Comprehensive AI large model base construction method and system based on multi-data fusion

Abstract

The invention relates to the technical field of information, in particular to a comprehensive AI large model base construction method and system based on multi-data fusion. The method comprises the following steps: constructing a multi-source heterogeneous data acquisition layer, and acquiring operation and maintenance related data from a plurality of preset devices through a standardized protocol; preprocessing the collected multi-source data to generate a fusion data set; based on the fusion data set, an AI large model base is constructed, and the AI large model base comprises a plurality of basic perception models, a cross-domain correlation analysis model and an intelligent decision generation model; obtaining an operation and maintenance target, and selecting a plurality of basic sensing models and configuring fusion weights according to the matching degree and implicit dependency relationship between the operation and maintenance target and a plurality of preset reference operation and maintenance objects; and fusing the plurality of selected basic perception models according to the fusion weight, and docking the fused basic perception models with an intelligent decision generation model to obtain an operation and maintenance auxiliary model of the operation and maintenance target.

Description

Technical Field

[0001] This application relates to the field of information technology, specifically to a method and system for constructing a comprehensive AI large model foundation based on multi-data fusion. Background Technology

[0002] In the context of accelerated digital transformation, enterprise IT systems are becoming increasingly complex, encompassing multiple heterogeneous subsystems such as networks, storage, applications, terminals, and office automation. Traditional operation and maintenance methods mainly rely on manual experience and rule engines, which are difficult to handle massive, multi-source, and high-dimensional operation and maintenance data. In particular, when facing cross-domain fault propagation, implicit dependencies, and sudden abnormal events, problems such as delayed response, high misjudgment rate, and weak policy generalization ability are particularly prominent.

[0003] The development of artificial intelligence technology, especially large-scale models, has provided new solutions for intelligent operations and maintenance (AIOps). However, existing AI-based operations and maintenance solutions generally suffer from bottlenecks such as severe data silos, limited model generalization capabilities, lack of unified semantic understanding of multi-source heterogeneous data, and uninterpretable decision-making processes, making it difficult to support the generation of highly reliable and highly adaptive operations and maintenance strategies in complex business scenarios.

[0004] Therefore, there is an urgent need to build a comprehensive AI big model foundation that can integrate multi-source operation and maintenance data, identify cross-domain dependencies, and have intelligent policy generation capabilities, so as to achieve an upgrade of the operation and maintenance paradigm. Summary of the Invention

[0005] This specification describes a method and system for constructing a comprehensive AI large model foundation based on multi-data fusion through several embodiments.

[0006] Firstly, this specification provides a method for constructing a comprehensive AI large-scale model foundation based on multi-data fusion, used to assist in generating operation and maintenance strategies, including the following steps:

[0007] Construct a multi-source heterogeneous data acquisition layer to collect operation and maintenance-related data from multiple pre-set devices through standardized protocols;

[0008] The collected multi-source data is preprocessed to generate a fused dataset;

[0009] Based on the fused dataset, a large-scale AI model foundation is constructed, which includes multiple basic perception models, cross-domain correlation analysis models, and intelligent decision generation models, wherein:

[0010] The various basic perception models are used to identify abnormal patterns of multiple preset reference maintenance objects.

[0011] The cross-domain correlation analysis model analyzes the implicit dependencies between different reference operation and maintenance objects.

[0012] The intelligent decision generation model is used to receive the output results of multiple basic perception models and generate operation and maintenance strategies based on the output results;

[0013] Obtain the operation and maintenance target, and select several basic perception models and configure fusion weights based on the matching degree and implicit dependency relationship between the operation and maintenance target and multiple preset reference operation and maintenance objects;

[0014] After the selected basic perception models are fused according to the fusion weights, they are connected with the intelligent decision generation model to obtain the operation and maintenance auxiliary model of the operation and maintenance target. The operation and maintenance auxiliary model generates operation and maintenance strategies based on the operation and maintenance related data of the operation and maintenance target.

[0015] Secondly, this specification provides an embodiment of a comprehensive AI large-scale model foundation construction system based on multi-data fusion, used to assist in generating operation and maintenance strategies, including:

[0016] The data acquisition module constructs a multi-source heterogeneous data acquisition layer to collect operation and maintenance-related data from multiple preset devices through standardized protocols.

[0017] The fusion module preprocesses the collected multi-source data to generate a fused dataset;

[0018] The generation module, based on the fused dataset, constructs an AI large-scale model foundation. This foundation includes multiple basic perception models, cross-domain correlation analysis models, and intelligent decision generation models, wherein:

[0019] The various basic perception models are used to identify abnormal patterns of multiple preset reference maintenance objects.

[0020] The cross-domain correlation analysis model analyzes the implicit dependencies between different reference operation and maintenance objects.

[0021] The intelligent decision generation model is used to receive the output results of multiple basic perception models and generate operation and maintenance strategies based on the output results;

[0022] The access module obtains the operation and maintenance target, and selects several basic perception models and configures fusion weights based on the matching degree and implicit dependency relationship between the operation and maintenance target and multiple preset reference operation and maintenance objects.

[0023] The running module fuses the selected basic perception models according to the fusion weights and then interfaces with the intelligent decision generation model to obtain the operation and maintenance auxiliary model for the operation and maintenance target. The operation and maintenance auxiliary model generates operation and maintenance strategies based on the operation and maintenance related data of the operation and maintenance target.

[0024] Thirdly, embodiments of this specification provide an electronic device, including a processor and a memory;

[0025] The processor is connected to the memory;

[0026] The memory is used to store executable program code;

[0027] The processor runs a program corresponding to the executable program code stored in the memory to perform the method described in any of the above aspects.

[0028] Fourthly, embodiments of this specification provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the methods described in any of the above aspects.

[0029] Fifthly, embodiments of this specification provide a computer program product, including a computer program that, when executed by a processor, implements the methods described in any of the above aspects.

[0030] The beneficial effects of the technical solutions provided in some embodiments of this specification include at least the following:

[0031] In several embodiments of this specification, a method and system for constructing a comprehensive AI large-scale model foundation based on multi-data fusion are provided. This constructs an AI large-scale model foundation that integrates multi-source operation and maintenance data and possesses cross-domain dependency recognition and intelligent strategy generation capabilities. It integrates multi-source data through unified semantic modeling and, by establishing a large-scale model foundation, quickly builds dedicated operation and maintenance auxiliary models for different subsystems, thereby improving operation and maintenance efficiency. Leveraging the contextual understanding and reasoning capabilities of the large-scale model, it captures implicit dependencies, helping to improve the prediction accuracy of sudden failures. Assisting operation and maintenance personnel in generating operation and maintenance strategies helps improve operation and maintenance efficiency and reduces the professional skill requirements for operation and maintenance personnel.

[0032] Other features and advantages of various embodiments of this specification will be further revealed in the following detailed description and accompanying drawings. Attached Figure Description

[0033] To more clearly illustrate the technical solutions in the embodiments of this specification, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0034] Figure 1 This is a schematic diagram of the construction of the large model base provided in this manual.

[0035] Figure 2 This is a schematic diagram illustrating the construction process of the large model base provided in this manual.

[0036] Figure 3 This is a schematic diagram of the method flow for constructing the basic perception model provided in this manual.

[0037] Figure 4 This is a schematic diagram illustrating the process of constructing a cross-domain association analysis model provided in this manual.

[0038] Figure 5 This is a schematic diagram of the method for constructing an intelligent decision generation model provided in this manual.

[0039] Figure 6 This is a schematic diagram of the large model base construction system provided in this manual.

[0040] Figure 7 This is a schematic diagram of the electronic device provided in this manual. Detailed Implementation

[0041] The technical solutions of the embodiments of this specification will be explained and described below with reference to the accompanying drawings. However, the following embodiments are only preferred embodiments of this specification and not all of them. Other embodiments obtained by those skilled in the art based on the embodiments in the implementation methods without creative effort are all within the protection scope of this specification.

[0042] The terms "first," "second," "third," etc., in the description, claims, and accompanying drawings are used to distinguish different objects, not to describe a specific order. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to such processes, methods, products, or apparatus.

[0043] In the following description, terms such as “inner,” “outer,” “upper,” “lower,” “left,” and “right” are used only to facilitate the description of the embodiments and to simplify the description, and are not intended to indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of this specification.

[0044] All data involved in this application are information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0045] Before introducing the technical solutions described in this manual, the application scenarios and related technologies of the technical solutions will be introduced.

[0046] Operations and maintenance (O&M) is a crucial link in ensuring the stable, efficient, and secure operation of information systems, spanning the entire lifecycle of IT infrastructure, application systems, network environments, and terminal devices. The O&M work differs depending on the type of object being maintained. For example, for network devices, topology management, bandwidth monitoring, security policy configuration, and troubleshooting are required; for server and storage systems, the focus is on resource scheduling, performance tuning, capacity planning, and high availability assurance; for application systems, deployment and release, log analysis, service health checks, and user experience monitoring are involved; and for terminal and office automation systems, O&M emphasizes user support, software distribution, access control, and compliance auditing. O&M is the guardian of business continuity. An efficient O&M system can promptly identify and eliminate potential risks, improve system availability and response speed, reduce operating costs, and provide stable and reliable technical support for business innovation.

[0047] However, current operations and maintenance practices still face numerous challenges. First, system architectures are becoming increasingly complex; the introduction of technologies such as multi-cloud, hybrid cloud, and microservices has led to a surge in the number of operations and maintenance objects and intricate dependencies. Second, data silos are severe; numerous monitoring tools exist, but they are fragmented and difficult to form a unified view. Third, fault location is difficult; cross-domain issues occur frequently and their root causes are hidden; traditional rule-based or threshold-based alarm mechanisms have high false alarm rates and delayed responses. Fourth, there is a high reliance on human resources; a large number of repetitive operations consume the energy of operations and maintenance personnel, hindering their transition to high-value analysis and optimization work. These problems not only affect system stability but also restrict the overall improvement of enterprise IT efficiency, urgently requiring a fundamental upgrade of the operations and maintenance paradigm through intelligent and automated means.

[0048] To improve the efficiency and convenience of operations and maintenance, this manual provides a method and system for constructing a comprehensive AI large-scale model foundation based on multi-data fusion, realizing the construction of a unified intelligent operations and maintenance foundation for complex enterprise IT environments. Please refer to the appendix. Figure 1 Firstly, addressing the common problem of fragmented, multi-source, heterogeneous data in current operations and maintenance (O&M) systems, a unified semantic representation framework was established to integrate O&M data from multiple subsystems, including network, storage, computing, applications, terminals, and office automation. Through standardized data access interfaces and a context-aware semantic alignment mechanism, structured, semi-structured, and unstructured data, originally scattered across different monitoring tools, log systems, configuration management databases, and alarm platforms, are deeply integrated. This breaks down data silos in traditional O&M and lays a high-quality data foundation for subsequent intelligent analysis.

[0049] Building upon this foundation, the system leverages the contextual understanding, pattern recognition, and cross-domain reasoning capabilities of large language models or domain-adapted large models to dynamically model and continuously learn explicit or implicit dependencies between system components. Especially in highly dynamic IT environments such as microservice architectures and hybrid cloud deployments, it can automatically identify potential fault propagation paths caused by version changes, resource contention, or configuration drift, effectively improving early detection capabilities for complex anomalies such as cascading failures and slow degradation. Finally, by introducing generative AI technology, combined with historical operational knowledge bases, real-time system status, and business impact assessments, it automatically generates interpretable and actionable operational decision recommendations. For example, during an operational operation, when an abnormal database response latency was detected, a dedicated operational model built upon the foundation constructed using the comprehensive AI large model foundation 20 methodology pinpointed a potential cause of underlying storage I / O bottlenecks and generated recommended scaling strategies, index optimization schemes, and temporary rate limiting solutions.

[0050] First, this manual provides a method for constructing a comprehensive AI large-scale model foundation based on multi-data fusion, which is used to assist in generating operation and maintenance strategies. Please refer to the appendix. Figure 2 This includes the following steps:

[0051] Step S1) Construct a multi-source heterogeneous data acquisition layer to collect operation and maintenance related data from multiple preset devices through standardized protocols.

[0052] The plurality of devices include one or more of network security devices, data storage systems, business application platforms, smart terminal devices, and office automation devices.

[0053] The operation and maintenance related data includes operation status data, security logs, business metrics, fault alarms, and user behavior data.

[0054] First, deploy a data acquisition layer for all IT assets to achieve unified access and standardized processing of operational data from different vendors, architectures, and protocol environments. Multiple devices cover common key components in enterprise IT environments, including but not limited to: network security devices such as firewalls, intrusion detection systems (IDS), web application firewalls (WAF), data storage systems such as SAN / NAS storage arrays, distributed file systems, and database clusters; business application platforms such as ERP, CRM, containerized applications under microservice architectures; smart terminal devices such as employee PCs, mobile terminals, and IoT sensors; and office automation devices such as conferencing systems, print servers, and identity authentication gateways.

[0055] The data types related to operations and maintenance are rich and diverse, including runtime status data, security logs, business metrics, fault alarms, and user behavior data. Runtime status data includes CPU utilization, memory usage, disk I / O throughput, network bandwidth utilization, and service process liveness status. Security logs include firewall blocking records, failed login attempts, permission change audit logs, and malware scan results. Business metrics include order processing volume, API call success rate, page load latency, and transaction failure rate—key performance indicators (KPIs) reflecting business health. Fault alarms come from threshold-triggered alarms and abnormal event notifications from monitoring systems such as Zabbix, Prometheus, and Nagios. User behavior data includes user login time distribution, high-frequency operation paths, and abnormal operation patterns, such as batch data export during non-working hours, which can be used to identify potential internal risks or user experience issues. To ensure data collection compatibility and scalability, standardized protocols such as JDBC / ODBC and RESTful APIs are used, and an adapter mechanism supports the encapsulation and conversion of private protocols.

[0056] Step S2) Preprocess the collected multi-source data 10 to generate a fused dataset 11.

[0057] The preprocessing includes cleaning, normalization, temporal alignment, and semantic mapping. Data cleaning removes invalid, duplicate, or obviously erroneous data records. Normalization addresses inconsistencies in measurement units and numerical ranges between different devices or systems. Temporal alignment ensures that data from different sources is comparable in time. Since different systems have different sampling frequencies (e.g., network devices report every 5 seconds, while application logs may be triggered by events), the system uses interpolation, sliding window aggregation, or event-anchor-based timestamp calibration strategies to align all data to a uniform temporal granularity, such as a time slice per minute, to facilitate cross-domain correlation analysis.

[0058] The methods for semantic mapping include:

[0059] Construct a unified operation and maintenance knowledge graph, which records the semantic relationships between device types, indicator categories, alarm levels, business processes, and user roles, and establish a unified semantic space based on the operation and maintenance knowledge graph;

[0060] Based on the semantic similarity and semantic vector of the context embedding of the fields of the multi-source data 10, the fields of the multi-source data 10 are mapped to the unified semantic space.

[0061] The IT operations knowledge graph explicitly models key entities and their relationships in the IT operations domain in a graph structure. Examples include: device types (e.g., firewalls, MySQL databases, Kubernetes nodes); metric categories (e.g., throughput, error rate, response latency); alarm levels (e.g., warning, critical, urgent); business processes (e.g., user login, order creation, payment processing, shipping notification); and user roles (e.g., regular employees, system administrators, security auditors). Entities are interconnected through predefined or learned relationships (e.g., deployed at, affect, belong to, trigger, permission inclusion, etc.), forming a unified semantic space covering infrastructure, application logic, and business context.

[0062] By leveraging natural language processing techniques such as BERT, Sentence-BERT, or domain-fine-tuned operation and maintenance-specific embedding models, context-aware semantic vectorization is performed on textual content such as field names, log keywords, and alarm descriptions in multi-source data10. For example, although CPU Utilization, cpu_usage_percent, and processor load are described differently, their semantic vectors are highly similar in the embedding space. The system calculates the semantic similarity between these fields and standard concepts in the knowledge graph, such as computing resource utilization, and maps them to corresponding nodes in the graph, achieving semantic alignment.

[0063] Step S3) Based on the fusion dataset 11, construct the AI ​​large model base 20, which includes multiple basic perception models, cross-domain correlation analysis models and intelligent decision generation models.

[0064] Wherein: multiple basic perception models are used to identify abnormal patterns of multiple preset reference operation and maintenance objects; the cross-domain correlation analysis model analyzes the implicit dependencies between different reference operation and maintenance objects; and the intelligent decision generation model is used to receive the output results of multiple basic perception models and generate operation and maintenance strategies based on the output results.

[0065] For details, please refer to the appendix. Figure 3 Methods for constructing basic perception models include:

[0066] Step S3101) Collect and label the working data of each reference operation and maintenance object, including normal and abnormal states.

[0067] For each type of critical operational object, such as database servers, core switches, web application services, and endpoint security agents, historical data is backtracked and collected in a scenario-based manner. This includes collecting health data not only during stable operation but also paying special attention to abnormal data generated when known faults or performance degradation events occur. All data is manually or semi-automatically labeled by operations experts or based on post-event root cause analysis reports, clearly marking each record with its corresponding status label, such as normal, CPU overload, network packet loss, or SQL injection attack. For example, in the database cluster of an e-commerce platform, the operations team compiled complete monitoring logs of the MySQL master database over the past year under four typical scenarios: daily load, surge in slow queries, master-slave synchronization interruption, and disk full. Each segment was labeled accordingly, forming a high-quality labeled dataset.

[0068] Step S3102) Extract the time series features, frequency domain features, and several preset statistical features of the working data, and denot them as feature set.

[0069] Multidimensional features are extracted from the raw working data. Time series features include trends, periodicity, and abrupt changes within a sliding window. Trends can be represented using methods such as first-order difference mean. Periodicity is detected using an autocorrelation function. Abrupt changes are identified using the CUSUM or Pelt algorithm.

[0070] Frequency domain features extract the main frequency components of a signal through fast Fourier transform or wavelet transform, which can be used to discover hidden periodic interference or oscillation anomalies, such as regular resource competition caused by timed tasks; statistical features cover general indicators such as mean, variance, skewness, kurtosis, maximum / minimum value, quantile, and rate of change.

[0071] Taking network switch port traffic as an example, in addition to the usual packets per second and bandwidth utilization, the traffic fluctuation coefficient within a 5-minute sliding window, the entropy value of the burst packet interval, and the main frequency energy ratio after FFT are also calculated, which together constitute the behavioral fingerprint of the port.

[0072] Step S3103) After associating the working data and its feature set with status labels, it is used as sample data.

[0073] After feature extraction, each piece of raw working data, along with its corresponding multidimensional feature vector and status label, is integrated into a structured sample. For example, a sample about an application service might include: [timestamp, service name, average CPU usage = 78%, peak memory usage = 92%, API error rate = 5.3%, traffic entropy = 0.82, FFT clock speed energy = 0.65, status label = "abnormal: memory leak"]. These samples are organized by category to form a supervised learning dataset for specific operational objects.

[0074] Step S3104) Establish and use the sample dataset to train the machine learning model. A suitable model architecture can be flexibly selected based on the characteristics of the operation and maintenance object and the data scale. Cross-validation, early stopping mechanisms, and class weighting strategies are employed during training to address the problem of sparse abnormal samples.

[0075] Step S3105) Obtain the basic perception model corresponding to the reference operation and maintenance object based on the trained machine learning model.

[0076] After training, the model is solidified as the "basic perception model" for this type of operational object and deployed in edge nodes or the central inference engine for real-time or near-real-time state determination. When new data flows in, the same feature set is automatically extracted and fed into the corresponding model, outputting the current state prediction result and confidence level. These prediction results can not only be used for immediate alerts, but also serve as input to higher-level large models, providing them with structured and semantically clear state summaries, avoiding the large models directly processing raw noisy data, thereby improving the overall inference efficiency and accuracy.

[0077] Please see the appendix Figure 4 Methods for constructing cross-domain association analysis models include:

[0078] Step S3201) Based on the fused dataset 11, extract the state change sequence of multiple reference operation and maintenance objects in the time dimension, and align the abnormal states of each reference operation and maintenance object on the time axis.

[0079] For each type of reference maintenance object, such as databases, application services, network devices, and terminals, the state sequence output by the basic perception model is extracted. The sequence is indexed by timestamps, recording the object's state within each time window, such as normal, CPU overload, or connection timeout. Subsequently, abnormal events for all objects are aligned under a unified time benchmark. For example, if the database is determined to have a surge in slow queries at 10:05:23, and the front-end web service experiences API response latency at 10:05:30, these two events are mapped to the same time grid, such as a time bucket with a 10-second granularity, ensuring a consistent temporal context for subsequent correlation analysis.

[0080] Step S3202) Construct a cross-domain event graph, taking the abnormal states of different reference operation and maintenance objects as nodes, and establishing edge connections based on time proximity and business relationships to form an initial association structure.

[0081] Cross-domain anomaly events are organized using a graph structure. Each node represents the abnormal state of a specific operational object at a particular moment, such as MySQL master database slow query @10:05. Edges represent potential relationships. Edges are established based on two criteria: temporal proximity (e.g., the interval between two anomaly events is less than a preset threshold) and business topology relationships derived from the service dependency graph (e.g., the order service calling the user database). For example, in a transaction system, "payment gateway timeout" and "sudden drop in Redis cache hit rate" highly overlap in time and have business call dependencies; therefore, a directed edge is established between them, forming the initial cross-domain event graph.

[0082] Step S3203) Use a machine learning model to learn the cross-domain event graph and identify the implicit dependencies between reference operation and maintenance objects. The implicit dependencies are unidirectional influence, bidirectional coupling or delayed propagation.

[0083] The initial graph only reflects surface-level relationships, while real-world systems contain numerous implicit dependencies that are not explicitly recorded, such as resource contention, cascading configuration changes, and shared middleware bottlenecks. To address this, a graph neural network or temporal graph attention network is introduced for end-to-end training of the historical cross-domain event graph. By learning event propagation patterns across numerous failure scenarios, the model automatically identifies three typical implicit dependencies:

[0084] One-way impact: For example, storage I / O latency can lead to a decrease in database performance, which in turn can cause application timeouts;

[0085] Two-way coupling: such as microservices A and B calling each other, which can lead to an avalanche-like drag on each other under high load;

[0086] Delayed propagation: For example, batch tasks exhaust disk bandwidth in the early morning, and only become apparent as database write failures several hours later during peak daytime business hours.

[0087] For example, in a post-event analysis of a major e-commerce promotion, the model successfully identified that the Kafka message backlog was not directly caused by consumer failure, but rather by the upstream log collection agent consuming too much CPU during a traffic surge, indirectly causing the Kafka producer thread to be blocked. This implicit dependency had not been noticed by the operations team before.

[0088] Step S3204) Assign weights to the implicit dependencies according to the attention mechanism, and generate a dependency rule base based on the implicit dependencies and their weights.

[0089] To quantify the importance of different dependencies, attention mechanisms are introduced, such as node attention in GAT or multi-head attention in Transformer, to dynamically calculate the influence weight of each edge in a specific context. For example, in a slow database query scenario, the attention weight for storage latency causing DB performance degradation may be as high as 0.85, while the attention weight for network jitter causing DB performance degradation is only 0.15, indicating that the former is the dominant factor.

[0090] Step S3205) Construct a cross-domain association analysis model based on the dependency rule base.

[0091] The rule base is encapsulated into a reasoning-based cross-domain correlation analysis model. When a new fault occurs, the model receives real-time status input from various basic perception models, matches applicable rules, and combines current attention weights to dynamically infer the most likely root cause path and scope of impact. For example, when three alarms are received simultaneously—"Application 5xx errors are increasing," "Database connection pool is exhausted," and "Redis response is slow"—the model can quickly determine based on the rule base that the cause may be "Redis master node memory overflow," and eliminate other secondary factors through weight sorting, thereby further shortening the MTTR.

[0092] Please see the appendix Figure 5 Methods for constructing intelligent decision generation models include:

[0093] Step S3301) Obtain the anomaly detection results and their confidence scores output by multiple basic perception models, read the implicit dependencies and weights output by the cross-domain association analysis model, and construct the context vector.

[0094] This system integrates anomaly detection results and their corresponding confidence scores from different foundational perception models, such as network monitoring and application performance monitoring. Simultaneously, it extracts implicit dependencies and their weights from cross-domain correlation analysis models. This information collectively forms a context vector, reflecting the current system's operational status and potential root causes of problems. For example, in an e-commerce platform, if order service response times become longer, it may involve multiple factors such as slow database query speeds, high network latency, or third-party payment gateway failures; all of these factors will be incorporated into the context vector.

[0095] Step S3302) Based on historical operation and maintenance work orders, expert handling records and strategy execution feedback records, construct an operation and maintenance strategy knowledge base. The knowledge base contains a mapping relationship between anomaly types, handling actions and effect evaluation.

[0096] The created operational strategy knowledge base includes various past anomalies, specific measures taken, and evaluations of their effectiveness. It includes not only successful cases but also lessons learned from failures. For example, when an e-commerce website suffered a DDoS attack, historical records show that increasing bandwidth and enabling traffic scrubbing services were effective countermeasures. Another instance involved IP blocking, which resulted in a new anomaly where legitimate users were unable to access the site. This knowledge base helps provide reference solutions for emerging problems and predict possible outcomes.

[0097] Step S3303) Using the context vector as input and the operation and maintenance strategy knowledge base as constraints, adjust the pre-connected natural language model, obtain a strategy generation model based on the adjusted natural language model, and the output of the strategy generation model is an operation and maintenance suggestion in natural language form.

[0098] Using context vectors as input and combining them with rules from the operations and maintenance strategy knowledge base, the pre-trained natural language model is fine-tuned or its generation is guided. The goal is to enable the model to understand the context specific to the operations and maintenance domain and propose targeted suggestions accordingly. For example, in the case of slow order service response mentioned earlier, the adjusted strategy generation model might output the following suggestion: "Given that inefficient database queries are likely the main reason for the prolonged order service response time, please consider optimizing the SQL query statement or expanding the database index." This suggestion is both specific and practical, and provides a feasible solution.

[0099] Step S4) Obtain the operation and maintenance target. Based on the matching degree and implicit dependency relationship between the operation and maintenance target and multiple preset reference operation and maintenance objects, select several basic perception models and configure fusion weights.

[0100] Receive operational goals from users or upper-level platforms. These goals can be business-level, such as ensuring an order payment success rate of no less than 99.5% during peak sales periods; performance-level, such as ensuring a core database P99 response latency of less than 200ms; or security or compliance-oriented, such as detecting and blocking all suspected lateral movement internal threat behaviors.

[0101] The operational goal is semantically matched against a pre-defined set of reference operational objects, such as web applications, MySQL clusters, Redis caches, Kafka message queues, firewalls, and terminal EDR proxies. The matching process incorporates the following two key criteria:

[0102] Target object matching degree: By using the business process mapping relationships in the operation and maintenance knowledge graph, we can determine which objects directly support the target. For example, the target "ensuring payment success rate" is associated with nodes such as "payment gateway service", "user authentication center", "transaction database", and "risk control engine" in the knowledge graph, so these objects have a high matching degree; while the matching degree of office printers or meeting room reservation systems is extremely low and can be excluded.

[0103] Implicit Dependency Strength: Using a dependency rule base, further assess whether there is strong coupling or high-impact paths between target-related objects. For example, although "Redis cache" does not appear directly in the payment process description, the cross-domain analysis model has identified a high-weight delay propagation relationship of "Redis hit rate decrease causing payment service response timeout," so Redis should still be included in the scope of awareness.

[0104] Based on the above analysis, a set of the most relevant basic perception models is dynamically selected, one for each reference operation and maintenance object, and fusion weights are configured for them.

[0105] The weighting strategy takes into account the following factors: the object's direct contribution to the operation and maintenance goals, which comes from the knowledge graph; whether there is an abnormal state or high-risk signal, which comes from the confidence output of the basic perception model; and the dependency weight between the object and other selected objects, which comes from the cross-domain association model.

[0106] Step S5) After the selected basic perception models are fused according to the fusion weights, they are connected with the intelligent decision generation model to obtain the operation and maintenance auxiliary model of the operation and maintenance target. The operation and maintenance auxiliary model generates operation and maintenance strategies based on the operation and maintenance related data of the operation and maintenance target.

[0107] The operation and maintenance assistance model can receive multi-source data related to operation and maintenance objectives in real time, dynamically integrate the outputs of various sensing channels, and automatically generate executable and interpretable operation and maintenance strategies based on context understanding.

[0108] A weighted fusion of several selected basic perception models is performed. Each basic perception model continuously outputs the state judgment result of the object it is responsible for, such as "normal" or "abnormal - type A", and the corresponding confidence score. Based on the preset fusion weights, a comprehensive state vector is generated using weighted voting, confidence-weighted averaging, or ensemble learning strategies. The vector not only reflects whether an anomaly exists, but also quantifies the contribution of different components to the overall health of the target. For example, in a scenario that ensures "payment success rate", if an LDAP latency anomaly (weight 0.35) and a WAF false interception alarm (weight 0.20) occur simultaneously, the fused state vector will highlight "high risk in authentication link" instead of simply listing two independent alarms.

[0109] The integrated state vector, along with raw operation and maintenance data fragments such as key indicator time series and log summaries, is encapsulated into a structured context input and fed into a pre-tuned intelligent decision generation model. The intelligent decision generation model, constrained by its built-in operation and maintenance strategy knowledge base and leveraging the reasoning and generation capabilities of a large language model, outputs operation and maintenance strategy suggestions in natural language form.

[0110] For example, the policy content typically includes: a problem diagnosis summary, such as "The increase in payment login failure rate is mainly caused by LDAP response latency and overly strict WAF policies"; recommended actions, such as temporarily expanding LDAP slave nodes, adjusting the sensitivity threshold of WAF rules, and enabling an alternative authentication caching mechanism; expected results and risk warnings, such as it is expected that the login failure rate can be reduced to below 0.05%, but attention should be paid to the cache consistency window period; and automation execution suggestions, such as calling an automated script to perform the above operations with one click.

[0111] On the other hand, this manual provides a comprehensive AI large-scale model foundation construction system based on multi-data fusion to assist in generating operation and maintenance strategies. Please refer to the appendix. Figure 6 ,include:

[0112] The acquisition module 100 constructs a multi-source heterogeneous data acquisition layer to collect operation and maintenance-related data from multiple preset devices through standardized protocols.

[0113] The fusion module 200 preprocesses the collected multi-source data 10 to generate a fused dataset 11.

[0114] The generation module 300, based on the fused dataset 11, constructs an AI large-scale model foundation 20, which includes multiple basic perception models, cross-domain correlation analysis models, and intelligent decision generation models, wherein:

[0115] The various basic perception models are used to identify abnormal patterns of multiple preset reference maintenance objects.

[0116] The cross-domain correlation analysis model analyzes the implicit dependencies between different reference operation and maintenance objects.

[0117] The intelligent decision generation model is used to receive the output results of multiple basic perception models and generate operation and maintenance strategies based on the output results;

[0118] Access module 400 obtains the operation and maintenance target, and selects several basic perception models and configures fusion weights based on the matching degree and implicit dependency relationship between the operation and maintenance target and multiple preset reference operation and maintenance objects.

[0119] The running module 500 fuses the selected basic perception models according to the fusion weights and then interfaces with the intelligent decision generation model to obtain the operation and maintenance auxiliary model of the operation and maintenance target. The operation and maintenance auxiliary model generates operation and maintenance strategies based on the operation and maintenance related data of the operation and maintenance target.

[0120] Please see Figure 7 The diagram shown is a structural schematic of an electronic device provided in an embodiment of this specification.

[0121] like Figure 7 As shown, the electronic device 1100 may include: at least one processor 1101, at least one network interface 1104, a user interface 1103, a memory 1105, and at least one communication bus 1102. The communication bus 1102 can be used to connect and communicate with the various components mentioned above. The user interface 1103 may include buttons, and optionally may include standard wired or wireless interfaces. The network interface 1104 may include, but is not limited to, a Bluetooth module, an NFC module, or a Wi-Fi module. The processor 1101 may include one or more processing cores. The processor 1101 connects to various parts within the electronic device 1100 using various interfaces and lines, and performs various functions of the routing device and processes data by running or executing instructions, programs, code sets, or instruction sets stored in the memory 1105, and by calling data stored in the memory 1105. Optionally, the processor 1101 may be implemented using at least one hardware form of DSP, FPGA, or PLA. The processor 1101 may integrate one or more combinations of CPU, GPU, and modem. The CPU primarily handles the operating system, user interface, and applications; the GPU is responsible for rendering and drawing the content that the display screen needs to show; and the modem is used for wireless communication.

[0122] It is understandable that the aforementioned modem may not be integrated into the processor 1101, but may be implemented using a separate chip.

[0123] The memory 1105 may include RAM or ROM. Optionally, the memory 1105 may include a non-transitory computer-readable medium. The memory 1105 may be used to store instructions, programs, code, code sets, or instruction sets. The memory 1105 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as touch function, sound playback function, image playback function, etc.), instructions for implementing the above-described method embodiments, etc.; the data storage area may store data involved in the above-described method embodiments, etc. Optionally, the memory 1105 may also be at least one storage device located remotely from the aforementioned processor 1101. As a computer storage medium, the memory 1105 may include an operating system, a network communication module, a user interface module, and application programs. The processor 1101 may be used to call the application programs stored in the memory 1105 and execute the methods in the above-described embodiments.

[0124] This specification also provides a computer-readable storage medium storing instructions that, when executed on a computer or processor, cause the computer or processor to perform multiple steps as described in the above embodiments. If the constituent modules of the above-described electronic device are implemented as software functional units and sold or used as independent products, they can be stored in the computer-readable storage medium.

[0125] This specification also provides a computer program product, including a computer program that, when executed by a processor, implements the multiple steps described in the above embodiments.

[0126] Where there is no conflict, the technical features in this embodiment and implementation scheme can be combined arbitrarily.

[0127] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented, in whole or in part, as a computer program product. The computer program product includes multiple computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this specification are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted through the computer-readable storage medium. The computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, Digital Subscriber Line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium accessible to a computer or a data storage device such as a server or data center integrating multiple available media. The available media may be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., digital versatile discs (DVDs)), or semiconductor media (e.g., solid-state drives (SSDs)).

[0128] When implemented through hardware or firmware, the aforementioned method flow is programmed into the hardware circuit to obtain the corresponding hardware circuit structure and achieve the corresponding function. For example, a Programmable Logic Device (PLD) (such as a Field Programmable Gate Array (FPGA)) is such an integrated circuit, whose logic function is determined by the user programming the device. Designers can program a digital system onto a PLD themselves, eliminating the need for chip manufacturers to design and fabricate dedicated integrated circuit chips. Furthermore, nowadays, instead of manually fabricating integrated circuit chips, this programming is mostly implemented using "logic compiler" software, similar to the software compiler used in program development. The original code before compilation must also be written in a specific programming language, called a Hardware Description Language (HDL). There is not just one HDL, but many. Those skilled in the art should understand that by simply performing some logic programming on the method flow using one of the aforementioned hardware description languages ​​and programming it into an integrated circuit, the hardware circuit implementing the logic method flow can be easily obtained.

[0129] The embodiments described above are merely preferred embodiments of this specification and are not intended to limit the scope of this specification. Any modifications and improvements made by those skilled in the art to the technical solutions of this specification without departing from the spirit of this specification should fall within the protection scope defined by the claims of this specification.

Claims

1. A method for constructing a comprehensive AI large-scale model foundation based on multi-data fusion, used to assist in generating operation and maintenance strategies, characterized in that, Includes the following steps: Construct a multi-source heterogeneous data acquisition layer to collect operation and maintenance-related data from multiple pre-set devices through standardized protocols; The collected multi-source data is preprocessed to generate a fused dataset; Based on the fused dataset, a large-scale AI model foundation is constructed, which includes multiple basic perception models, cross-domain correlation analysis models, and intelligent decision generation models, wherein: The various basic perception models are used to identify abnormal patterns of multiple preset reference maintenance objects. The cross-domain correlation analysis model analyzes the implicit dependencies between different reference operation and maintenance objects. The intelligent decision generation model is used to receive the output results of multiple basic perception models and generate operation and maintenance strategies based on the output results; Obtain the operation and maintenance target, and select several basic perception models and configure fusion weights based on the matching degree and implicit dependency relationship between the operation and maintenance target and multiple preset reference operation and maintenance objects; After the selected basic perception models are fused according to the fusion weights, they are connected with the intelligent decision generation model to obtain the operation and maintenance auxiliary model of the operation and maintenance target. The operation and maintenance auxiliary model generates operation and maintenance strategies based on the operation and maintenance related data of the operation and maintenance target.

2. The method for constructing a comprehensive AI large-scale model foundation based on multi-data fusion according to claim 1, characterized in that, The operation and maintenance related data includes operation status data, security logs, business metrics, fault alarms, and user behavior data; The plurality of devices include one or more of network security devices, data storage systems, business application platforms, smart terminal devices, and office automation devices.

3. The method for constructing a comprehensive AI large-scale model foundation based on multi-data fusion according to claim 1, characterized in that, The preprocessing includes cleaning, normalization, temporal alignment, and semantic mapping. Methods for performing semantic mapping include: Construct a unified operation and maintenance knowledge graph, which records the semantic relationships between device types, indicator categories, alarm levels, business processes, and user roles, and establish a unified semantic space based on the operation and maintenance knowledge graph; Based on the semantic similarity and semantic vectors of the context embedding of fields from multi-source data, the fields of multi-source data are mapped to the unified semantic space.

4. The method for constructing a comprehensive AI large-scale model foundation based on multi-data fusion according to claim 1, characterized in that, Methods for constructing basic perception models include: Collect and label the working data of each reference maintenance object, including both normal and abnormal states; Extract the time series features, frequency domain features, and several preset statistical features from the working data, and denot them as a feature set; The working data and its feature set are associated with status labels and used as sample data; Establish and train a machine learning model using the aforementioned sample dataset; Based on the trained machine learning model, a basic perception model corresponding to the reference operation and maintenance object is obtained.

5. The method for constructing a comprehensive AI large-scale model foundation based on multi-data fusion according to claim 4, characterized in that, Methods for constructing cross-domain association analysis models include: Based on the fused dataset, the state change sequences of multiple reference operation and maintenance objects in the time dimension are extracted, and the abnormal states of each reference operation and maintenance object are aligned on the time axis. Construct a cross-domain event graph, using the abnormal states of different reference operation and maintenance objects as nodes, and establish edge connections based on time proximity and business relationships to form an initial association structure; The cross-domain event graph is learned using a machine learning model to identify implicit dependencies between reference operation and maintenance objects. These implicit dependencies can be unidirectional, bidirectional, or delayed propagation. The implicit dependencies are assigned weights based on the attention mechanism, and a dependency rule base is generated based on the implicit dependencies and their weights. A cross-domain association analysis model is constructed based on the aforementioned dependency rule base.

6. The method for constructing a comprehensive AI large-scale model foundation based on multi-data fusion according to claim 5, characterized in that, Methods for constructing intelligent decision generation models include: Obtain the anomaly detection results and their confidence scores from multiple basic perception models, read the implicit dependencies and weights output by the cross-domain association analysis model, and construct a context vector; Based on historical operation and maintenance work orders, expert handling records, and strategy execution feedback records, an operation and maintenance strategy knowledge base is constructed. The knowledge base includes a mapping relationship between anomaly types, handling actions, and effect evaluation. Using the context vector as input and the operation and maintenance strategy knowledge base as constraints, the pre-connected natural language model is adjusted, and a strategy generation model is obtained based on the adjusted natural language model. The output of the strategy generation model is an operation and maintenance suggestion in natural language form.

7. A comprehensive AI large-scale model foundation construction system based on multi-data fusion, used to assist in generating operation and maintenance strategies, characterized in that, include: The data acquisition module constructs a multi-source heterogeneous data acquisition layer to collect operation and maintenance-related data from multiple preset devices through standardized protocols. The fusion module preprocesses the collected multi-source data to generate a fused dataset; The generation module, based on the fused dataset, constructs an AI large-scale model foundation. This foundation includes multiple basic perception models, cross-domain correlation analysis models, and intelligent decision generation models, wherein: The various basic perception models are used to identify abnormal patterns of multiple preset reference maintenance objects. The cross-domain correlation analysis model analyzes the implicit dependencies between different reference operation and maintenance objects. The intelligent decision generation model is used to receive the output results of multiple basic perception models and generate operation and maintenance strategies based on the output results; The access module obtains the operation and maintenance target, and selects several basic perception models and configures fusion weights based on the matching degree and implicit dependency relationship between the operation and maintenance target and multiple preset reference operation and maintenance objects. The running module fuses the selected basic perception models according to the fusion weights and then interfaces with the intelligent decision generation model to obtain the operation and maintenance auxiliary model for the operation and maintenance target. The operation and maintenance auxiliary model generates operation and maintenance strategies based on the operation and maintenance related data of the operation and maintenance target.

8. An electronic device, characterized in that, Including the processor and memory; The processor is connected to the memory; The memory is used to store executable program code; The processor runs a program corresponding to the executable program code stored in the memory to perform the method as described in any one of claims 1-6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1-6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1-6.

Images