Fault diagnosis method and device based on causal state space hints, medium and electronic equipment

Abstract

This application provides a fault diagnosis method, apparatus, medium, and electronic device based on causal state space prompts, relating to the field of data processing. The method includes: mapping each IT operation and maintenance event to an event feature vector; inputting the vectors into an online state space model in chronological order, outputting the latent state corresponding to each time step; in response to receiving an IT operation and maintenance diagnosis request, mapping the latent state corresponding to the current time step to several discrete state words; concatenating the problem description corresponding to the IT operation and maintenance service interruption, the IT operation and maintenance events occurring within the target time window, and several discrete state words into a target prompt, and inputting it into a frozen large language model to obtain the fault diagnosis result. This application possesses the advantages of natural language reasoning in large language models while avoiding the illusion problem caused by limited context windows and missing key causal information. Furthermore, the use of a frozen large language model significantly reduces training costs and computational consumption.

Description

Technical Field

[0001] This application belongs to the field of data processing, and in particular relates to fault diagnosis methods, devices, media and electronic equipment based on causal state space hints. Background Technology

[0002] Modern IT services generate massive amounts of heterogeneous telemetry data, including underlying system logs, service-level structured logs, traces, metric-based alerts, and manually written fault tickets. During service outages, operations personnel must infer root causes and select mitigation measures under uncertainty, time pressure, and strict business constraints. The use of large language models (LLMs) makes automating or assisting this workflow increasingly feasible, as a single model can unify log parsing, hypothesis generation, and tool-based remediation processes through natural language. However, real-world production failures often exceed the processing capabilities of modern large language models (LLMs) within limited context windows. A single failure can encompass hours of continuous event streams, constantly changing topologies, cascading retries, partial rollbacks, and cross-service dependencies. Therefore, the technical bottleneck lies not only in understanding individual records but also in maintaining coherent long-horizon reasoning as evidence continues to be input.

[0003] Operational failure scenarios differ significantly from existing general long-text benchmarking scenarios. These differences systematically put pressure on sequence models in the following dimensions: First, the time dimension: root causes may occur early, while symptoms may only appear much later (e.g., configuration drift, progressive resource leaks, certificate expiration). Second, causal sparsity: key triggers may be scarce and weakly expressed, buried in repetitive normal noise. Third, distribution offset and drift: templates, fields, and identifiers change with version and deployment; under heavy load, the performance of detection tools may degrade. Fourth, action constraints: diagnosis and mitigation are inseparable, but proposed actions must comply with security policies, approval processes, and operational manuals. These characteristics mean that a simple "add tokens" strategy is mismatched with the actual needs of failure response: namely, preserving the causal chain of failures within bounded memory.

[0004] Numerous works have extended the effective context length of Transformers through more efficient attention mechanisms, sparse / linear attention variants, or explicit recursion and segment-level storage. Positional extrapolation and long context fine-tuning further enhance length generalization capabilities. Streaming inference methods retain a fixed set of sink-tokens to stabilize model behavior outside the training window. Meanwhile, retrieval enhancement cues are widely adopted to bypass contextual constraints by retrieving relevant evidence. Despite significant progress, these methods still have limitations in fault diagnosis: when queries are symptom-centric, retrieval may miss causal triggers; sliding window and sink-token heuristics cannot guarantee that the retained evidence maintains dependency structure; and for continuously running streaming telemetry systems, the computational cost of extending attention mechanisms is too high.

[0005] Domain-specific log analysis has shifted from traditional parsing and sequence modeling to interfaces with underlying models. Log parsers and anomaly detectors have improved robustness and interpretability, but most still assume limited sequence length or rely on fixed windows. Furthermore, when failures span long time horizons, the primary failure modes are often long-term triggers that are forgotten or incorrectly weighted, rather than a lack of local pattern recognition capabilities. Even high-capacity LLM inference engines can produce illusions or overcommitments when critical evidence is truncated, misretrieved, or overwhelmed by noise. This necessitates the development of an interface to: (i) preserve causal evidence within bounded memory; and (ii) expose evidence to a frozen inference engine in a stable, interpretable form. Recent research on tool usage and validation shows that structured interfaces and constraint checks can reduce unfounded generation, but these methods still require a memory mechanism that reliably preserves long-horizon causes. Therefore, designing a bounded memory framework for maintaining causality in streaming update scenarios is crucial to overcoming current technical bottlenecks. Summary of the Invention

[0006] To address the aforementioned technical problems, this application provides a fault diagnosis method, apparatus, medium, and electronic device based on causal state space indication, which at least partially solves the problems existing in the prior art.

[0007] In a first aspect of this application, a fault diagnosis method based on causal state-space hints is provided, the method comprising the following steps:

[0008] Collect several IT operations and maintenance events;

[0009] Map each IT operations event to a corresponding event feature vector;

[0010] The event feature vectors are continuously input into the online state space model in chronological order, and the latent state corresponding to each time step is output. The online state space model has bounded memory capacity. The latent state represents the historical features of fault causal dependencies in the event stream composed of event feature vectors up to the corresponding time step. The latent state is maintained based on an update equation with a content dependency gating mechanism.

[0011] In response to receiving an IT operations and maintenance diagnostic request, the potential hidden state corresponding to the current time step is mapped to several discrete state words; where each discrete state word corresponds to a vector space.

[0012] The problem description corresponding to the IT operation and maintenance service interruption, the IT operation and maintenance events that occurred within the target time window, and several discrete state words are concatenated into a target prompt, which is then input into the frozen large language model to obtain the fault diagnosis result. The start time of the target time window is the time point corresponding to the preset duration before the IT operation and maintenance service interruption, and the end time is the time point corresponding to the preset duration after the IT operation and maintenance service interruption.

[0013] In a second aspect of this application, a fault diagnosis device based on causal state-space hints is provided, the device comprising:

[0014] The data collection unit is used to collect several IT operations and maintenance events;

[0015] The mapping unit is used to map each IT operations and maintenance event to a corresponding event feature vector.

[0016] The output unit is used to continuously input event feature vectors into the online state space model in chronological order and output the latent state corresponding to each time step. The online state space model has bounded memory capacity. The latent state represents the historical features of fault causal dependencies in the event stream composed of event feature vectors up to the corresponding time step. The latent state is maintained based on an update equation with a content dependency gating mechanism.

[0017] The lexical acquisition unit is used to map the potential hidden state corresponding to the current time step into several discrete state lexical units in response to receiving an IT operation and maintenance diagnosis request; wherein each discrete state lexical unit corresponds to a vector space.

[0018] The result acquisition unit is used to concatenate the problem description corresponding to the IT operation and maintenance service interruption, the IT operation and maintenance events that occurred within the target time window, and several discrete state words into a target prompt, and input it into the frozen large language model to obtain the fault diagnosis result; wherein, the start time of the target time window is the time point corresponding to the preset duration before the IT operation and maintenance service interruption, and the end time is the time point corresponding to the preset duration after the IT operation and maintenance service.

[0019] In a third aspect of this application, a non-transitory computer-readable storage medium is provided, wherein at least one instruction or at least one program is stored in the storage medium, and the at least one instruction or at least one program is loaded and executed by a processor to implement the aforementioned fault diagnosis method based on causal state space hints.

[0020] In a fourth aspect of this application, an electronic device is provided, including a processor and the aforementioned non-transitory computer-readable storage medium.

[0021] This application has at least the following beneficial effects: The fault diagnosis method based on causal state space hints provided in this application first collects several IT operation and maintenance events; it achieves comprehensive capture of heterogeneous and continuous raw operation and maintenance data in the production environment, laying a complete data foundation for the subsequent extraction of fault causal features; then, it maps each IT operation and maintenance event to a corresponding event feature vector, completing the standardization processing of heterogeneous operation and maintenance events, eliminating format differences and noise interference caused by different operation and maintenance environments and different log templates, enabling subsequent models to process with a unified input format, and solving the problem that traditional operation and maintenance data cannot effectively identify event classes due to messy formats. This approach addresses the problem of continuously inputting event feature vectors into an online state-space model with bounded memory capabilities. By combining this with an update equation featuring content dependency gating to maintain the latent states, the bounded memory feature vectors are continuously input into the model. This avoids uncontrolled memory overhead caused by the unbounded growth of IT operations and maintenance event streams, thus meeting the real-time requirements of streaming data processing. Furthermore, the content dependency gating mechanism allows the model to selectively retain information from critical fault-triggered events and adaptively forget redundant normal events. This ensures that the latent states at each time step accurately represent the historical causal dependencies of faults within the event stream up to that time step, effectively... This paper addresses the long-range dependency forgetting problem in long-sequence operation and maintenance event streams, where early root cause information is easily submerged by later noise. Then, in response to receiving IT operation and maintenance diagnostic requests, the potential hidden state of the current time step is mapped to several discrete state words, each corresponding to a vector space. This achieves the discretization and semantic transformation of high-dimensional, continuous potential hidden states, preserving the core features of the fault causal history while converting it into an input form recognizable by the frozen large language model, thus building an adaptation bridge between the bounded memory state space model and the frozen large language model. Finally, the service interruption problem description, IT operation and maintenance events within the target time window, and several discrete state words are concatenated. By providing target prompts and inputting a frozen large language model, and precisely defining the target time window, the system focuses on the range of key events before and after service interruption. Combining the long-range causal historical features contained in discrete state lexical units, the frozen large language model can perform inference based on standardized event information and condensed causal features without modifying its own parameters or bearing the pressure of long-term time-series data processing. The final fault diagnosis result output not only has the advantages of natural language inference of large language models, but also avoids the illusion problem caused by the limited context window and the lack of key causal information. At the same time, the use of the frozen large language model significantly reduces the training cost and computing power consumption of the solution. Attached Figure Description

[0022] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 A flowchart of a fault diagnosis method based on causal state space hints provided in an embodiment of this application;

[0024] Figure 2 This application provides a schematic diagram of the IT operations and maintenance event standardization process and robust embedded learning in its embodiments.

[0025] Figure 3 A schematic diagram illustrating the causal state space memory update mechanism provided in this application embodiment;

[0026] Figure 4 This is a schematic diagram illustrating the discrete state lexical generation and reasoning prompt construction provided in the embodiments of this application;

[0027] Figure 5 A schematic diagram illustrating the operation of the CSSP model in a streaming event scenario provided in this application embodiment;

[0028] Figure 6 This application provides a bounded memory long-range inference system architecture diagram for IT operation and maintenance event streams in an embodiment of the present application.

[0029] Figure 7 This is a structural block diagram of a fault diagnosis device based on causal state space hints provided in an embodiment of this application. Detailed Implementation

[0030] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0031] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or server that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or devices.

[0032] It should be noted that the following description covers various aspects of embodiments within the scope of the appended claims. It will be apparent that the aspects described herein can be embodied in a wide variety of forms, and any particular structure and / or function described herein is merely illustrative. Based on this application, those skilled in the art will understand that one aspect described herein can be implemented independently of any other aspect, and two or more of these aspects can be combined in various ways. For example, any number of aspects set forth herein can be used to implement the device and / or practice the method. Additionally, this device and / or method can be implemented using structures and / or functionalities other than one or more of the aspects set forth herein.

[0033] Please refer to Figure 1 As shown, embodiments of this application provide a fault diagnosis method based on causal state space hints, the method comprising the following steps:

[0034] S100 collects several IT operations and maintenance events.

[0035] Specifically, the first step is to collect data, including BGL (containing logs from large supercomputers), HDFS (covering distributed file system events), and OpenStack (including cloud platform multi-service interaction records). IT operations events are then constructed by concatenating the logs into a session stream and attaching ticket-like prompts describing the symptoms.

[0036] S200 maps each IT operations event to a corresponding event feature vector.

[0037] Specifically, raw operational data (such as log lines and alarms) exhibits high lexical variability, high cardinality identifiers (such as PodID and request tracking numbers), and format drift across versions and deployments. To eliminate the interference of these surface noises on subsequent causal learning, the raw event stream is first normalized.

[0038] Step S200 includes:

[0039] S210, according to the preset encoder, each IT operation and maintenance event is mapped to a structured tuple; wherein, the structured tuple includes event type, entity set and additional attribute description; wherein, the loss of the preset encoder includes template prediction loss and contrast invariance loss; the template prediction loss represents the negative value of the log-likelihood of the probability of the IT operation and maintenance event corresponding to the real template for each time step.

[0040] S220 maps structured tuples to standard discrete event IDs.

[0041] S230 converts standard discrete event IDs into event feature vectors.

[0042] Specifically, such as Figure 2 As shown, for an IT operations event x that arrives at time step t... t (i.e., the original log message x) t According to the preset encoder, it is mapped into a structured tuple ( e t a t ).in:

[0043] It is the event type, which can be an event template identifier that represents the type of event. For example: Authentication cache miss or DB connection pool exhausted.

[0044] e t It is a typed collection of entities used to extract key objects from an event, such as service name (SERVICE), host name (HOST), database instance (DB), etc.

[0045] a t It is an additional attribute description, which can be an optional dictionary of category attributes used to store other category attributes, such as status code categories, error types, subsystem labels, etc.

[0046] This structured tuple is ultimately mapped to a discrete, normalized event ID, denoted as u. t .

[0047] It should be noted that the default encoder is a lightweight encoder, and its loss includes template prediction loss and contrastive invariance loss. The template prediction loss represents the negative log-likelihood of the probability of the true template corresponding to the IT operation event at each time step, as detailed below:

[0048] With labeled data available, supervised learning is used to predict event templates. The template prediction loss function is defined as:

[0049] ;

[0050] Where: for IT operations and maintenance event x at time step t t The model predicts its corresponding real template. The negative of the log-likelihood of the probability. Minimizing the template prediction loss is equivalent to maximizing the probability that the preset encoder predicts the correct template, thereby teaching the preset encoder to identify the type of event from the original text.

[0051] It should be noted that the above-mentioned labeled data comes from: Loghub, which contains a large amount of log data; BGL (containing logs from large supercomputers), HDFS (covering distributed file system events), and OpenStack (including cloud platform multi-service interaction records), as well as existing data. The labeled data can be efficiently extracted from the log stream using the Drain algorithm to train the above-mentioned preset encoder.

[0052] To address unseen formats and noise and improve robustness, a contrastive invariance loss function is introduced, ensuring that the pre-defined encoder produces similar representations of different surface forms of the same event. For IT operations event x... t We generate enhanced views by employing semantic-preserving enhancement techniques (such as field rearrangement, formatting changes, and masking temporary IDs). The contrast invariance loss function is defined as follows:

[0053] ;

[0054] Where: h t =f canon (x t ) is an IT operations and maintenance event x t Vector representation of; It is an IT operations and maintenance incident. t Enhanced view The vector representation of ; sim() is a similarity function (such as cosine similarity) used to measure how close two vectors are in space; γ is a temperature parameter used to control the smoothness of the similarity distribution; h j Is with x t Other different records x from the same batch of data j The vector representation of is used as a negative sample.

[0055] Understandably, the purpose of the comparison invariant loss function is to bring the positive sample pairs closer together. The distance (even if the molecule is larger), while pushing h away t With all other negative samples hj The distance (even if the denominator is smaller). In this way, the preset encoder learns h. t This indicates a greater focus on the semantic core of the event, rather than sensitivity to superficial formatting changes.

[0056] Finally, u t It is mapped to a dense embedding vector, i.e., an event feature vector. (u) t );in, (A continuous eigenvector space of d-dimensional real numbers).

[0057] After the above steps, the original, noisy IT operations and maintenance events x t It is transformed into a stable, low-noise event feature vector, providing a high-quality foundation for subsequent causal memory learning.

[0058] S300 continuously inputs event feature vectors into the online state space model in chronological order and outputs the latent state corresponding to each time step. The online state space model has bounded memory capacity. The latent state represents the historical features of fault causal dependencies in the event stream composed of event feature vectors up to the corresponding time step. The latent state is maintained based on an update equation with a content dependency gating mechanism.

[0059] Specifically, such as Figure 3 As shown, this application constructs a causal state estimator with bounded memory capability. It compresses an unbounded, continuously flowing stream of events online into a fixed-length latent state rich in causal information. This latent state represents the fault causal dependency history features in the event stream, composed of event feature vectors, up to the corresponding time step. The latent state is maintained based on an update equation with a content-dependent gating mechanism.

[0060] Maintain the latent state using an update equation with content-dependent gating. ;s t Meets the following conditions:

[0061] ;

[0062] Where: s t s is the latent hidden state corresponding to the t-th time step, representing the historical features of fault causal dependencies in the event stream composed of event feature vectors up to the corresponding time step; t-1 It is the latent hidden state of the previous time step; u t Let t be the normalized event ID corresponding to the t-th time step; (u) t ) is u t The embedding vector; It is the symbol for element-wise multiplication; α t ,β t ∈ (0, 1) d ; is an element-wise gating vector calculated from the current input and the previous state, used to implement content-dependent forgetting and information propagation. These are not fixed but dynamically generated based on the current input and the previous state, thus enabling content-dependent memory updates: (α t ,β t It meets the following conditions:

[0063] (α) t ,β t ) ( (u) t );s t-1 ]);

[0064] in (u) t );s t-1 [] is the vector obtained by concatenating the event feature vector corresponding to the t-th time step with the latent hidden state corresponding to the (t-1)-th time step; W is the learnable weight matrix; It's the sigmoid activation function, which compresses the output value to between 0 and 1. Therefore, when a recurring, benign heartbeat log is received, β... t The value will be very small, indicating that the new information contributes little, while α t A value close to 1 indicates that the old state is well preserved; however, when a rare error event is received, β... t It will grow larger, injecting the event information into the state, and simultaneously α t This can be adjusted depending on the situation to decide whether to retain or partially forget the old state. This perfectly simulates the process by which human operations experts remember important information and skip repetitive noise when reading logs.

[0065] In one exemplary embodiment of this application, the evolution trajectory between latent hidden states is based on a causal loss function supervised loss. To enable the latent hidden states s t The evolutionary trajectory can encode causal dependencies between events, not just statistical correlations, thus introducing a causal dependency supervised loss. The causal loss function is defined as:

[0066] ;

[0067] Among them, L causal The causal loss value is given; BCE is the binary cross-entropy loss; a weakly labeled adjacency matrix A is constructed for the event fragment, where A... ij Indicates the degree of impact of IT operations and maintenance event i on IT operations and maintenance event j; A ij=1 indicates that IT operations event i is very likely to have affected IT operations event j; g() is a learnable scorer, indicating whether there is a causal relationship between IT operations event i and IT operations event j; g() receives the potential hidden states when IT operations event i and IT operations event j occur, and outputs a score between 0 and 1 to predict whether there is a causal relationship between IT operations event i and IT operations event j; s i s j These are the potential hidden states corresponding to IT operations and maintenance events i and j, respectively.

[0068] Understandably, BCE encourages models to retain information that helps distinguish and predict causal links when updating their state. For example, an early configuration change event, while not itself an anomaly, must have a state representation that contains sufficient information so that the scorer can correctly determine the causal relationship between subsequent symptomatic IT operations events.

[0069] It should be noted that the adjacency matrix A is constructed as follows:

[0070] Construct a weakly supervised adjacency matrix A∈{0,1} using the following three-level rule set arranged in priority. N×N (Where N is the number of normalized events in the training segment):

[0071] Shared request / tracking identifier (highest priority): If two normalized events e i and e j If the same request_id, trace_id, or span_parent_id is extracted during normalization (i < j), then A is set. ij =1. This rule captures the propagation of end-to-end requests across service boundaries and is the most reliable signal in systems equipped with distributed tracing.

[0072] Entity coreference within the time window: if e i and e j Share at least one typed entity with the same role (e.g., the same DB instance, the same Service name, or the same Pod identifier), and ji≤△ t (Time window, default △) t =60 seconds of wall clock time), then set A ij =1. For entity types marked as infrastructure level (such as Host, Version, Cluster), the window is widened to 5△. t This is because configuration or hardware failures typically propagate more slowly.

[0073] Template transformation heuristics (lowest priority): Maintain a set of rules compiled by domain experts. , The template pairs the "precedes" table, representing known causal chains in the target environment (e.g., auth_cache_miss). retry_storm,db_pool_exhausted (connection_timeout). If , If i < j, then let A be an integer. ij =1. This table contains 47 template pairs in BGL, 38 in HDFS, and 61 in OpenStack, all derived from domain documentation and expert annotations of training set fault summaries.

[0074] The above rules are applied greedily: A will be triggered whenever any one of the rules is triggered. ij That is, it is set to 1. To reduce spurious links generated by low-priority rules, a deduplication mechanism is applied: if e j There are already ≥5 preceding nodes; only the top 5 nodes, sorted by rule priority and closest time, are retained. The generated graph is typically very sparse (edge ​​fill rate <3%), reflecting the true sparsity of causal connections in actual operation and maintenance workflows.

[0075] Finally, to enhance the stability of state updates and prevent overreaction to single-point noise, the s... t and s t-1 Add a smoothness regularization term:

[0076] ;

[0077] This loss term penalizes the state for drastic changes between adjacent time steps, encouraging the state to evolve smoothly for most of the time and only abruptly change when strong evidence is received, thereby improving the model's robustness in noisy environments.

[0078] S400, in response to receiving an IT operations and maintenance diagnosis request, maps the potential hidden state corresponding to the current time step into several discrete state words; where each discrete state word corresponds to a vector space.

[0079] Specifically, the latent state obtained above is a dense embedding vector, which cannot be directly used by a frozen instruction understanding model that expects natural language lexical units as input. Therefore, as Figure 4As shown, fixed-length, causal-rich latent states are further transformed into discrete, interpretable state tokens. These tokens, serving as bounded memory, along with recent raw data, are used by a frozen, powerful instruction understanding model for final, constrained diagnosis and decision-making.

[0080] Further, step S400 includes:

[0081] S410 maps the potential hidden state corresponding to the current time step to several different vector spaces to obtain several projection vectors.

[0082] S420 inputs each projected vector into the learnable vector quantization module to find the nearest prototype vector for each projected vector.

[0083] S430 maps each prototype vector to a discrete state lexical according to the preset decoder header.

[0084] Here, we first use K independent linear projections to represent the potential hidden state s corresponding to the time step when the IT operation and maintenance request is received. T Mapped to K distinct vector spaces:

[0085] ;

[0086] Where v k It is the projection vector corresponding to the k-th vector space; P k This is the k-th projection matrix. Multiple projection matrices are set up so that different projectors can capture and represent the latent state s. T Information from different dimensions, for example: one head might focus on describing the root cause, while another head focuses on the propagation path.

[0087] Next, v k The vector is fed into a learnable vector quantization module VQ(:C), which maintains a codebook C containing M learnable prototype vectors (codebook embeddings). The vector quantization process finds the vectors that are most similar to the input v. k The nearest prototype vector :

[0088] ;

[0089] In this way, v kThe codebook indexes are mapped to discrete codebook indices. Finally, a lightweight, trainable decoder head maps each discrete codebook index to a short, human-readable natural language phrase, i.e., a discrete-state term, such as "db connection saturation" or "auth cache thrashing". The entire process is trained end-to-end using techniques such as a straight-through estimator, ensuring that the generated terms accurately reflect the latent hidden state S. T The content can then be understood by the subsequent frozen language model.

[0090] In one exemplary embodiment of this application, discrete state lexical units have a diversity mechanism; and the diversity mechanism of discrete state lexical units is based on codebook-level diversity processing and slot-level structure allocation processing; wherein, codebook-level diversity processing is based on maximizing the entropy of codebook usage by committing to penalties; slot-level structure allocation processing performs lexical slot allocation; the lexical slot allocation result includes trigger evidence slots, propagation evidence slots, and constraint evidence slots.

[0091] Specifically, a common failure mode of learning-based text summarization is the collapse of multiple lexical units into the same latent direction (pattern collapse), generating redundant signals and wasting cueing budget. This application prevents discrete-state lexical units from collapsing into the same latent direction by employing a joint diversity objective operating at two levels.

[0092] First, there's codebook-level diversity: a commitment penalty is added during training, which maximizes the entropy of codebook usage by adjusting the projected vector v. k They pushed each other away, promising to punish the losses as follows:

[0093] ;

[0094] in The first term is the Shannon entropy of slot k over the codebook distribution (calculated across batches), and the second term is the hinge repulsion between all token embedding pairs. The margin δ = 0.5, and the parameter μ = 0.01 are used to balance these two components. Maximizing the entropy of each slot encourages each slot to utilize different parts of the codebook, while hinge repulsion directly penalizes nearly repetitive token embeddings in the embedding space.

[0095] In one embodiment, slot-level structural assignment pre-allocates K=24 lexical slots to three facet groups: triggering evidence (K / 3 slots), propagation evidence (K / 3 slots), and constraint-related evidence (K / 3 slots). The projection matrix {P} of slots belonging to the same facet group... k They share a common base projection, but generate differentiation through a lightweight low-rank adapter (rank 8). This encourages diversity within the laterals while maintaining specialization between laterals.

[0096] To prevent the learned summaries from becoming general (e.g., with increased service errors) and lacking discriminative power, we curb this by: first, using existing fault summaries or teacher distillation to supervise lexical content where possible; and second, encouraging diversity among lexical units through diversity objectives to ensure that different facets of the potential state are represented.

[0097] S500 concatenates the problem description corresponding to the IT operation and maintenance service interruption, the IT operation and maintenance events that occurred within the target time window, and several discrete state words into a target prompt, and inputs it into the frozen large language model to obtain the fault diagnosis result; wherein, the start time of the target time window is the time point corresponding to the preset duration before the IT operation and maintenance service interruption, and the end time is the time point corresponding to the preset duration after the IT operation and maintenance service.

[0098] Specifically, we concatenate the problem description corresponding to the IT operations and maintenance service interruption (such as a ticket), the IT operations and maintenance events occurring within the target time window (to provide local context and reference accuracy), and the generated K discrete state lexical units into a fixed prompt, which is then input into the frozen large language model. The large language model is instructed to generate a structured diagnostic result, which in one embodiment includes: a root cause hypothesis; a set of evidence supporting the hypothesis; this evidence must explicitly reference the provided discrete state lexical units or segments within the target time window; one or more alternative hypotheses; and a specific mitigation plan.

[0099] In addition, the generated diagnostic results are then fed into a lightweight validator.

[0100] Specifically, the validator performs the following key checks: Evidence consistency: Verifies the existence of the cited discrete state terms or original fragments and whether their semantics truly support the proposed claim. Security strategy: Checks whether the proposed mitigation measures conform to predefined security rules, such as avoiding the execution of destructive commands at inappropriate times and preventing credential leakage. Tool consistency: If the mitigation plan depends on the output of certain tools (such as health checks), the validator checks whether the plan is consistent with the actual output of these tools.

[0101] Furthermore, the validator is a lightweight, modular component consisting of three deterministic rule-based sub-checkers and a learning-based reorderer, all of which operate without extending the frozen inferencer context:

[0102] Evidence Consistency Checker (Rule-Based): For each claim in the generated hypothesis, the checker extracts the state lexicon and original fragment it references and verifies: (a) whether the index k of each referenced state lexicon is within the valid range and whether its decoded phrase is semantically implied by the normalized representation of the event stream (verified by calculating a lexical overlap ≥ 0.6 with the Drain template with the highest score for that lexicon); and (b) whether the original fragment of each reference actually appears in the text W. T The violation was marked as UNSUPPORTED_CLAIM.

[0103] Security Policy Inspector (Rule-Based): Contains a curated list of 112 dangerous operation patterns (e.g., DROPTABLE, rm-rf, unauthorized credential rotation, restart outside the change window, etc.). Action plans are checked through precise string matching and a 15-word sliding n-gram check. Violations are marked as UNSAFE_ACTION.

[0104] Tool Alignment Inspector (Rule-Based): When the action plan references the output of a specific tool call (e.g., a health check API returning 200), the inspector aligns the assumptions in the plan with those stored in W. T The output of the actual tool in the database is compared. Inconsistencies are marked as TOOL_MISMATCH.

[0105] The learning-based reorderer (neural network) uses a small cross-encoder (BERT-based, 110 million parameters, frozen after initial training) to score the plausibility of root cause hypotheses for a given state lexicon. If the score of the highest-scoring hypothesis falls below a threshold θ = 0.45, the validator triggers a correction mechanism, boosting the second-highest-scoring alternative hypothesis.

[0106] If a violation is detected, the validator returns a brief corrective suggestion and requests modification. This suggestion, along with the original one, is then fed back into the frozen large language model, requesting it to generate a revised diagnosis. This optimization process can be completed without expanding the context, and typically a single round of correction is sufficient to significantly improve the reliability and security of the output.

[0107] In one exemplary embodiment of this application, the start time and length of the target time window are not fixed preset values, but can be adaptively determined through the following steps:

[0108] S001: Perform semantic classification on the problem description and determine the corresponding preset basic backtracking duration.

[0109] Specifically, the problem description corresponding to the IT operations and maintenance service interruption is input into a pre-trained semantic encoder to obtain a problem semantic vector. Based on the semantic vector, the fault is divided into the following categories: transient faults (such as sudden denial of service, instantaneous error), gradual faults (such as slow lag, gradual resource exhaustion), cascading faults (such as multiple services failing one after another), and periodic faults (such as periodic occurrences, certificate expiration). Each category of fault has a corresponding preset basic backtracking duration.

[0110] S002, calculate the causal backtracking depth based on discrete state lexical units.

[0111] Specifically, the semantic matching degree between each discrete state term and the problem description is calculated, and several high-contribution discrete state terms with the highest correlation to the current fault are selected. Then, based on the generation time of these high-contribution discrete state terms in the historical time series, the time position of the earliest causal clue of the fault is determined, so as to obtain the depth and duration required for fault causal backtracking.

[0112] S003, the basic backtracking duration and the fault causal backtracking depth duration are weighted and fused according to preset weights to obtain the final total length of the target time window.

[0113] The sum of the two weights is 1. The target time window is centered on the moment of service interruption, and the time taken to trace back the total length is taken as the start time, while the time taken to extend forward by a preset short time is taken as the end time.

[0114] This embodiment identifies fault types and matches corresponding basic backtracking durations based on the semantic encoding results of fault problem descriptions. It can preliminarily determine the required backtracking time range by combining the fault's own manifestations, ensuring the time window setting adapts to the actual fault characteristics. By calculating the semantic matching degree between discrete state words and problem descriptions and filtering high-contribution discrete state words, it can locate key information highly relevant to the current fault diagnosis from the extracted historical features of fault causal dependencies. Then, based on the temporal information corresponding to the high-contribution discrete state words, it determines the causal backtracking depth, accurately reflecting the timing of the fault root cause in the event stream and avoiding the omission of key causal clues due to the root cause occurring too early. By weightedly fusing the basic backtracking duration and the causal backtracking depth duration to obtain the total length of the target time window, information from both the external manifestations of the fault and its internal causal history can be combined simultaneously. This allows for dynamic adaptive adjustment of the target time window length, avoiding both insufficient coverage of the entire fault occurrence and development process due to a fixed window length that is too short, and the introduction of numerous irrelevant normal events that create noise interference due to a fixed window length that is too long. Consequently, the prompts input to the frozen large language model are more concise and focused on effective content. This reduces the computational pressure on the model, minimizes diagnostic biases and illusions caused by information redundancy or missing key information, and improves the accuracy and reliability of fault diagnosis results.

[0115] In one exemplary embodiment of this application, the start time and length of the target time window are not fixed preset values, but can be adaptively determined through the following steps:

[0116] S010 performs semantic parsing on the problem description corresponding to the IT operation and maintenance service interruption, extracts core fault features, associates and matches the core fault features with the preset fault feature knowledge base, and dynamically generates several candidate fault evolution modes.

[0117] Specifically, the problem description of IT operation and maintenance service interruption is first semantically parsed to extract core fault features (such as the scope of fault impact, symptoms, and business scenarios). These features are then matched with a pre-set fault feature knowledge base to generate several candidate fault evolution patterns (each pattern corresponds to a possible fault occurrence and development trajectory, such as single point of failure to cascading spread, resource consumption to threshold exceedance, configuration change to delayed effect, etc.). There is no fixed upper limit to the number of candidate patterns; they are generated dynamically entirely from the semantic matching results.

[0118] S020, construct a three-dimensional correlation graph of lexical, temporal, and causal relationships based on the aforementioned discrete state lexical units, and identify the potential causal chain fragments corresponding to each candidate fault evolution mode through a graph traversal algorithm, wherein the potential causal chain fragments are temporal chains composed of triggering lexical units, transmission lexical units, and result lexical units.

[0119] Specifically, based on several generated discrete state lexical units, a three-dimensional correlation graph of lexical units, temporal sequence, and causality is constructed: where the horizontal axis is the time dimension (corresponding to the time step of discrete state lexical unit generation), the vertical axis is the lexical unit correlation dimension (characterizing the semantic correlation strength between different discrete state lexical units), and the depth axis is the causal dimension (calculating the causal influence coefficient between lexical units through the evolution trajectory of the latent state corresponding to the discrete state lexical units); through the graph traversal algorithm, the potential causal chain fragments corresponding to each candidate fault evolution mode are identified, that is, the temporal chain from the triggering lexical unit to the transmission lexical unit to the result lexical unit that may exist in each mode.

[0120] S030, for each candidate fault evolution mode, trace back to its earliest trigger word in the event stream, and use the time step corresponding to the earliest trigger word as the temporary start time and the time of IT operation and maintenance service interruption as the temporary end time to form an initial candidate window.

[0121] S040, calculate the matching degree between all IT operation and maintenance events in the initial candidate window and the corresponding candidate fault evolution mode.

[0122] S050, if the matching degree does not meet the preset matching conditions, the temporary start time is extended forward by one time unit, and the above matching degree calculation and verification steps are repeated until the preset matching conditions are met or the temporary start time is extended to the start time of the event stream.

[0123] Specifically, for each candidate pattern's potential causal chain segment, its earliest triggering term in the event stream is traced backwards. The time step corresponding to this term is used as the temporary start time, and the service interruption time is used as the temporary end time to form an initial candidate window. Then, the matching degree between all IT operation and maintenance events within this window and the candidate pattern is calculated (the matching dimensions include event type sequence, time interval distribution, and anomaly degree gradient). If the matching degree does not reach the point where three consecutive sub-chains are completely matched (i.e., the event sequence within the window can be divided into three consecutive sub-segments, and each sub-segment matches the corresponding link in the pattern), the temporary start time is extended forward by one time unit, and the above matching verification is repeated until the three consecutive sub-chains are completely matched or the time is extended to the start time of the event stream.

[0124] S060, perform a consistency check on each initial candidate window to obtain several intermediate candidate windows.

[0125] Specifically, for each candidate window, consistency is judged from three dimensions: causal dimension: whether the causal influence coefficients of discrete state terms within the window show a reasonable trajectory of increasing, peaking, and decaying (consistent with the causal transmission law of faults); business dimension: whether the event sequence within the window is consistent with the business process logic corresponding to the fault (e.g., whether the payment fault window contains related events of payment service, order service, and database service, and conforms to the business call order); data dimension: whether the abnormal frequency and severity of events within the window match the symptom intensity in the problem description (e.g., the window corresponding to complete service unavailability should contain high-frequency severe abnormal events, rather than low-frequency minor alarms); if any dimension is inconsistent, the candidate window is removed.

[0126] S070, calculate the causal loop completeness and the proportion of redundant events for each intermediate candidate window.

[0127] S080: If the number of intermediate candidate windows that meet both the causal loop integrity and the proportion of redundant events is greater than 1, then proceed to step S090; otherwise, end the process.

[0128] Specifically, for the remaining valid candidate windows, the causal closed-loop completeness of each window is calculated, i.e., whether the window contains a complete chain of root cause event, intermediate transmission event, and failure result event, and whether the discrete state tokens of each link in the chain can form bidirectional causal verification through the evolution trajectory of the latent state (the latent state of the token in the previous link can deduce the generation of the token in the next link, and the latent state of the token in the next link can inversely verify the influence of the token in the previous link); if multiple windows satisfy the causal closed-loop completeness, the redundant event ratio of each window is further calculated (the number of normal events in the window that are not related to the causal chain / the total number of events in the window), and the windows with the highest redundancy ratio (for example: 20%) are eliminated; if only one window remains, it is taken as the target candidate window; if there are still multiple windows, proceed to step S090.

[0129] S090, extract target words from each intermediate candidate window that meets the requirements for causal loop completeness and redundant event ratio, perform secondary association between the target words and the core fault features of the problem description, determine whether the events corresponding to the target words fully cover the core fault features, and verify the matching of events in the window with the IT system topology; select the window with the highest coverage of core fault features and the highest matching degree of IT system topology as the final target time window, the start time of the final target time window is the time step corresponding to the earliest event in the window, and the end time is the preset event convergence time after the IT operation and maintenance service is interrupted.

[0130] Specifically, for the remaining multiple target candidate windows, a cross-lexical verification mechanism is introduced. This involves extracting all target lexicals (high-contribution discrete state lexicals: determined by the lexical's irreplaceability score in the causal chain, calculated by the degree of causal chain breakage after removing the lexical) within each window. These lexicals are then associated with the core fault features of the problem description to determine whether the events corresponding to the lexicals fully cover the fault features (e.g., if the fault features are: database connection failure, order submission timeout, then the window must contain database connection-related lexicals and order service-related lexicals). Simultaneously, the matching of events within the window with the system topology is verified (e.g., whether abnormal events within the window are concentrated on the topology path affected by the fault). Finally, the window with the highest feature coverage and the highest topology matching degree is selected as the final target time window. Its start time is the earliest event time of the window, and its end time is the preset event convergence time after the service interruption (ensuring that subsequent impact events after the fault are included).

[0131] This embodiment generates dynamic candidate fault evolution patterns through semantic parsing of the problem description, overcoming the limitations of fixed pattern classification. This allows the initial window range to accurately match the potential fault occurrence trajectory, laying a foundation for subsequent window calibration that aligns with actual fault characteristics. A three-dimensional correlation graph is constructed, transforming isolated information from discrete state words into multi-dimensional correlation data, overcoming the limitations of single-dimensional judgment and making causal chain identification more comprehensive. The first round of iterative verification employs a threshold-free matching mechanism with reverse tracing and dynamic extension. By using a verification standard where three consecutive sub-chains perfectly match, it avoids subjective bias caused by preset thresholds, ensuring that the initial candidate window fully covers the key stages of fault evolution. Cross-dimensional consistency verification conducts multi-dimensional verification from causal, business, and data perspectives, eliminating unreasonable windows that only meet single-dimensional matching requirements, significantly improving the reliability of candidate windows. The second round of iterative verification, through causal loop integrity judgment and redundant event screening, ensures the integrity of the causal chain within the window while avoiding window-related errors. Over-extension leads to noise redundancy, and simple proportional threshold screening is abandoned. Instead, a logic of dynamically removing the part with the highest redundancy ratio is adopted to adapt to the noise distribution differences of different fault scenarios. The third round of cyclic verification introduces cross-word verification and topology matching dual verification, which deeply binds window screening with fault features and system topology to ensure that the final window can not only fully cover the key events related to the fault, but also fit the actual architecture logic of the IT system. The whole process completely abandons the traditional simple weighted or threshold logic through multiple rounds of cyclic iteration and cross-dimensional correlation judgment. This makes the determination of the target time window not only accurately capture the complete causal chain of the fault, but also adapt to the differences of different fault types and different system environments. It effectively avoids the problems of "broken causal chain, excessive noise redundancy, and mismatch with business or topology" that may occur with fixed windows or simple adaptive windows. In this way, it provides more accurate, more focused and more in line with the actual fault scenario input information for freezing the large language model, which significantly improves the accuracy, reliability and adaptability of fault diagnosis results.

[0132] This application constructs a CSSP model for streaming event scenarios, such as Figure 5 and Figure 6 As shown, this method does not rely on the attention window of the extended model, but innovatively constructs a causal state estimator with bounded memory capabilities. It compresses an unbounded, continuously flowing stream of events online into a fixed-length latent state rich in causal information, and further transforms it into discrete, interpretable "state tokens." These tokens, as carriers of bounded memory, along with recent raw data, are used by a frozen, powerful instruction understanding model to perform final, constrained diagnosis and decision-making.

[0133] During the training phase, the CSSP model streams data, updates memory online, generates state markers, and minimizes the joint objective function. λ controls the strength of smooth regularization. During inference, the CSSP model updates memory, generates state terms, queries the frozen inferencer once, and can optionally apply validator-guided corrections once.

[0134] The trained CSSP model was deployed on the test set. A streaming, one-time traversal mechanism (single memory update and single inferencer call) was used to process the logs, recording and calculating anomaly detection precision, recall, F1 score, and end-to-end latency. This validated the model's robustness and accuracy.

[0135] This application presents a fault diagnosis method based on causal state space cues. Employing a causal state space memory module and a discrete state lexicon generator, it avoids the computational overhead of expensive attention mechanisms in existing long context expansion methods. With constant memory and linear time complexity, it can compress an unbounded event stream into a fixed number of compact discrete state lexicons. This significantly saves computational resources and perfectly meets the stringent cue word budget requirements of downstream frozen large language models. Furthermore, the memory module introduces a content-dependent gating mechanism (enabling dynamic forgetting and information propagation) and causal dependency supervision loss. This effectively solves the industry challenges of early triggering causes and late-onset fault symptoms, as well as the sparseness of key evidence in practical operations and maintenance. It also prevents important triggering factors from being overwritten by high-frequency, bursty normal events.

[0136] Furthermore, this application innovatively designs an event normalizer that combines template prediction loss and contrast invariance loss, supplemented by a smoothness regularization term. This effectively avoids overfitting the model to temporary identifiers and prioritizes the preservation of stable dependency structure evidence. Even under conditions of extremely high log corruption or format distortion, it maintains stable and excellent inference performance, with a performance degradation significantly less than existing streaming processing or hint engineering methods. It also introduces a lightweight validator to rigorously perform evidence alignment and operational constraint verification without increasing the model's inference burden. The validator mandates that generated diagnostic results explicitly cite discrete state terms or original log fragments as factual support. Simultaneously, it verifies whether mitigation actions comply with security policies and are consistent with the output of available tools. This significantly reduces model illusions through a single corrective feedback step, substantially improving the reliability of security-sensitive operational workflows.

[0137] This application also employs a single-pass streaming memory update mechanism and a single inference engine query, with at most one validator correction. The state update process is not hampered by the length of historical data, can scale to arbitrarily long unbounded data streams, and always maintains predictable low latency. While significantly improving fault diagnosis accuracy, it delivers highly competitive fast inference capabilities, fully meeting the stringent requirements of real-time event response systems in production environments for computational budget and timeliness.

[0138] The following specific embodiments illustrate the fault diagnosis method based on causal state space hints provided in this application:

[0139] We will use a real-world failure scenario from the OpenStack test suite as an example to demonstrate the entire process of the failure. This failure involved an authentication cache jitter event that occurred at t=0, which led to a retry storm approximately 8 minutes later, ultimately exhausting the database connection pool. The event stream contained 2,841 lines of logs; operations personnel intervened at t=510s and queried the CSSP to obtain a hypothesis for the root cause.

[0140] Phase 1 - Standardization:

[0141] The original log line at t=3s:

[0142] 2024-03-0100:00:03keystoneWARNauth.cache[req-a3f1..]Cachemissforuser <uuid>onhost10.0.0.41:5000

[0143] Mapped to tuples:

[0144] ;

[0145] e={Service:keystone,Host: <ip> : <port>,User: <uuid>};

[0146] .

[0147] The temporary field (req-a3f1...,10.0.0.41) was successfully masked.

[0148] Phase 2 - Memory Update:

[0149] At t=3s, the gated network produces β3≈0.82 (high injection weight) because auth_cache_miss is a rare template. After 480 seconds of almost entirely benign nova_scheduler_tick and cinder_heartbeat events, the latent state S... 510 High activation of the auth subsystem is retained, while scheduling / heartbeat activation is mostly filtered out by the gating mechanism.

[0150] Stage 3 - State Terminology Generation:

[0151] During the query, the system generated 24 state tokens. Three representative tokens and their decoded phrases are as follows:

[0152] (Triggering evidence): "authcachemiss-keystonewarn";

[0153] (Evidence of dissemination): "retrystorm-novacompute";

[0154] (Constraint evidence): "dbpool exhausted-safe restarteligible".

[0155] Phase 4 - Reasoning and Verification:

[0156] The frozen 7B inferencer received a ticket description ("User reported 503 errors starting at 00:08"), the most recent raw window of 256 terms (covering the event of database connection pool exhaustion), and 24 status terms.

[0157] Its initial assumptions are:

[0158] Root cause: Authentication cache thrashing (evidence: y1) leads to a retry storm (evidence: y9) and database connection pool exhaustion (evidence: y). 17 Recommended actions: Restart Keystone caching; verify database connection pool limits.

[0159] The validator confirmed that both y1 and y9 are contained within the normalized event stream (lexical overlap of 0.87 and 0.79 respectively), and the action "Restart Keystone Cache" passed the security block list. The tool alignment requirements were also met (the health check API returned a database status of 200). Therefore, no correction is needed, and the diagnostic results are returned as is.

[0160] In contrast, the sliding window baseline method (StreamingLLM, using a 512-term window) misses y1 because the triggering event occurs 510 seconds before the query, falling outside the reserved area, thus incorrectly assuming a general network congestion cause.

[0161] Please refer to Figure 7 As shown, an embodiment of this application provides a fault diagnosis device 100 based on causal state space hints, the device comprising:

[0162] The data collection unit 110 is used to collect several IT operation and maintenance events.

[0163] The mapping unit 120 is used to map each IT operation and maintenance event to a corresponding event feature vector.

[0164] Output unit 130 is used to continuously input event feature vectors into the online state space model in chronological order and output the latent state corresponding to each time step; wherein, the online state space model has bounded memory capability; the latent state represents the fault causal dependency history features in the event stream composed of event feature vectors up to the corresponding time step; the latent state is maintained based on an update equation with a content dependency gating mechanism.

[0165] The lexical acquisition unit 140 is used to map the potential hidden state corresponding to the current time step into several discrete state lexical units in response to receiving an IT operation and maintenance diagnosis request; wherein each discrete state lexical unit corresponds to a vector space.

[0166] The result acquisition unit 150 is used to concatenate the problem description corresponding to the IT operation and maintenance service interruption, the IT operation and maintenance events that occurred within the target time window, and several discrete state words into a target prompt, and input it into the frozen large language model to obtain the fault diagnosis result; wherein, the start time of the target time window is the time point corresponding to the preset duration before the IT operation and maintenance service interruption, and the end time is the time point corresponding to the preset duration after the IT operation and maintenance service.

[0167] Embodiments of this application also provide a computer program product including program code that, when the program product is run on an electronic device, causes the electronic device to perform the steps of the methods described above according to various exemplary embodiments of this application.

[0168] Furthermore, although the steps of the method in this application are described in a specific order in the accompanying drawings, this does not require or imply that the steps must be performed in that specific order, or that all the steps shown must be performed to achieve the desired result. Additional or alternative steps may be omitted, multiple steps may be combined into one step, and / or a step may be broken down into multiple steps.

[0169] Through the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, mobile terminal, or network device, etc.) to execute the methods according to the embodiments of this application.

[0170] In an exemplary embodiment of this application, an electronic device capable of implementing the above-described method is also provided.

[0171] Those skilled in the art will understand that various aspects of this application can be implemented as a system, method, or program product. Therefore, various aspects of this application can be specifically implemented as: a completely hardware implementation, a completely software implementation (including firmware, microcode, etc.), or a combination of hardware and software implementations, collectively referred to herein as a "circuit," "module," or "system."

[0172] An electronic device according to this embodiment of the present application. The electronic device is merely an example and should not be construed as limiting the functionality and scope of use of the embodiments of this application.

[0173] Electronic devices are manifested in the form of general-purpose computing devices. Components of an electronic device may include, but are not limited to: at least one processor, at least one memory, and buses connecting different system components (including memory and processor).

[0174] The memory stores program code that can be executed by a processor, causing the processor to perform the steps described in the "Exemplary Methods" section above, according to various exemplary embodiments of this application.

[0175] The storage may include readable media in the form of volatile storage, such as random access memory (RAM) and / or cache memory, and may further include read-only memory (ROM).

[0176] The storage may also include programs / utilities having a set (at least one) of program modules, including but not limited to: an operating system, one or more applications, other program modules, and program data, each or some combination of these examples may include an implementation of a network environment.

[0177] A bus can represent one or more of several bus architectures, including a memory bus or memory controller, a peripheral bus, a graphics acceleration port, a processor, or a local bus that uses any of the various bus architectures.

[0178] The electronic device can also communicate with one or more external devices (such as keyboards, pointing devices, Bluetooth devices, etc.), one or more devices that enable a user to interact with the electronic device, and / or any device that enables the electronic device to communicate with one or more other computing devices (such as routers, modems, etc.). This communication can be performed via input / output (I / O) interfaces. Furthermore, the electronic device can communicate with one or more networks (such as local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter. As shown in the figure, the network adapter communicates with other modules of the electronic device via a bus. It should be understood that, although not shown in the figure, other hardware and / or software modules can be used in conjunction with the electronic device, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0179] Through the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, terminal device, or network device, etc.) to execute the methods according to the embodiments of this application.

[0180] In exemplary embodiments of this application, a computer-readable storage medium is also provided, on which a program product capable of implementing the methods described above is stored. In some possible implementations, various aspects of this application may also be implemented as a program product including program code, which, when the program product is run on a terminal device, causes the terminal device to perform the steps of the various exemplary embodiments of this application described in the "Exemplary Methods" section above.

[0181] The program product may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: electrical connections having one or more wires, portable disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0182] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of sending, propagating, or transmitting programs for use by or in conjunction with an instruction execution system, apparatus, or device.

[0183] The program code contained on the readable medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0184] Program code for performing the operations of this application can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's computing device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0185] Furthermore, the above figures are merely illustrative of the processes included in the method according to exemplary embodiments of this application, and are not intended to be limiting. It is readily understood that the processes shown in the above figures do not indicate or limit the temporal order of these processes. Additionally, it is readily understood that these processes may be executed synchronously or asynchronously, for example, in multiple modules.

[0186] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to the embodiments of this application, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0187] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.< / uuid> < / port> < / ip> < / uuid>

Claims

1. A fault diagnosis method based on causal state-space hints, characterized in that, The method includes: Collect several IT operations and maintenance events; Map each IT operations event to a corresponding event feature vector; The event feature vectors are continuously input into the online state space model in chronological order, and the latent state corresponding to each time step is output. The online state space model has bounded memory capacity. The latent state represents the historical features of fault causal dependencies in the event stream composed of event feature vectors up to the corresponding time step. The latent state is maintained based on an update equation with a content dependency gating mechanism. In response to receiving an IT operations and maintenance diagnostic request, the potential hidden state corresponding to the current time step is mapped to several discrete state words; where each discrete state word corresponds to a vector space. The problem description corresponding to the IT operation and maintenance service interruption, the IT operation and maintenance events that occurred within the target time window, and several discrete state words are concatenated into a target prompt, which is then input into the frozen large language model to obtain the fault diagnosis result. The start time of the target time window is the time point corresponding to the preset duration before the IT operation and maintenance service interruption, and the end time is the time point corresponding to the preset duration after the IT operation and maintenance service interruption. The evolutionary trajectory between latent states is supervised by a causal loss function, which satisfies the following condition: ； Among them, L causal The causal loss value is represented by BCE; BCE is the binary cross-entropy loss; A ij The expression represents the degree of influence of IT operations event i on IT operations event j; g() is a learnable scorer, indicating whether a causal relationship exists between IT operations event i and IT operations event j; s i s j These are the potential hidden states corresponding to IT operations and maintenance events i and j, respectively. In response to receiving an IT operations and maintenance diagnostic request, the potential latent state corresponding to the current time step is mapped to several discrete state terms, including: Map the potential hidden state corresponding to the current time step to several different vector spaces to obtain several projection vectors; Each projected vector is input into the learnable vector quantization module to find the nearest prototype vector to each projected vector. Each prototype vector is mapped to a discrete state word based on the preset decoder header; The discrete state lexical unit has a diversity mechanism; and the diversity mechanism of the discrete state lexical unit is based on codebook-level diversity processing and slot-level structure allocation processing; wherein, codebook-level diversity processing is based on maximizing the entropy of codebook usage by committing to penalties; slot-level structure allocation processing is used to allocate lexical slots; the lexical slot allocation results include trigger evidence slots, propagation evidence slots, and constraint evidence slots.

2. The fault diagnosis method based on causal state-space hints according to claim 1, characterized in that, The process of mapping each IT operations and maintenance event to a corresponding event feature vector includes: According to the preset encoder, each IT operation and maintenance event is mapped to a structured tuple; wherein, the structured tuple includes event type, entity set and additional attribute description; wherein, the loss of the preset encoder includes template prediction loss and contrast invariance loss; the template prediction loss represents the negative value of the log-likelihood of the probability of the IT operation and maintenance event corresponding to the real template for each time step; Map structured tuples to standard discrete event IDs; Convert standard discrete event IDs into event feature vectors.

3. The fault diagnosis method based on causal state-space hints according to claim 1, characterized in that, The potential hidden state meets the following conditions: ； Among them, s t It is the latent hidden state corresponding to the t-th time step; u t Let φ(u) be the normalized event ID corresponding to the t-th time step; t ) represents the event feature vector corresponding to the t-th time step; s t-1 It is the latent hidden state corresponding to the (t-1)th time step; α t ,β t It is an element-wise gated vector; It is the symbol for element-wise multiplication.

4. The fault diagnosis method based on causal state-space hints according to claim 3, characterized in that, α t ,β t Both are non-fixed, (α) t ,β t It meets the following conditions: (a t ,b t )=σ(W[φ(u t );s t-1 ]); Among them, [φ(u) t );s t-1 ] is the vector obtained by concatenating the event feature vector corresponding to the t-th time step with the latent hidden state corresponding to the (t-1)-th time step; W is the learnable weight matrix; σ is the Sigmoid activation function.

5. A fault diagnosis device based on causal state-space hints, applied to the method described in any one of claims 1-4, characterized in that, The device includes: The data collection unit is used to collect several IT operations and maintenance events; The mapping unit is used to map each IT operations and maintenance event to a corresponding event feature vector. The output unit is used to continuously input event feature vectors into the online state space model in chronological order and output the latent state corresponding to each time step. The online state space model has bounded memory capacity. The latent state represents the historical features of fault causal dependencies in the event stream composed of event feature vectors up to the corresponding time step. The latent state is maintained based on an update equation with a content dependency gating mechanism. The lexical acquisition unit is used to map the potential hidden state corresponding to the current time step into several discrete state lexical units in response to receiving an IT operation and maintenance diagnosis request; wherein each discrete state lexical unit corresponds to a vector space. The result acquisition unit is used to concatenate the problem description corresponding to the IT operation and maintenance service interruption, the IT operation and maintenance events that occurred within the target time window, and several discrete state words into a target prompt, and input it into the frozen large language model to obtain the fault diagnosis result; wherein, the start time of the target time window is the time point corresponding to the preset duration before the IT operation and maintenance service interruption, and the end time is the time point corresponding to the preset duration after the IT operation and maintenance service.

6. A non-transitory computer-readable storage medium, characterized in that, The storage medium stores at least one instruction or at least one program segment, which is loaded and executed by a processor to implement the method as described in any one of claims 1-4.

7. An electronic device, characterized in that, Includes a processor and the non-transitory computer-readable storage medium as described in claim 6.

Images