embodiment, during the fine-tuning of the Qwen3-14B large language model, the original weight matrix of the Qwen3-14B large language model is kept frozen, and training is performed only on the two low-rank decomposition matrices A and B. This approach reduces the scale of parameter updates during the fine-tuning process of the Qwen3-14B large language model, thereby reducing the consumption of computational resources.
[0021] Preferably, in step S4, the knowledge content from the dual-channel sources is preprocessed, specifically including the following sub-steps: performing text segmentation and vectorization on the knowledge content from the dual-channel sources.
[0022] In this embodiment, by first performing text segmentation on the knowledge content from the dual channels, redundant information can be removed and core knowledge nodes can be accurately focused; then, vectorization processing can be performed to transform the abstract knowledge connotation and semantic association into standardized numerical features of a unified dimension, laying the foundation for efficient retrieval in the future.
[0023] Preferably, in step S6, based on real-time anomaly data, a hybrid retrieval strategy is used to retrieve the corresponding knowledge fragments from the operation and maintenance knowledge base, specifically including the following sub-steps: Step S61: Vectorize the real-time anomaly data to obtain a high-dimensional vector, and calculate the cosine similarity between this high-dimensional vector and the vectors of each knowledge fragment in the operation and maintenance knowledge base. ; Step S62: Extract target keywords from real-time anomaly data, and use the target keywords as search conditions to retrieve candidate knowledge fragments containing the target keywords from the operation and maintenance knowledge base. Calculate the keyword matching score based on the completeness of the target keyword matching. ; Step S63: According to and Calculate the comprehensive similarity of candidate knowledge fragments. The specific calculation formula is as follows:
[0024] in, Indicates the weighting factor; Step S64: Set a filtering threshold and determine the overall similarity of candidate knowledge fragments. If the similarity of the candidate knowledge fragment is less than or equal to the filtering threshold, and if not, the candidate knowledge fragment is output as the search result; if so, the candidate knowledge fragment is filtered out, and steps S62-S64 are re-executed until the overall similarity of the retrieved candidate knowledge fragments is less than or equal to the filtering threshold.
[0025] In this embodiment, in step S61, vectorizing the real-time anomaly data helps transform abstract anomaly information into high-dimensional vectors. Calculating the cosine similarity between the high-dimensional vector and the vectors of each knowledge segment in the operation and maintenance knowledge base reflects their semantic fit. In step S62, extracting target keywords from the real-time anomaly data and using these keywords as search conditions effectively narrows the search scope, thereby improving search efficiency. Calculating the keyword matching score based on the completeness of the target keyword match effectively distinguishes between knowledge segments that are "fully matched" and "partially matched." In step S63, Setting it to 0.7 allows for highly flexible retrieval strategies. By calculating the comprehensive similarity of candidate knowledge fragments, potential solutions are not missed due to keyword limitations, nor is invalid information introduced due to semantic broadness. In step S64, the comprehensive similarity is calculated... Filtering out candidate knowledge fragments that are less than or equal to the filtering threshold can improve the effectiveness of search results.
[0026] Preferably, the method further includes the following steps: constructing an operation and maintenance knowledge graph based on the source analysis results in the anomaly root cause analysis report; wherein, the operation and maintenance knowledge graph includes problem entities, several cause entities, and causal relationships between entities; performing multi-level confidence assessment on each cause entity and causal relationship between entities in the knowledge operation and maintenance graph to obtain the confidence level corresponding to each cause entity and causal relationship between entities; constructing a causal inference chain, in which the confidence level of each cause entity and causal relationship between entities is sequentially determined to be greater than or equal to a preset confidence threshold. If so, the corresponding cause entity and causal relationship between entities are included in the causal inference chain; otherwise, the inclusion operation of the causal inference chain is not performed.
[0027] In this embodiment, by constructing an operations and maintenance (O&M) knowledge graph based on the source analysis results in the anomaly root cause analysis report, the unstructured source information scattered in the anomaly root cause analysis report can be transformed into a structured O&M knowledge graph, achieving standardized organization and associated storage of O&M data. Specifically, the construction of the O&M knowledge graph involves calling the `import_relationships_to_neo4j` function to import the structured, parsed source information into the Neo4j graph database. A confidence cleansing mechanism is introduced, which performs multi-level confidence assessments on each cause entity and the causal relationships between entities in the knowledge O&M graph, effectively distinguishing between high-confidence and low-confidence O&M knowledge. Furthermore, multi-level confidence assessment refers to a comprehensive confidence score based on factors such as the clarity of technical evidence, the closeness of problem correlation, and the prediction of solution effects. During the construction of the causal inference chain, by including cause entities and causal relationships greater than or equal to a pre-set confidence threshold in the causal inference chain, low-quality or potentially erroneous O&M knowledge can be effectively filtered out, reducing pollution of the causal inference chain at the source. To further explain, in extreme scenarios, such as the absence of high-confidence knowledge nodes, strict confidence threshold filtering may cause the causal inference chain to break at a certain node. To address this, this solution employs a fallback mechanism, retaining the node with the highest confidence among all candidate nodes at the end of the current causal inference chain. This completes the critical link in the inference chain, ensuring the continuity and integrity of the root cause tracing process. Simultaneously, nodes included through the fallback mechanism are specially marked to ensure the traceability of the origin of each node in the inference chain.
[0028] Preferably, the method further includes the following steps: invoking the Extended Berkeley Package Filter (eBPF) tool; determining whether the trained fine-tuned Qwen3-14B large language model requires underlying data support; if so, collecting underlying data using the eBPF tool; otherwise, not performing data collection. In this embodiment, by integrating eBPF technology with the trained fine-tuned Qwen3-14B large language model, the root cause analysis capability of the trained fine-tuned Qwen3-14B large language model can be effectively enhanced. Specifically, eBPF technology provides accurate and low-overhead kernel-level data collection capabilities, while the trained fine-tuned Qwen3-14B large language model provides intelligent analysis and decision-making capabilities based on this data.
[0029] Furthermore, the functional units in the various embodiments of the present invention can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.
[0030] Although embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of the present invention.
Claims
1. A root cause analysis method based on an improved Qwen3-14B large language model, characterized in that: Includes the following steps: Step S1: Construct a dataset for the domestic operation and maintenance field; Step S2: Construct the Qwen3-14B large language model and fine-tune the Qwen3-14B large language model using LoRA lightweight technology to obtain the fine-tuned Qwen3-14B large language model; Step S3: Train the fine-tuned Qwen3-14B large language model using a dataset for domestic operation and maintenance fields to obtain the trained fine-tuned Qwen3-14B large language model. Step S4: Obtain knowledge content from both channels and preprocess it to obtain effective knowledge content from both channels; Step S5: Store the valid dual-channel source knowledge content in the preset PGVector vector database to build an operation and maintenance knowledge base; Step S6: Collect real-time anomaly data, and based on the real-time anomaly data, use a hybrid retrieval strategy to retrieve the corresponding knowledge fragments from the operation and maintenance knowledge base; Step S7: Filter the retrieved knowledge fragments to obtain valid knowledge fragments; Step S8: Input real-time anomaly data and effective knowledge fragments into the trained fine-tuned Qwen3-14B large language model for anomaly root cause analysis, and output an anomaly root cause analysis report and operation and maintenance suggestions.
2. The root cause analysis method based on the improved Qwen3-14B large language model according to claim 1, characterized in that: In step S2, the LoRA lightweight technique is used to fine-tune the Qwen3-14B large language model, which specifically includes the following sub-steps: Two low-rank decomposition matrices A and B of the Qwen3-14B large language model are used for training to update the weights of the Qwen3-14B large language model; the weight update formula of the Qwen3-14B large language model is as follows: Where W represents the updated weight matrix, This represents the original weight matrix.
3. The root cause analysis method based on the improved Qwen3-14B large language model according to claim 1, characterized in that: In step S4, the knowledge content from the dual-channel sources is preprocessed, specifically including the following sub-steps: performing text segmentation and vectorization on the knowledge content from the dual-channel sources.
4. The root cause analysis method based on the improved Qwen3-14B large language model according to claim 1, characterized in that: In step S6, based on real-time anomaly data, a hybrid retrieval strategy is used to retrieve the corresponding knowledge fragments from the operation and maintenance knowledge base, specifically including the following sub-steps: Step S61: Vectorize the real-time anomaly data to obtain a high-dimensional vector, and calculate the cosine similarity between this high-dimensional vector and the vectors of each knowledge fragment in the operation and maintenance knowledge base. ; Step S62: Extract target keywords from real-time anomaly data, and use the target keywords as search conditions to retrieve candidate knowledge fragments containing the target keywords from the operation and maintenance knowledge base. Calculate the keyword matching score based on the completeness of the target keyword matching. ; Step S63: According to and Calculate the comprehensive similarity of candidate knowledge fragments. The specific calculation formula is as follows: in, Indicates the weighting factor; Step S64: Set a filtering threshold and determine the overall similarity of candidate knowledge fragments. If the similarity of the candidate knowledge fragment is less than or equal to the filtering threshold, and if not, the candidate knowledge fragment is output as the search result; if so, the candidate knowledge fragment is filtered out, and steps S62-S64 are re-executed until the overall similarity of the retrieved candidate knowledge fragments is less than or equal to the filtering threshold.
5. The root cause analysis method based on the improved Qwen3-14B large language model according to claim 1, characterized in that: It also includes the following steps: Based on the root cause analysis results in the anomaly root cause analysis report, an operation and maintenance knowledge graph is constructed; the operation and maintenance knowledge graph includes problem entities, several cause entities, and causal relationships between entities; A multi-level confidence assessment is performed on each cause entity and the causal relationship between entities in the knowledge operation and maintenance graph to obtain the confidence level corresponding to each cause entity and the causal relationship between entities; Construct a causal reasoning chain. During the construction process, determine whether the confidence level of each cause entity and the causal relationship between entities is greater than or equal to a preset confidence threshold. If so, include the corresponding cause entity and the causal relationship between entities into the causal reasoning chain. If not, do not perform the inclusion operation of the causal reasoning chain.
6. The root cause analysis method based on the improved Qwen3-14B large language model according to claim 1, characterized in that: It also includes the following steps: Invoke the extended Berkeley package filter eBPF tool; Determine whether the fine-tuned Qwen3-14B large language model after training requires underlying data support. If so, collect the underlying data using the eBPF tool; otherwise, do not perform the data collection operation.