Business anomaly detection model and business anomaly detection method based on multi-modal data fusion

Abstract

The invention provides a service anomaly detection model and a service anomaly detection method based on multi-modal data fusion, and belongs to the technical field of computers, and the method comprises the following steps: a user intention translation module analyzes an anomaly detection request input by a user to obtain a structured detection task; the multi-modal anomaly detection module drives the intelligent agent to process the business data according to the structured detection task to obtain an anomaly detection result; the anomaly detection information text generation module converts each anomaly detection result into a semantic anomaly detection information text based on a preset semantic rule tree; and the exception report generation module fuses the exception detection information texts to generate a fused text, and performs reasoning analysis on the fused text to generate an exception detection report. According to the method, a multi-agent collaborative detection framework driven by a large language model is constructed, so that end-to-end automatic analysis from the operation and maintenance intention of a user to explaining an abnormal diagnosis report is realized, and the accuracy of fault positioning and problem solving is improved.

Description

Multimodal data fusion business anomaly detection model and method Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a business anomaly detection model and method based on multimodal data fusion. Background Technology

[0002] In recent years, with the rapid evolution of computing paradigms such as cloud-native architecture, microservices, containerization, and service mesh, business systems are gradually moving from traditional monolithic structures to large-scale, distributed, and heterogeneous structures.

[0003] Current technologies for detecting business anomalies typically rely on feature engineering-based methods. These existing technologies often model only a single data source, such as analyzing only time-series metrics or processing only log text, failing to effectively utilize the correlation information inherent in multi-source heterogeneous data. This results in significant detection blind spots when dealing with complex faults that require combining multiple data sources for discovery. Summary of the Invention

[0004] This invention provides a multimodal data fusion business anomaly detection model and method to address the shortcomings of existing technologies, thereby improving the accuracy of fault location and problem solving.

[0005] This invention provides a multimodal data fusion business anomaly detection model, comprising: a user intent translation module, a multimodal anomaly detection module, an anomaly detection information text generation module, and an anomaly report generation module. The user intent translation module parses user-input anomaly detection requests to obtain structured detection tasks. The multimodal anomaly detection module drives an intelligent agent to process business data based on the structured detection tasks to obtain anomaly detection results. The anomaly detection information text generation module converts each anomaly detection result into semantic anomaly detection information text based on a preset semantic rule tree; wherein, the semantic rule tree is used to map the structured detection results into natural language descriptions. The anomaly report generation module merges each anomaly detection information text to generate a fused text, and performs reasoning analysis on the fused text to generate an anomaly detection report containing fault type judgment and reasoning processes.

[0006] According to a multimodal data fusion business anomaly detection model provided by the present invention, the multimodal anomaly detection module includes an intelligent agent collaboration module, a key performance analysis intelligent agent, a log analysis intelligent agent, and a traffic analysis intelligent agent. The intelligent agent collaboration module decomposes the structured detection task into multiple sub-tasks, each sub-task corresponding to a processing target. The processing targets include key performance analysis, log analysis, and traffic analysis. The intelligent agent collaboration module calls the intelligent agent corresponding to the processing target. The key performance analysis intelligent agent processes the time-series data of key performance indicators to obtain a first anomaly detection result. The log analysis intelligent agent processes log data to obtain a second anomaly detection result. The traffic analysis intelligent agent processes traffic data to obtain a third anomaly detection result.

[0007] According to a multimodal data fusion business anomaly detection model provided by the present invention, the key performance analysis agent includes a first input layer, a CNN convolutional layer, a pooling layer, a first LSTM layer, and a first output layer; the first input layer receives standardized time-series data of key performance indicators; the CNN convolutional layer performs convolution operations on the time-series data of key performance indicators to extract local time pattern features; the pooling layer performs dimensionality reduction on the local time pattern features to retain key feature information; the first LSTM layer performs time-series modeling on the pooled features to capture the long-term dependencies of key performance indicators; the first output layer performs classification based on the output of the first LSTM layer to generate the first anomaly detection result.

[0008] According to a multimodal data fusion business anomaly detection model provided by the present invention, the log analysis agent includes a second input layer, a Transformer layer, a second LSTM layer, a fully connected layer, and a second output layer. The second input layer receives preprocessed log data. The Transformer layer captures the global dependencies of sequences in the log data through a multi-head attention mechanism and generates a global feature representation. The second LSTM layer captures the time-series dependencies in the log data based on the global feature representation. The fully connected layer maps the output of the second LSTM layer to the prediction space and performs feature integration. The second output layer generates a second anomaly detection result containing anomaly judgment and anomaly type based on the output of the fully connected layer.

[0009] According to a multimodal data fusion business anomaly detection model provided by the present invention, the traffic analysis agent includes a third input layer, an embedding layer, a BiLSTM layer, an Attention layer, and a third output layer. The third input layer receives preprocessed traffic data containing multiple feature dimensions. The embedding layer reduces the dimensionality of the input features of the traffic data, converting them into a format suitable for processing by a bidirectional long short-term memory network. The BiLSTM layer processes the embedded traffic data, capturing the bidirectional temporal dependency features of the sequence. The Attention layer includes channel attention and temporal attention. The channel attention is used to adaptively adjust the importance weights of different traffic feature dimensions. The temporal attention is used to identify and enhance the feature representation of key time steps. The third output layer classifies the features weighted by the attention mechanism to generate the third anomaly detection result.

[0010] According to a multimodal data fusion business anomaly detection model provided by the present invention, the anomaly detection information text generation module includes a rule base construction unit, a state judgment unit, and a text conversion unit; the rule base construction unit performs cluster analysis on key performance indicators of historical normal data to construct a rule base; the state judgment unit performs state evaluation on the anomaly detection results based on the rule base to generate a state list; and the text conversion unit traverses the state list based on the semantic rule tree to generate the anomaly detection information text.

[0011] According to the multimodal data fusion business anomaly detection model provided by the present invention, the rule base construction unit performs cluster analysis on each key performance indicator from four dimensions: average value, fluctuation value, variance, and trend. The average value, fluctuation value, and variance are clustered using the K-means algorithm to obtain the range intervals of different clusters. The trend is determined by the number of extreme points to obtain trend state rules. The determination of the trend state rules includes: identifying maximum and minimum points by setting thresholds; when multiple maximum and minimum values ​​exist, it is determined to be a fluctuating trend; when only a single minimum value exists, it is determined to be a sudden downward trend; when only a single maximum value exists, it is determined to be a sudden upward trend.

[0012] According to a multimodal data fusion business anomaly detection model provided by the present invention, the status list includes status information of node attributes and link attributes; the status information of each attribute includes average value status, fluctuation value status, variance status and trend status; the status judgment unit determines the status level of each attribute by comparing the feature value of the data to be detected with the cluster range in the rule base.

[0013] According to a multimodal data fusion business anomaly detection model provided by the present invention, the semantic rule tree includes: a root node representing the fault type; a first-level child node representing the network indicator type; a second-level child node representing the feature dimension type; and a third-level child node representing the state level vocabulary. The text conversion unit generates the anomaly detection information text by traversing the semantic rule tree downward from the root node and combining the state information in the state list.

[0014] The present invention also provides a business anomaly detection method, comprising: inputting an anomaly detection request into a large language model to obtain an anomaly detection report output by the large language model, which includes fault type judgment and reasoning process; wherein, the large language model is a multimodal data fusion business anomaly detection model.

[0015] In summary, one or more technical solutions provided in the embodiments of this application have at least the following technical effects or advantages: By using a user intent translation module to parse natural language requests, the user's operational intent is automatically transformed into a structured detection task. By using a multimodal anomaly detection module to drive an intelligent agent to collaboratively process different types of business data, the limitations of single data source detection are overcome, and comprehensive analysis of heterogeneous data such as logs, traffic, and performance indicators is achieved, improving the coverage and accuracy of anomaly identification. By using an anomaly detection information text generation module to transform numerical detection results into semantic text, the problem of poor interpretability of the original detection results is solved, providing standardized input with clear semantics and contextual information for subsequent reasoning analysis. By using an anomaly report generation module to perform reasoning analysis on the fused information, an anomaly detection report containing fault type judgment and detailed reasoning process is generated, thereby improving the accuracy of fault location and problem solving. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0017] Figure 1 is a schematic diagram of the business anomaly detection model for multimodal data fusion provided by the present invention.

[0018] Figure 2 is a schematic diagram of the structure of the multimodal anomaly detection module provided by the present invention.

[0019] Figure 3 is a schematic diagram of the anomaly detection information text generation module provided by the present invention.

[0020] Figure 4 is a schematic diagram of the business anomaly detection process framework of a business anomaly detection model based on multimodal data fusion provided by the present invention.

[0021] Figure 5 is a flowchart illustrating the business anomaly detection method provided by this invention. Detailed Implementation

[0022] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0023] It should be noted that in the description of this invention, the terms "comprising," "including," or any other variations thereof are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element. The terms "upper," "lower," etc., indicating orientation or positional relationships according to the accompanying drawings, are only for the convenience of describing the invention and for simplifying the description, and do not indicate or imply that the system or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of the invention. Those skilled in the art can understand the specific meaning of the above terms in this invention according to the specific circumstances.

[0024] The terms "first," "second," etc., used in this invention are used to distinguish similar objects, not to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the invention can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first," "second," etc., are generally of the same class, without limiting the number of objects; for example, a first object can be one or more. Furthermore, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0025] The following description, in conjunction with Figures 1-5, illustrates the business anomaly detection model and method for multimodal data fusion provided by this invention.

[0026] Referring to Figure 1, which is a schematic diagram of the business anomaly detection model of multimodal data fusion provided by the present invention, the business anomaly detection model of multimodal data fusion includes: a user intent translation module, a multimodal anomaly detection module, an anomaly detection information text generation module, and an anomaly report generation module. The user intent translation module parses the anomaly detection request input by the user to obtain a structured detection task. The multimodal anomaly detection module drives the intelligent agent to process the business data according to the structured detection task to obtain anomaly detection results. The anomaly detection information text generation module converts each anomaly detection result into semantic anomaly detection information text based on a preset semantic rule tree. The semantic rule tree is used to map the structured detection results into natural language descriptions. The anomaly report generation module merges each anomaly detection information text to generate a fused text, and performs reasoning analysis on the fused text to generate an anomaly detection report containing fault type judgment and reasoning process.

[0027] In the specific implementation process, firstly, the user intent translation module receives anomaly detection requests input by the user in natural language form, such as "analyze application response time" or "analyze network latency." The user intent translation module parses the received anomaly detection requests and transforms them into explicit structured detection tasks.

[0028] Next, the multimodal anomaly detection module receives the aforementioned structured detection task and drives multiple internal agents to process and analyze business data (such as key performance indicators, logs, traffic, etc.) of different modalities according to the task content, thereby obtaining their respective anomaly detection results.

[0029] Then, the anomaly detection information text generation module receives these anomaly detection results from different agents. Using a pre-defined semantic rule tree, the anomaly detection information text generation module maps and converts these structured, raw detection results one by one into semantic anomaly detection information text.

[0030] Finally, the anomaly report generation module collects all semantic anomaly detection information text generated by the anomaly detection information text generation module and merges the collected semantic anomaly detection information text into a unified fused text. The anomaly report generation module then performs in-depth reasoning analysis on the generated fused text, and finally generates a complete anomaly detection report. The report clearly indicates the fault type judgment and the detailed reasoning process for obtaining the fault type judgment.

[0031] By employing the above technical solutions, a closed-loop anomaly detection process was constructed, encompassing natural language intent understanding and intelligent report generation. The user intent-to-text translation module automatically converts natural language into structured tasks, lowering the system's barrier to entry. The multimodal anomaly detection module ensures comprehensive analysis of heterogeneous data. The anomaly detection information text generation module provides interpretable semantic input for subsequent reasoning and analysis. The anomaly report generation module, through fusion and reasoning, outputs decision support information with in-depth analysis. This design achieves end-to-end automated processing of operational tasks, improving the systematic nature and response efficiency of the detection process.

[0032] In a preferred embodiment, referring to Figure 2, which is a schematic diagram of the multimodal anomaly detection module provided by the present invention, the multimodal anomaly detection module includes an agent collaboration module, a key performance analysis agent, a log analysis agent, and a traffic analysis agent. The agent collaboration module decomposes the structured detection task into multiple sub-tasks, each sub-task corresponding to a processing target. The processing targets include key performance analysis, log analysis, and traffic analysis. The agent collaboration module calls the agent corresponding to the processing target. The key performance analysis agent processes the time-series data of key performance indicators to obtain a first anomaly detection result. The log analysis agent processes log data to obtain a second anomaly detection result. The traffic analysis agent processes traffic data to obtain a third anomaly detection result.

[0033] In the specific implementation process, the intelligent agent collaboration module first analyzes the received structured detection task and breaks it down into multiple sub-tasks. For example, a comprehensive detection task is broken down into sub-tasks targeting performance indicators, sub-tasks targeting log information, and sub-tasks targeting network traffic.

[0034] Next, the agent collaboration module calls the corresponding agent to perform the detection based on the processing goal of each subtask.

[0035] If the processing objective of a subtask is key performance analysis, the agent collaboration module invokes the key performance analysis agent. The key performance analysis agent receives time-series data of key performance indicators from the business system, processes the time-series data, and generates the first anomaly detection result.

[0036] If the processing objective of a subtask is log analysis, the agent collaboration module invokes the log analysis agent. The log analysis agent receives the system's log data, processes the log data, and generates a second anomaly detection result.

[0037] If the processing objective of a subtask is traffic analysis, the agent collaboration module invokes the traffic analysis agent. The traffic analysis agent receives network traffic data, processes the data, and generates a third anomaly detection result. Finally, the generated first, second, and third anomaly detection results are transmitted to the anomaly detection information text generation module for further processing.

[0038] By employing the above technical solution, a framework consisting of an intelligent agent collaboration module and multiple dedicated intelligent agents is constructed to achieve collaborative analysis of multimodal business data. This design overcomes the limitations of traditional single detection models in terms of data coverage. Dedicated intelligent agents are designed to process three different types of heterogeneous data—key performance indicators, logs, and traffic—ensuring the depth and accuracy of analysis for each data modality. Simultaneously, the introduction of the intelligent agent collaboration module enables dynamic task allocation and on-demand activation, allowing the system to flexibly allocate resources according to specific detection intentions. This achieves global awareness of complex faults and highly robust task execution, thereby improving the comprehensiveness and accuracy of anomaly identification.

[0039] In a preferred embodiment, the key performance analysis agent includes a first input layer, a CNN convolutional layer, a pooling layer, a first LSTM layer, and a first output layer. The first input layer receives standardized time-series data of key performance indicators. The CNN convolutional layer performs convolution operations on the time-series data of key performance indicators to extract local time pattern features. The pooling layer reduces the dimensionality of the local time pattern features while retaining key feature information. The first LSTM layer performs time-series modeling on the pooled features to capture the long-term dependencies of key performance indicators. The first output layer performs classification based on the output of the first LSTM layer to generate a first anomaly detection result.

[0040] In the specific implementation process, after the key performance analysis agent is activated, it first receives time-series data of key performance indicators from the business system through the first input layer, such as sequences of indicators like packet loss rate, bit error rate, or buffer size. This time-series data has undergone standardization preprocessing to eliminate the impact of differences in the units of measurement between different indicators on model training, forming a uniform-scale input sequence. Subsequently, the input sequence is fed into a CNN convolutional layer. The CNN convolutional layer applies one or more wide convolutional kernels, performing sliding convolution operations along the time dimension of the input sequence. This operation can effectively capture and extract local pattern features within a short time range in the indicator sequence, such as instantaneous performance fluctuations or spikes. The output of the convolution operation is a set of feature maps, each representing a recognized local temporal pattern.

[0041] Next, the local temporal pattern features extracted by the CNN convolutional layers are fed into the pooling layers. The pooling layers perform dimensionality reduction operations on the input feature maps, such as max pooling. This operation preserves the most salient feature information by selecting the maximum value within a local region of the feature map, while reducing the computational burden on subsequent network layers and enhancing the model's robustness to small changes in feature location. After processing by the pooling layers, a lower-dimensional feature sequence containing key information is obtained. This feature sequence is then input into the first LSTM layer. The first LSTM layer processes the input feature sequence sequentially over time. Through internal gating units (input gate, forget gate, output gate), the first LSTM layer can learn and retain long-term historical information related to the current anomaly judgment, while filtering out irrelevant information, thereby effectively capturing the evolution trend and dependencies of key performance indicators over a longer time span.

[0042] Finally, the output of the first LSTM layer is passed to the first output layer. The output of the first LSTM layer is a high-dimensional feature vector containing the short-term and long-term dependencies of the sequence. The first output layer receives this feature vector and performs the final classification by passing it through a fully connected network layer and an activation function (e.g., the Softmax function). The classification result maps the state of the input data to a predefined anomaly category, such as "normal" or "abnormal," and uses this as the first anomaly detection result output.

[0043] By employing the above technical solution and combining the structure of CNN convolutional layers and the first LSTM layer, the accuracy and robustness of anomaly detection in time-series data of key performance indicators are improved. CNN convolutional layers effectively extract short-term local variation features from the indicator sequence, while the first LSTM layer excels at modeling time series to capture long-term dependencies. This combination enables the key performance analysis agent to identify both short-term, sudden anomalies and long-term trend anomalies, ensuring comprehensive detection. Furthermore, the CNN convolutional and pooling layers reduce data dimensionality while extracting features, making the data processed by the subsequent first LSTM layer more compact and improving the overall computational efficiency of the agent.

[0044] In a preferred embodiment, the log analysis agent includes a second input layer, a Transformer layer, a second LSTM layer, a fully connected layer, and a second output layer. The second input layer receives preprocessed log data. The Transformer layer captures the global dependencies of sequences in the log data through a multi-head attention mechanism and generates a global feature representation. The second LSTM layer captures the time-series dependencies in the log data based on the global feature representation. The fully connected layer maps the output of the second LSTM layer to the prediction space and performs feature integration. The second output layer generates a second anomaly detection result containing anomaly judgment and anomaly type based on the output of the fully connected layer.

[0045] In the implementation process, after the log analysis agent is activated, it first receives log data from the business system through the second input layer. The log data has been preprocessed, including transforming the unstructured raw log text into structured sequence data. For example, the Continuous Bag of Words (CBOW) model converts the words in the log template into word embedding vectors, forming a numerical sequence that can be processed by the neural network. Subsequently, the preprocessed log data sequence is fed into the Transformer layer. The self-attention mechanism inside the Transformer layer calculates the association weights between all word vectors in the sequence, thereby capturing global dependencies within log statements or between log sequences without distance limitations. For example, the association between an error code and its cause description at the far end of the log message can be effectively identified. After processing by the multi-head attention mechanism, the model generates a global feature representation containing rich contextual information.

[0046] Next, the global feature representation generated by the Transformer layer is input into the second LSTM layer. The second LSTM layer processes the input feature sequence in temporal order. Through internal gating units, the second LSTM layer learns and models the evolution patterns of the log sequence over time, effectively capturing the long-term and short-term temporal dependencies between log events. This step complements the Transformer layer's understanding of global semantics, adding awareness of temporal dynamics. After processing, the output of the second LSTM layer—a feature vector that integrates global semantics and temporal dynamics—is passed to the fully connected layer. The fully connected layer performs a non-linear transformation on the feature vector, mapping the features from the output space of the second LSTM layer to a more easily classified prediction space. This process achieves the final integration of features from different sources.

[0047] Finally, the features integrated by the fully connected layer are fed into the second output layer. The second output layer uses a classification function (such as the Softmax function) to discriminate the input features. The output of the second output layer is the second anomaly detection result, which includes not only a binary judgment of whether the current log sequence is abnormal, but also a classification of the specific anomaly type, such as "configuration error" or "resource bottleneck".

[0048] By employing the aforementioned technical solution, combining the Transformer layer with a second LSTM layer, dual deep modeling of log data semantics and temporal sequence is achieved. The Transformer layer captures the core semantic relationships of log content from a global perspective, compensating for the shortcomings of traditional sequence models in handling long-distance dependencies. The second LSTM layer, building upon this, further captures the dynamic patterns of log events evolving over time. This combination enables the log analysis agent to gain a deeper understanding of log data, significantly improving the accuracy of anomaly detection and outputting detection results containing specific anomaly types, providing richer contextual information for subsequent fault diagnosis.

[0049] In a preferred embodiment, the traffic analysis agent includes a third input layer, an embedding layer, a BiLSTM layer, an attention layer, and a third output layer. The third input layer receives preprocessed traffic data containing multiple feature dimensions. The embedding layer reduces the dimensionality of the input features of the traffic data, converting them into a format suitable for processing by a bidirectional long short-term memory network. The BiLSTM layer processes the embedded traffic data, capturing the bidirectional temporal dependency features of the sequence. The attention layer includes channel attention and temporal attention. Channel attention is used to adaptively adjust the importance weights of different traffic feature dimensions. Temporal attention is used to identify and enhance the feature representations of key time steps. The third output layer classifies based on the attention-weighted features to generate a third anomaly detection result.

[0050] In practice, after the traffic analysis agent is activated, it first receives preprocessed network traffic data through the third input layer. The traffic data is a time series, with each time step containing multiple feature dimensions, such as source IP address, destination port, protocol type, packet size, and packet rate. The preprocessing step converts these raw features into numerical vectors. Subsequently, the multidimensional feature vector sequence is fed into the embedding layer. The embedding layer performs dimensionality reduction on the input feature vectors, mapping them from a high-dimensional sparse space to a low-dimensional dense space, generating an embedding vector sequence. This step not only reduces the computational complexity of the model but also helps capture the inherent correlations between different features and converts the data into a format suitable for processing by the BiLSTM layer.

[0051] Next, the sequence of embedding vectors generated by the embedding layer is fed into the BiLSTM layer. The BiLSTM layer consists of a forward LSTM and a backward LSTM. The forward LSTM processes the data sequentially from the beginning to the end of the sequence, capturing the influence of past information on the current state; the backward LSTM processes the data in reverse order, from the end to the beginning of the sequence, capturing the influence of future information on the current state. By combining the outputs from both directions, the BiLSTM layer generates a hidden state for each time step in the sequence that includes both past and future contextual information, thus comprehensively capturing the bidirectional temporal dependency features of the traffic data.

[0052] The output sequence of the BiLSTM layer is then passed to the Attention layer for weighted processing. The Attention layer works in two parallel parts. First, the channel attention mechanism analyzes the importance of different traffic feature dimensions (channels) at each time step. For example, when detecting DDoS attacks, the channel attention mechanism automatically assigns higher weights to key features such as packet rate. Second, the temporal attention mechanism analyzes the entire time series to identify the most critical time steps for anomaly detection. For example, at the starting point of a traffic surge, the temporal attention mechanism assigns higher attention to that time point. Through the combined effect of channel attention and temporal attention, the model generates a weighted feature representation that highlights the most critical feature information at the most critical moments.

[0053] Finally, the weighted feature representations from the Attention layer are fed into the third output layer. The third output layer typically consists of one or more fully connected layers and a classifier. The classifier (e.g., a sigmoid or softmax function) performs the final discrimination on the input weighted features, generating the third anomaly detection result. The result can be a binary classification (normal / abnormal) or a multi-class classification (normal / DDoS attack / SQL injection, etc.).

[0054] By employing the above technical solution and combining BiLSTM layers and a dual attention mechanism, the accuracy of traffic anomaly detection is significantly improved. The BiLSTM layer can capture the temporal features of traffic data from both forward and backward directions, providing richer contextual information compared to unidirectional models. The introduction of the attention layer is a key aspect of this implementation. The attention layer enables the model to automatically focus on the most suspicious feature dimensions and the most critical time points, like an expert, while ignoring irrelevant noise. This focusing ability not only improves detection accuracy but also enhances the model's ability to identify complex and unknown attack patterns, thereby achieving high-precision traffic anomaly diagnosis.

[0055] In a preferred embodiment, referring to Figure 3, which is a schematic diagram of the anomaly detection information text generation module provided by the present invention, the anomaly detection information text generation module includes a rule base construction unit, a state judgment unit, and a text conversion unit. The rule base construction unit performs cluster analysis on key performance indicators of historical normal data to construct a rule base. The state judgment unit evaluates the anomaly detection results based on the rule base and generates a state list. The text conversion unit traverses the state list based on a semantic rule tree to generate anomaly detection information text.

[0056] In practice, the workflow is divided into two stages: offline construction of the rule base and online generation of anomaly information. First, in the offline construction stage, the rule base construction unit collects a large amount of historical business data under normal operating conditions and extracts key performance indicators. Further cluster analysis is performed on these key performance indicators to construct the rule base.

[0057] Secondly, during online anomaly detection, the state judgment unit receives raw numerical anomaly detection results from the key performance analysis agent, log analysis agent, or traffic analysis agent. For a key performance indicator to be detected, the state judgment unit calculates the specific values ​​of the indicator in four dimensions: mean, fluctuation, variance, and trend. Subsequently, the state judgment unit queries the rule base, comparing the calculated value of each dimension with the cluster range of the corresponding indicator in the rule base to determine the state level of the dimension (e.g., "normal," "high," "low"). After completing the state evaluation of all relevant node and link attribute indicators, the state judgment unit integrates all results to generate a structured state list.

[0058] Next, the text conversion unit receives the status list. The text conversion unit traverses and parses the contents of the status list based on a pre-defined semantic rule tree. The root node of the semantic rule tree represents a fault, followed by child nodes of network metric types, child nodes of feature dimension types, and leaf nodes of status level terms. Starting from the root node, the text conversion unit traverses downwards along the tree structure according to the network metrics, feature dimensions, and status levels specified in the status list, finding the corresponding path. During the traversal, the text conversion unit combines the node information on the path with the specific values ​​in the status list to generate a descriptive statement conforming to natural language grammar. For example, when the status list shows that the "average" status of "link packet loss rate" is "high," the text conversion unit generates text similar to "The average packet loss rate of the link is high." The text conversion unit repeats this process for all entries in the status list, ultimately assembling all generated statements into a complete, semantically meaningful anomaly detection information text.

[0059] In one specific implementation, the rule base construction unit performs cluster analysis on each key performance indicator from four dimensions: average value, fluctuation value, variance, and trend. The average value, fluctuation value, and variance are clustered using the K-means algorithm to obtain the range intervals of different clusters. The trend is determined by the number of extreme points to obtain trend state rules. The determination of trend state rules includes: identifying maximum and minimum points by setting thresholds; when multiple maximum and minimum values ​​exist, it is determined to be a fluctuating trend; when only a single minimum value exists, it is determined to be a sudden downward trend; and when only a single maximum value exists, it is determined to be a sudden upward trend.

[0060] In the specific implementation process, the rule base construction unit first obtains a large amount of time-series data on key performance indicators of business systems under normal operating conditions from the historical database. For the three dimensions of mean, fluctuation, and variance, the rule base construction unit performs the following operations: First, for each historical normal data sample (represented as a sequence)... ), calculate the average value of each specific key performance indicator. Fluctuation value and variance The calculation formula is as follows: Average value: Fluctuation value: ;variance: By performing the above calculations on a large number of samples, a set of numerous values ​​is formed for each dimension. Then, the rule base construction unit independently applies the K-means algorithm to each set of values. For example, all calculated average data are input into the K-means algorithm, which automatically clusters these averages into a preset number of clusters. After clustering, the range of values ​​covered by each cluster is recorded, and this range is associated with the corresponding status label (e.g., "normal" or "high") and stored in the rule base. The same clustering and recording process is repeated for fluctuation values ​​and variance data.

[0061] Regarding the trend dimension The rule base construction unit performs the following operations: First, to reduce the interference of data noise on trend judgment, a threshold H needs to be set. This threshold H is determined by taking the average of the variances of multiple sets of time series data under normal conditions. Next, for a segment of time series data (represented as a sequence)... The rule base building unit traverses data points to identify valid maxima and minima. A data point... Whether a point is an extreme point can be determined using the following formula: Then, the total number of maxima and minima is determined using the following formula. : Finally, the trend status rules are applied based on the number of extreme points: if there are multiple maximum and minimum points in the sequence, the current trend is judged to be a fluctuating trend; if there is only one minimum point in the sequence, it is judged to be a sudden downward trend; if there is only one maximum point in the sequence, it is judged to be a sudden upward trend.

[0062] Finally, the range intervals and trend judgment rules of all clusters are stored together to form a rule base.

[0063] In one specific implementation, the status list contains status information of node attributes and link attributes; the status information of each attribute includes average status, fluctuation status, variance status and trend status; the status judgment unit determines the status level of each attribute by comparing the feature value of the data to be detected with the cluster range in the rule base.

[0064] In the specific implementation process, the state determination unit first receives numerical detection results from the multimodal anomaly detection module. For a key performance indicator to be detected (such as the "Packet Loss Rate" of a link), the state determination unit calculates the specific feature values ​​of the indicator in four dimensions: mean, volatility, variance, and trend. Subsequently, the state determination unit performs state evaluation on each feature value according to a pre-built rule base. For example, the state determination unit compares the calculated average value of the "Packet Loss Rate" with the cluster range defined in the rule base for the average value dimension of that indicator to determine the cluster it falls into. Each cluster corresponds to a numerical state level; for example, level "3" represents "extremely high". The state determination unit performs the same matching and level determination operations on the volatility, variance, and trend dimensions. By iterating through all relevant node attributes and link attributes, the state determination unit finally generates a complete state list. The status list records the status levels of each indicator in four dimensions in tabular form. For example, the "PacketLoss Rate" entry in the link attribute may be recorded as {average: 3, Jitter: 3, variance: -3, trend: 2}.

[0065] Next, the text conversion unit receives the aforementioned state list and converts the list content into natural language descriptions based on a pre-defined semantic rule tree. The semantic rule tree is pre-built, and its construction process is as follows: First, a root node representing "fault" is defined. Second, a vocabulary list of network metric terms is maintained (e.g., {packet loss rate, bits error rate, ...}), and a first-level child node (Tree Node) is created for each network metric in the list as a child node of the root node. Then, a vocabulary list of feature dimension terms is maintained (e.g., {average value, fluctuation, trend, ...}), and the terms in the list are added as second-level child nodes (Tree Node1) to the corresponding network metric node. Finally, multiple state level vocabulary lists are maintained, such as the vocabulary list describing the average state zbs=[normal, slightly high, high, extremely high, ...] and the vocabulary list describing the trend state zbss=["up", "down", "jitter", ...]. Each term in these vocabulary lists is added as a third-level child node (Tree Node2) to the corresponding feature dimension node, thus constructing a complete and hierarchically clear semantic rule tree.

[0066] In one specific implementation, the semantic rule tree includes: a root node representing the fault type; first-level child nodes representing the network indicator type; second-level child nodes representing the feature dimension type; and third-level child nodes representing state-level words. The text conversion unit generates anomaly detection information text by traversing the semantic rule tree downwards from the root node and combining the state information in the state list.

[0067] In the specific implementation process, the text conversion unit filters out entries of abnormal network entities from the state list when generating text. For each abnormal entry, the text conversion unit traverses downwards from the root node of the semantic rule tree. Taking the "average" state level of "Packet Loss Rate" in the state list as "3" as an example, the text conversion unit first locates the "packet loss rate" node in the first-level child nodes, then locates the "averagevalue" node below it, and finally finds the state word (e.g., "extremely high") in the corresponding state level vocabulary list zbs based on the state level "3", and locates the third-level child node corresponding to that word. After completing the path traversal, the text conversion unit combines the node information on the path with the preset syntax to generate a descriptive sentence, such as "The packet loss rate's average value is extremely high."

[0068] For certain specific indicators, the text conversion unit also incorporates the specific numerical information recorded in the status list into the generated sentence to provide a more detailed explanation. The text conversion unit repeats the above traversal and sentence generation process for all entries in the status list. Finally, all generated descriptive statements are compiled together to form a well-structured and semantically complete anomaly detection information text.

[0069] To facilitate understanding and implementation of this invention by those skilled in the art, the business anomaly detection process of this invention is further illustrated below with reference to Figure 4. Figure 4 is a schematic diagram of the business anomaly detection process framework of a business anomaly detection model based on multimodal data fusion provided by this invention.

[0070] The process begins with the user inputting an anomaly detection request, and goes through stages such as intent understanding, task decomposition, multi-agent anomaly detection, and anomaly report generation, forming a closed-loop intelligent detection system.

[0071] First, the user inputs anomaly detection requests into the system in natural language, such as "Check if the network status at time point A is abnormal." This input request is fed into the Large Language Model (LLM), where the intent understanding module analyzes and identifies the user's intent, extracting key task information. Based on the Chain of Thought (COT) mechanism, the intent understanding module subdivides the complex anomaly detection task into multiple executable subtasks, including log detection, traffic detection, and performance metric detection.

[0072] Subsequently, the task decomposition yields multiple subtasks, each corresponding to a different agent in the multi-agent architecture: the log detection agent is responsible for anomaly analysis of log data, the traffic detection agent is responsible for network traffic data detection, and the performance detection agent is responsible for monitoring key performance indicators (KPIs). Each agent independently processes its assigned multimodal data, using dedicated models to perform log analysis, traffic analysis, and KPI analysis, thereby obtaining the corresponding anomaly detection results.

[0073] The anomaly detection results obtained from each agent are processed by the semantic representation module and converted into structured anomaly detection information text. Based on a rule base, the semantic representation module normalizes and semantically represents the information in the anomaly state list, forming text fragments describing the network's anomaly states. Then, the sentence generation module combines these text fragments into complete anomaly information description sentences, ensuring the coherence and accuracy of the anomaly information expression.

[0074] During the anomaly report generation phase, based on the semantic information output by the multi-agent system, the system generates prompt text for reasoning in the large language model, constructing a prompt that includes context, question, and options to guide the large language model in fault type judgment and reasoning analysis. Based on the input prompt text, the large language model integrates the detection results from different modalities and outputs an anomaly detection report containing the anomaly type judgment result and a detailed reasoning process.

[0075] To further verify the comprehensive effectiveness of multi-agent collaboration in improving report quality, this embodiment designed an ablation experiment. The experiment constructed three detection methods: single-agent, collaboration between any two agents, and complete collaboration among three agents. The Rouge scoring mechanism was used to evaluate the quality of the generated anomaly detection reports. Refer to Table 1, which is the detection report evaluation table.

[0076] Table 1 Test Report Evaluation Form

[0077] As shown in Table 1, each agent has its shortcomings when analyzing single-modal data (single agent). For example, the recall rate of the ROUGE-1 report generated by the log analysis agent is only 0.39, indicating insufficient information coverage; the accuracy rate of the ROUGE-1 report generated by the critical performance analysis agent is only 0.55, indicating that the accuracy of the content needs to be improved. When two agents are used for collaborative detection, the report quality is improved in several dimensions, but problems such as insufficient information fusion still exist. When three agents—critical performance analysis agent, log analysis agent, and traffic analysis agent—collaborate for detection, they achieve the highest recall and accuracy rates for ROUGE-1, ROUGE-2, and ROUGE-L.

[0078] Experimental results demonstrate the significant advantages of the multi-agent anomaly analysis architecture for collaborative analysis of multimodal network data. Through collaborative perception and fusion analysis of multimodal network data, including traffic, logs, and key performance metrics, it effectively alleviates the blind spots in anomaly identification caused by the limitations of single-modal information perception, thereby enhancing the coverage of complex network states by the detection system. Simultaneously, semantic complementarity and redundancy verification among the outputs of different agents strengthen the logical consistency and interpretability of anomaly judgments, thus comprehensively improving the accuracy and reliability of anomaly detection reports.

[0079] The present invention also provides a business anomaly detection method. Referring to Figure 5, which is a flowchart of the business anomaly detection method provided by the present invention, the method includes the following steps: Step 101: Input the anomaly detection request into the large language model to obtain the anomaly detection report output by the large language model, which includes the fault type judgment and reasoning process.

[0080] It should be noted that the "large language model" refers to the complete, holistic multimodal data fusion business anomaly detection model described in the foregoing embodiments of this invention. This multimodal data fusion business anomaly detection model integrates multiple functional modules, including user intent translation, multimodal anomaly detection, anomaly information text generation, and final report generation. From an external perspective, the multimodal data fusion business anomaly detection model receives a natural language request as input and outputs a complete analysis report. Its overall operation resembles a large language model specifically designed for the field of business anomaly detection.

[0081] In practice, a user first submits an anomaly detection request in natural language, such as "Analyze whether there is any suspicious behavior in the current network." This request is used as initial input to the multimodal data fusion business anomaly detection model. Within the model, the user intent translation module first parses the input anomaly detection request, breaking it down into structured detection sub-tasks targeting multiple dimensions such as logs, traffic, and key performance indicators. Next, the multimodal anomaly detection module, based on these sub-tasks, schedules corresponding log analysis agents, traffic analysis agents, and performance anomaly detection agents to process the real-time collected multimodal business data in parallel, generating their respective numerical anomaly detection results. Then, the anomaly detection information text generation module receives these numerical results and, using its internal rule base and semantic rule tree, transforms them into semantic, human-readable anomaly detection information text. Finally, the anomaly report generation module merges all the semantic information text and uses its internal large language model for comprehensive reasoning and analysis, ultimately generating a complete anomaly detection report. This anomaly detection report is output as the final result from the multimodal data fusion business anomaly detection model.

[0082] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A business anomaly detection model based on multimodal data fusion, characterized in that, It includes a user intent translation module, a multimodal anomaly detection module, an anomaly detection information text generation module, and an anomaly report generation module; the user intent translation module parses the anomaly detection request input by the user to obtain a structured detection task; The multimodal anomaly detection module drives the intelligent agent to process business data according to the structured detection task to obtain anomaly detection results; the anomaly detection information text generation module converts each anomaly detection result into semantic anomaly detection information text based on a preset semantic rule tree; wherein, the semantic rule tree is used to map the structured detection results into natural language descriptions; the anomaly report generation module merges each anomaly detection information text to generate a fused text, and performs reasoning analysis on the fused text to generate an anomaly detection report containing fault type judgment and reasoning process.

2. The business anomaly detection model based on multimodal data fusion according to claim 1, characterized in that, The multimodal anomaly detection module includes an agent collaboration module, a key performance analysis agent, a log analysis agent, and a traffic analysis agent. The agent collaboration module decomposes the structured detection task into multiple sub-tasks, each sub-task corresponding to a processing target. The processing targets include key performance analysis, log analysis, and traffic analysis. The agent collaboration module calls the agent corresponding to the processing target. The key performance analysis agent processes the time-series data of key performance indicators to obtain the first anomaly detection result; The log analysis agent processes the log data to obtain a second anomaly detection result; The traffic analysis agent processes the traffic data to obtain a third anomaly detection result.

3. The business anomaly detection model based on multimodal data fusion according to claim 2, characterized in that, The key performance analysis agent includes a first input layer, a CNN convolutional layer, a pooling layer, a first LSTM layer, and a first output layer. The first input layer receives standardized time-series data of key performance indicators. The CNN convolutional layer performs convolution operations on the time-series data of key performance indicators to extract local time pattern features. The pooling layer reduces the dimensionality of the local time pattern features and retains key feature information. The first LSTM layer performs time-series modeling on the pooled features to capture the long-term dependencies of key performance indicators. The first output layer performs classification based on the output of the first LSTM layer to generate the first anomaly detection result.

4. The business anomaly detection model based on multimodal data fusion according to claim 2, characterized in that, The log analysis agent includes a second input layer, a Transformer layer, a second LSTM layer, a fully connected layer, and a second output layer. The second input layer receives preprocessed log data. The Transformer layer captures the global dependencies of sequences in the log data through a multi-head attention mechanism and generates a global feature representation. The second LSTM layer captures the time-series dependencies in the log data based on the global feature representation. The fully connected layer maps the output of the second LSTM layer to the prediction space for feature integration. The second output layer generates a second anomaly detection result, which includes anomaly judgment and anomaly type, based on the output of the fully connected layer.

5. The business anomaly detection model based on multimodal data fusion according to claim 2, characterized in that, The traffic analysis agent comprises a third input layer, an embedding layer, a BiLSTM layer, an attention layer, and a third output layer. The third input layer receives preprocessed traffic data containing multiple feature dimensions. The embedding layer reduces the dimensionality of the input features of the traffic data, converting them into a format suitable for processing by a bidirectional long short-term memory network. The BiLSTM layer processes the embedded traffic data, capturing the bidirectional temporal dependency features of the sequence. The attention layer includes channel attention and temporal attention. Channel attention is used to adaptively adjust the importance weights of different traffic feature dimensions. Temporal attention is used to identify and enhance the feature representations of key time steps. The third output layer classifies the features weighted by the attention mechanism, generating the third anomaly detection result.

6. The business anomaly detection model based on multimodal data fusion according to claim 1, characterized in that, The anomaly detection information text generation module includes a rule base construction unit, a status judgment unit, and a text conversion unit; the rule base construction unit performs cluster analysis on key performance indicators of historical normal data to construct a rule base; the status judgment unit performs status evaluation on the anomaly detection results based on the rule base and generates a status list. The text conversion unit traverses the state list based on the semantic rule tree to generate the anomaly detection information text.

7. The business anomaly detection model based on multimodal data fusion according to claim 6, characterized in that, The rule base construction unit performs cluster analysis on each key performance indicator from four dimensions: average value, fluctuation value, variance, and trend. The average value, fluctuation value, and variance are clustered using the K-means algorithm to obtain the range intervals of different clusters. The trend is determined by the number of extreme points to obtain trend state rules. The determination of the trend state rules includes: identifying maximum and minimum points by setting thresholds; when multiple maximum and minimum values ​​exist, it is determined to be a fluctuating trend; when only a single minimum value exists, it is determined to be a sudden downward trend; when only a single maximum value exists, it is determined to be a sudden upward trend.

8. The business anomaly detection model based on multimodal data fusion according to claim 6, characterized in that, The status list contains status information for node attributes and link attributes; the status information for each attribute includes average status, fluctuation status, variance status, and trend status; the status judgment unit determines the status level of each attribute by comparing the feature values ​​of the data to be detected with the cluster range in the rule base.

9. The business anomaly detection model based on multimodal data fusion according to claim 6, characterized in that, The semantic rule tree includes: a root node representing the fault type; first-level child nodes representing the network indicator type; second-level child nodes representing the feature dimension type; and third-level child nodes representing state-level words. The text conversion unit generates the anomaly detection information text by traversing the semantic rule tree downwards from the root node and combining the state information in the state list.

10. A method for detecting business anomalies, characterized in that, include: An anomaly detection request is input into a large language model to obtain an anomaly detection report output by the large language model, which includes fault type judgment and reasoning processes; wherein, the large language model is the multimodal data fusion business anomaly detection model as described in any one of claims 1 to 9.

Images