A communication network fault diagnosis method based on heuristic matching of large language models

Abstract

The application provides a communication network fault diagnosis method based on a heuristic matching large language model, comprising the following steps: obtaining a fault diagnosis task set and a fault diagnosis algorithm candidate set, extracting multi-dimensional features of the fault diagnosis task, and constructing heuristic matching features including dimension matching degree, sparse adaptability, semantic adaptability, model complexity penalty and historical performance feedback; the matching degree of the task and algorithm combination is quantitatively evaluated according to the heuristic matching features, the weights of each feature in the heuristic matching features are calculated according to the historical performance expectation, the performance fluctuation standard deviation and the expert prior preference; based on the quantitative results and the weights of the heuristic matching features, the weighted scoring function of the task-algorithm combination is calculated, the algorithm with the highest weighted scoring function score is selected as the optimal recommended algorithm for the corresponding fault diagnosis task, and the large language model generates the corresponding fault diagnosis algorithm code according to the selected optimal recommended algorithm and the description of the fault diagnosis task.

Description

Technical Field

[0001] This invention belongs to the field of intelligent operation and maintenance and fault diagnosis technology of communication networks, specifically involving a communication network fault diagnosis method based on heuristic matching of large language models. Background Technology

[0002] With the large-scale deployment of 5G networks and the accelerated development of 6G technology, communication networks are rapidly evolving towards ultra-high speeds, massive connectivity, and ultra-low latency, resulting in exponential expansion in network scale. The widespread access of IoT devices, the deep integration of the Industrial Internet, and the large-scale deployment of edge computing nodes are increasingly increasing the complexity of network structures. In heterogeneous network environments, data interaction patterns are becoming more diverse, significantly increasing the probability and impact of various abnormal states during network operation. These abnormal states encompass a variety of situations, including sudden congestion, link interruptions, intrusion attacks, and device failures. Especially in scenarios supporting critical services such as autonomous driving and telemedicine, the occurrence of abnormal events can not only disrupt normal network communication but also potentially trigger major security incidents, posing a serious threat to network stability and security.

[0003] Anomaly detection, a crucial component of intelligent network operation and maintenance systems, plays a vital role in identifying potential system risks and issuing timely warnings, thus becoming a core technology for ensuring stable network operation and information security. In recent years, machine learning methods, particularly unsupervised and semi-supervised learning algorithms, have demonstrated broad adaptability and powerful detection capabilities in the field of communication network anomaly detection due to their advantages in handling complex data patterns, attracting significant attention within the industry. However, the practical application of machine learning algorithms faces numerous challenges. Model selection, feature engineering, hyperparameter tuning, and code implementation all heavily rely on operators possessing extensive professional knowledge and development experience. This situation is particularly pronounced in engineering deployment scenarios, directly leading to high algorithm development barriers, low implementation efficiency, and excessive migration costs between different scenarios, severely restricting the widespread application and effectiveness of anomaly detection technology in communication networks. Communication network operation and maintenance exhibits significant latency sensitivity and limited computing power. Under new network architectures such as 5G, OTN, and SDN, the number of device nodes is growing exponentially, significantly increasing data traffic and the frequency of alarm events. If the fault diagnosis algorithm cannot complete anomaly detection and localization within the limited time, it may lead to link interruption, bandwidth waste, or large-scale service degradation. Edge computing nodes generally face the problem of limited CPU / GPU resources and memory, making it impossible to support the long-term training and inference of complex deep learning models.

[0004] In recent years, the rapid development of large language models has provided new ideas for solving the above problems, as they have the ability to diagnose faults in input data. However, large language models are limited by the length of the input token. When faced with massive amounts of network state data that need to be analyzed, directly inputting this data into a large language model often results in the data length exceeding its processing capacity, making it impossible to perform a comprehensive and in-depth analysis of the data, thus affecting the accuracy and completeness of fault diagnosis. Summary of the Invention

[0005] This invention proposes a communication network fault diagnosis method based on heuristic matching of large language models, which solves the problem of limitations of existing large language models when processing massive network data.

[0006] To address the aforementioned technical problems, this invention provides a communication network fault diagnosis method based on heuristic matching of large language models, comprising the following steps:

[0007] Step S1: Obtain the set of fault diagnosis tasks and the candidate set of fault diagnosis algorithms, extract multi-dimensional features of fault diagnosis tasks, and construct heuristic matching features including dimensionality matching degree, sparsity adaptability, semantic adaptability, model complexity penalty and historical performance feedback.

[0008] Step S2: Quantitatively evaluate the matching degree between the fault diagnosis task and the candidate fault diagnosis algorithm combination based on the heuristic matching features, and calculate the weight of each feature in the heuristic matching features based on historical performance expectation, performance fluctuation standard deviation and expert prior preference;

[0009] Step S3: Based on the quantization results of the heuristic matching features and the weights, calculate the weighted scoring function of the combination of the fault diagnosis task and the candidate fault diagnosis algorithm, select the fault diagnosis algorithm with the highest score of the weighted scoring function as the optimal recommendation algorithm for the corresponding fault diagnosis task, and drive the large language model to generate the corresponding fault diagnosis algorithm code according to the selected optimal recommendation algorithm and the description of the fault diagnosis task.

[0010] Preferably, the dimension matching degree mentioned in step S1 is used to measure the adaptability of the data feature dimension of the fault diagnosis task to the high-dimensional feature space processing of the candidate fault diagnosis algorithm. When the data feature dimension of the task is high, algorithms with feature compression or reconstruction capabilities are preferred. The expression for the dimension matching degree is:

[0011] ;

[0012] In the formula, for and Dimensional matching degree between them; For the first One type of fault task; For the first A fault diagnosis algorithm; For data dimensions; This is the Isolation Forest algorithm; It is a self-encoder.

[0013] Preferably, the sparsity adaptability is used to represent the sparsity of anomalous samples in the fault diagnosis task. The sensitivity of the fault diagnosis algorithm to sparse anomalies is evaluated by calculating the local density distribution and volatility of the anomalous samples. The expression for the sparsity adaptability is:

[0014] ;

[0015] In the formula, for and Sparse adaptability between them; The number of samples; For the sample The number of neighbors; For sample set The first in One sample; For the sample The The nearest neighbor.

[0016] Preferably, the semantic fit is used to measure the semantic similarity between the natural language keywords of the fault diagnosis task and the design concept of the fault diagnosis algorithm, and the expression for the semantic fit is:

[0017] ;

[0018] In the formula, for and Semantic compatibility between them.

[0019] Preferably, the model complexity penalty is used to measure the computational complexity of the fault diagnosis algorithm, and the expression for the model complexity penalty is:

[0020] ;

[0021] In the formula, for and Model complexity penalty between; These are weight parameters; For the first The total number of parameters for a fault diagnosis algorithm.

[0022] Preferably, the historical performance feedback is used to record the performance of the fault diagnosis algorithm in handling similar fault diagnosis tasks in historical data, and the expression for the historical performance feedback is:

[0023] ;

[0024] ;

[0025] In the formula, for and Historical performance feedback between; Fault diagnosis algorithm In fault diagnosis task The average F1 score; for The accuracy rate; for Recall rate.

[0026] Preferably, in step S2, an adaptive dynamic weight calculation method is used to determine the weight of each feature in the heuristic matching features, and the expression for the weight is:

[0027] ;

[0028] In the formula, Let be the weight of the nth matching feature; This is the scaling factor; This represents the expected historical performance for the k-th matching feature. The standard deviation of performance fluctuation corresponding to the k-th matching feature; This represents the prior preference corresponding to the k-th matching feature; This represents the total number of matching features.

[0029] Preferably, in step S3, by employing prompt word engineering techniques and a few-shot learning strategy, the large language model is driven to generate corresponding fault diagnosis algorithm code based on the selected optimal recommendation algorithm and the description of the fault diagnosis task.

[0030] Preferably, the few-shot learning strategy utilizes a cue word structure consisting of the following three core components:

[0031] System settings: used to define the role, knowledge scope, and behavioral style of the large language model in code generation tasks;

[0032] User request: Used to carry the task instructions, data source and structure, and analysis objectives input by the end user;

[0033] Model Response: Outputs automatically generated complete runnable code, necessary explanations, and the model training and inference process.

[0034] Preferably, the fault diagnosis algorithm code generated by the large language model is a complete and runnable program, including data loading, model structure definition, training process, and anomaly scoring.

[0035] The beneficial effects of the present invention include at least the following:

[0036] 1. This invention not only extracts multi-dimensional features of fault diagnosis tasks, but also constructs heuristic matching features that include dimensional matching degree, sparsity adaptability, semantic adaptability, model complexity penalty and historical performance feedback. It considers fault diagnosis tasks and algorithms from multiple dimensions, and can more comprehensively understand task requirements and algorithm characteristics.

[0037] 2. The weights of each feature in the heuristic matching feature are calculated based on historical performance expectation, performance fluctuation standard deviation and expert prior preference. This integrates various factors such as historical data, statistical analysis and expert experience, making the weight allocation of each feature more reasonable and accurate, and can truly reflect the importance of different features in the fault diagnosis task and algorithm matching.

[0038] 3. Based on the quantification results and weight calculation of the task-algorithm combination, the algorithm with the highest score is selected as the optimal recommended algorithm for the current task. This can quickly and accurately select the most suitable algorithm for the current fault diagnosis task from many candidate algorithms, reducing the time and effort cost of manual screening and trial and error. Attached Figure Description

[0039] Figure 1 This is a schematic diagram of the method flow according to an embodiment of the present invention;

[0040] Figure 2 This is a partial code diagram of the fault diagnosis isolated forest algorithm generated in an embodiment of the present invention. Detailed Implementation

[0041] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the protection scope of the present invention.

[0042] Large language models possess powerful code generation capabilities, enabling them to automatically generate fault diagnosis codes for communication networks and diagnose faults in massive amounts of network data. However, in automated scenarios, large language models lack explicit label guidance, making it impossible to generate unsupervised learning field methods specifically. Furthermore, large language models struggle to select appropriate supervised learning algorithms based on the task. Unlike general machine learning tasks, communication network operation and maintenance environments exhibit significant real-time constraints and resource limitations. On one hand, during network operation, state data accumulates over time. When a system failure occurs, fault feature data generated by the faulty device becomes mixed within this massive dataset. The rapid fluctuations in network status require fault detection algorithms to complete feature extraction and anomaly determination within millisecond response times. Traditional methods relying on manual screening, limited by labor costs and efficiency, struggle to accurately locate anomalies from the vast amount of data, severely restricting the timeliness and accuracy of fault detection. On the other hand, operation and maintenance systems are often deployed on edge nodes or virtualization platforms with limited computing and storage resources, making it difficult to handle the high-intensity computations of complex models. Therefore, how to automate the selection and generation of fault diagnosis algorithms under limited computing power and latency constraints has become a core bottleneck issue in intelligent communication operation and maintenance. To address this, this invention proposes a heuristic matching algorithm based on fault task type. By constructing a mapping rule between fault type and algorithm capability, the algorithm selection process can be automated and the task can be adaptively optimized.

[0043] like Figure 1 As shown, this embodiment of the invention provides a communication network fault diagnosis method based on heuristic matching of large language models, including the following steps:

[0044] Step S1: Obtain the set of fault diagnosis tasks and the candidate set of fault diagnosis algorithms, extract multi-dimensional features of fault diagnosis tasks, and construct heuristic matching features including dimensionality matching degree, sparsity adaptability, semantic adaptability, model complexity penalty, and historical performance feedback.

[0045] Specifically, the set of fault diagnosis tasks is defined as follows:

[0046] ;

[0047] In the formula, T represents several identifiable fault task types in the communication network, such as performance fluctuations, resource exhaustion, and connection anomalies. This represents the total number of task types for failed tasks.

[0048] The candidate set of unsupervised learning fault diagnosis algorithms is denoted as:

[0049] ;

[0050] In the formula, It covers a variety of mainstream unsupervised anomaly detection algorithms, including Isolation Forest (IF), Local Outlier Factor (LOF), One-Class SVM (OCSVM), AutoEncoder (AE), Principal Component Analysis (PCA), etc. This represents the total number of types of unsupervised anomaly detection algorithms.

[0051] Construct the objective function and find task T i The optimal algorithm A j This achieves an optimal balance between performance, stability, and complexity. To accomplish this, a set of heuristic matching features is introduced. :

[0052] This invention designs five types of heuristic matching features from three levels: task characteristics, data structure, and algorithm capabilities, as defined below:

[0053] Dimensional matching degree This is used to measure the adaptability of data feature dimensions in fault diagnosis tasks to candidate fault diagnosis algorithms for processing high-dimensional feature spaces. In communication operation and maintenance scenarios, the collected data typically contains tens to hundreds of feature dimensions, such as performance counters, interface traffic, and signal quality. High-dimensional feature spaces often lead to the curse of dimensionality, causing a significant decline in the performance of traditional density-based or clustering-based algorithms. Therefore, this invention's embodiments design a dimension matching degree feature... This is used to characterize the fit between the task data dimensionality and the algorithm characteristics. When the dimensionality is high, algorithms with feature compression or reconstruction capabilities, such as PCA and AutoEncoder, are preferred to reduce feature space noise and improve the robustness of anomaly detection. Its expression is as follows:

[0054] ;

[0055] In the formula, for and Dimensional matching degree between them; For the first One type of fault task; For the first A fault diagnosis algorithm; For data dimensions.

[0056] Sparse adaptive features This term represents the sparsity of abnormal samples in a fault diagnosis task. Anomalies in communication networks are typically sparsely distributed, such as link packet loss or CPU spikes, representing a very low proportion of the overall sample. Density-based algorithms may be unstable under extremely sparse sample conditions, leading to an increased false alarm rate. Therefore, this invention introduces a sparsity adaptive feature. This method evaluates the algorithm's sensitivity to sparse anomalies by calculating the local density distribution and volatility of the samples, thus providing a quantitative basis for algorithm selection. This feature can avoid model overfitting or excessive smoothing when detecting sparse anomalies, improving the accuracy of sparse fault detection. Its expression is:

[0057] ;

[0058] In the formula, for and Sparse adaptability between them; The number of samples; For the sample The number of neighbors is usually 5, 10, or 20; For sample set The first in One sample; For the sample The The nearest neighbor.

[0059] Sample Recent Each sample point is used as a neighbor, and these neighbors are compared with... The algorithm estimates the local density by measuring the distance between samples and determines whether there are enough neighbors around a sample. If there are few nearby samples around a sample, the algorithm is prone to instability.

[0060] Semantic fit This measure assesses the semantic similarity between natural language keywords used in fault diagnosis tasks and the design principles of fault diagnosis algorithms. Task descriptions of communication faults are often expressed in natural language or event labels, and different algorithms exhibit significant differences in adaptability when handling sudden, periodic, or trend-based anomalies. Task semantic fit. By matching the semantic similarity between natural language keywords and algorithm design principles, the system can automatically understand the semantics of the task and match the appropriate algorithm type. For example, "sudden anomaly" is highly compatible with the random segmentation mechanism of the IF algorithm, while "trend change" is more suitable for the reconstruction detection mechanism of the AE or PCA model. This feature effectively improves the semantic intelligence of task-algorithm matching, and its expression is:

[0061] ;

[0062] In the formula, for and Semantic compatibility between them.

[0063] Model complexity penalty To meet the low latency requirements of real-time diagnosis, the algorithm complexity must be within a controllable range. This invention addresses this by penalizing model complexity. This design quantifies factors such as algorithm parameter size and computation time into penalty terms, enabling the system to automatically prioritize lightweight algorithms, such as IF or LOF, in resource-constrained scenarios. This ensures high response rates with low power consumption even at edge nodes, thus maintaining system real-time performance under resource constraints. (Model complexity penalty) This is used to measure the computational complexity of an algorithm. For edge devices or real-time diagnostic scenarios, algorithms with lower complexity are preferred. The expression for this is:

[0064] ;

[0065] In the formula, for and Model complexity penalty between; These are weight parameters; For the first The total number of parameters for a fault diagnosis algorithm.

[0066] Historical performance feedback This is used to record the performance of fault diagnosis algorithms in handling similar fault diagnosis tasks based on historical data. Fault modes in communication networks evolve over time, and the performance of algorithms on different tasks fluctuates with changes in network status and device topology. Therefore, this embodiment of the invention introduces historical performance feedback features. This feature is used to dynamically record the algorithm's historical F1 scores on different task types, improving the empirical reliability of algorithm selection through a historical data-driven adaptive optimization mechanism. This feature is equivalent to the system's memory mechanism, allowing algorithm selection to no longer rely on a single match but rather on a dynamic trade-off based on long-term performance. Its expression is:

[0067] ;

[0068] ;

[0069] In the formula, for and Historical performance feedback between; Fault diagnosis algorithm In fault diagnosis task The average F1 score; for The accuracy rate; for Recall rate.

[0070] Step S2: Quantitatively evaluate the matching degree between the fault diagnosis task and the candidate fault diagnosis algorithm combination based on the heuristic matching features, and calculate the weight of each feature in the heuristic matching features based on the historical performance expectation, the standard deviation of performance fluctuation and the expert prior preference.

[0071] Step S3: Based on the quantification results and weights of the heuristic matching features, calculate the weighted scoring function of the combination of the fault diagnosis task and the candidate fault diagnosis algorithm, select the fault diagnosis algorithm with the highest score of the weighted scoring function as the optimal recommendation algorithm for the corresponding fault diagnosis task, and drive the large language model to generate the corresponding fault diagnosis algorithm code according to the selected optimal recommendation algorithm and the description of the fault diagnosis task.

[0072] Specifically, the matching degree between the fault diagnosis task and the candidate fault diagnosis algorithm combination is quantitatively evaluated based on heuristic matching features to obtain the matching feature value of each combination, and a weighted scoring function is defined for each task-algorithm combination (T). i A j The weighted scoring function is expressed as follows:

[0073] ;

[0074] In the formula, This represents the weight of the nth heuristic matching feature; Let be the value of the nth heuristic matching feature.

[0075] This invention proposes an adaptive dynamic weight calculation method that intelligently allocates weights to each matching feature by incorporating three types of information: task evidence, historical performance, and stability. The weights are calculated based on the average performance of each heuristic matching feature in historical tasks. and stability Combined with the expert prior preferences of the current task The unnormalized score is calculated and then normalized using the Softmax function to obtain the weights. This method enables the system to dynamically adjust the importance of each feature across different tasks and algorithms, taking into account both the reliability of historical experience and the adaptability to the current task, thereby achieving self-learning and self-evolution in algorithm selection. The calculation formula is as follows:

[0076] ;

[0077] In the formula, This is a scaling factor used to adjust the impact of historical performance differences in weight calculation, used to control the sharpness of the Softmax weight distribution, thereby balancing the relative importance of historical experience and current task preferences in feature weight allocation; The expected historical performance of the k-th matching feature is obtained by statistically analyzing the diagnostic success rate of the algorithms involved in this feature on the task in historical data. This is the standard deviation of performance fluctuation corresponding to the k-th matching feature. Based on this, the standard deviation of its historical accuracy is further calculated; For the expert prior preference corresponding to the k-th matching feature, before the task starts, the expert sets a task-feature scoring table in advance and obtains the corresponding value by looking up the table; This represents the total number of matching features.

[0078] Finally, the algorithm with the highest score, A, was selected. * Recommendation algorithm for the current task:

[0079] .

[0080] In the specific operational process, the system first performs task identification, parses the natural language task description or fault label, and maps it to the corresponding task type T. i The system extracts data features, including statistical indicators such as dimensionality, sparsity, and density distribution, to form a task feature vector. Then, it performs a scoring calculation and evaluates all candidate algorithms based on a heuristic matching feature system. Finally, it selects the optimal algorithm and automatically generates an unsupervised learning algorithm that is suitable for the current task, thereby achieving efficient communication network fault detection.

[0081] This invention, through the construction of a heuristic algorithm matching mechanism based on fault task types, enables the system to dynamically and adaptively select the optimal algorithm combination from multiple candidate algorithms, and achieve a comprehensive performance balance of high efficiency, accuracy, and real-time performance by combining task characteristics. The key components of this architecture—data preprocessing module, large language model code generation unit, code compilation component, fault diagnosis module, and feedback optimization mechanism—work together to form an intelligent diagnostic closed loop with self-learning, adaptive, and interpretable characteristics. This closed-loop system enables fully automated processing from raw network data input to accurate fault diagnosis, effectively improving the efficiency and reliability of communication network fault diagnosis. This technical approach differs from traditional static algorithm selection or fixed model training methods, enabling intelligent decision optimization in complex, heterogeneous, and resource-constrained communication operation and maintenance scenarios.

[0082] After selecting an unsupervised learning algorithm suitable for the current task, this embodiment of the invention designs a few-shot learning generation method to generate code for an unsupervised learning algorithm for communication network fault diagnosis. To achieve communication network fault detection, this embodiment first employs prompting engineering techniques to perform few-shot learning training on a large language model. Furthermore, considering the specific scenarios and technical requirements of communication network fault detection, a highly adaptable prompting word strategy is designed. The core of this strategy lies in enabling the large language model to fully understand the technical points and logical framework of the communication network fault detection task through precise prompt construction, thereby generating algorithm code that meets the needs of practical applications.

[0083] In communication network fault diagnosis code generation technology based on large language models, the prompt system typically consists of three core components: system settings, user requests, and model responses. These three components work together to form the context for task execution, enabling automated generation from requirement description to runnable code.

[0084] In this embodiment of the invention, this prompting system is specifically used for scenarios involving the generation of few-sample codes for communication network anomaly detection and diagnostic codes. Its mechanism of action is as follows:

[0085] System settings

[0086] The system is configured to define the role, knowledge scope, and behavioral style of the large language model, and provides global background information and constraints in the generation task. By introducing professional knowledge positioning in communication operations and machine learning into this part, the model can automatically limit the output to structured, executable code that conforms to industry standards. For example, the system can be configured as: "You are a code generation expert proficient in communication network operations and artificial intelligence algorithms, capable of writing runnable Python anomaly detection programs based on user descriptions, supporting commonly used libraries such as scikit-learn and PyTorch."

[0087] Such settings ensure that the model follows technical specifications in subsequent generation, avoiding the output of irrelevant or erroneous content.

[0088] User request (User)

[0089] The user request section carries the end-user's task instructions and business requirements, typically including key information such as data source and structure, analysis objectives, algorithm type, and output requirements. In this invention, this section may include, for example, a description of the network device's operating data format, such as timestamps, CPU utilization, memory usage, packet loss rate, etc.; the desired anomaly detection algorithm type, such as a deep autoencoder; and the result presentation format, such as anomaly score output.

[0090] Since this part is the direct basis for the model generation logic, its level of detail and accuracy will directly affect the usability and performance of the final generated code.

[0091] Model Response (Assistant)

[0092] The model response section is the task result output area generated by the large language model based on system settings and user requests. In this embodiment of the invention, this section typically includes complete, runnable code automatically generated in response to user requests, necessary explanations, and the model training and inference process. For example, the model can automatically output a PyTorch-based deep autoencoder implementation, including steps such as data loading, model structure definition, training process, and anomaly scoring.

[0093] This response not only has the feasibility of being run directly, but can also be quickly adapted to different network environments and anomaly types through few-sample learning, thereby improving the efficiency and accuracy of fault diagnosis.

[0094] In the process of communication network anomaly detection, the network devices involved are not only structurally complex, encompassing various types such as routers, switches, and servers, but also exhibit significant differences in operating parameters and log formats, resulting in prominent data heterogeneity. Simultaneously, the objective of fault detection is clear: to quickly and accurately identify abnormal states in the network. This places extremely high demands on the targeting and effectiveness of the generation algorithm. Therefore, the construction of prompt words must adhere to the core principles of semantic coherence and functional completeness of the generation algorithm. It must ensure that the algorithm can accurately understand the data characteristics of different types of network devices and guarantee its stable fault detection capabilities in complex network environments. By combining the above three parts into a prompt structure oriented towards few-sample learning, this embodiment of the invention can still achieve high-precision automatic generation of anomaly detection code for communication networks even in the absence of large-scale labeled data.

[0095] The few-shot learning strategy employed does not simply embed task examples, but rather selects a small number of representative, high-quality task examples through a rigorous screening mechanism. These examples cover common fault types, data characteristics, and corresponding algorithm implementation logic in communication networks, comprehensively reflecting the core elements of the task. After embedding these examples with prompt words, an input template with stronger context awareness can be constructed. This template guides the model to extract the structural patterns of the task from the examples, understand the design ideas and implementation logic of algorithms under different fault scenarios, and thus improve the model's adaptability to new fault detection tasks and the quality of code generation.

[0096] Compared with traditional methods that rely on manual coding or large-scale data training, this solution significantly improves the generation speed and algorithm coverage, and has strong task transfer capabilities, providing basic support for building large-scale intelligent communication network operation and maintenance systems.

[0097] Example 1: A Few-Sample Hint Structure for Anomaly Detection in Communication Networks

[0098] In this embodiment, a prompt structure consisting of System settings, User requests, and Assistant responses is adopted for the task of generating communication network fault diagnosis codes. The functional positioning and example information of each part are shown in Table 1.

[0099] Table 1 Prompt words

[0100] Tip Category Function Description Example information (Communication network anomaly detection task) System settings Define the identity, role, knowledge scope, and behavioral constraints of the large language model in the generation task, providing technical background and rule boundaries for subsequent tasks. "You are an AI code generation expert familiar with communication network operation and maintenance and machine learning. You are able to use Python to generate anomaly detection programs that conform to industry standards based on user-provided descriptions. The generated code should be executable, structurally clear, and should prioritize the use of standard libraries such as scikit-learn or PyTorch." User request (User) The natural language task description, input by the end user, includes data types, feature fields, analysis objectives, and output requirements, providing specific business instructions for code generation. "We have a set of operational data (CSV format) for communication network equipment, including fields such as timestamp, CPU utilization, memory usage, and packet loss rate. Please implement unsupervised anomaly detection using a deep autoencoder method and output an anomaly score for each record." Model Response (Assistant) The large language model is a technical implementation based on system settings and user requests, and may include complete code, operating instructions, and result output methods. "The following is the code for a deep autoencoder model implemented in PyTorch, including data loading, model building, training process, and anomaly score calculation method, which is used to detect anomalies in the operating data of communication network devices."

[0101] In this embodiment, the prompts shown in the table can be replaced or expanded according to different network environments, algorithm requirements, and data types to adapt to different anomaly detection task scenarios. Through this structure, the large language model can quickly generate high-quality code that meets expectations under conditions of few samples, thereby significantly shortening the research and development and deployment cycle of communication network fault diagnosis.

[0102] Example 2: Fault Diagnosis Method for Unsupervised Learning in Large Language Model Generation

[0103] Building upon a few-shot learning code generation framework, and further incorporating unsupervised learning methods, a dynamic algorithm for communication network fault diagnosis is constructed. For clarity, this embodiment uses the Isolation Forest algorithm as an example to illustrate its specific application in communication network anomaly detection.

[0104] When the system is operating normally, the collected feature data reflects normal working conditions; however, when a fault occurs, the collected data differs significantly from normal samples. These anomalous feature data typically deviate from the normal dataset in numerical distribution, exhibiting clear outlier characteristics. Based on this property, the Isolation Forest method can efficiently identify and isolate such anomalous data points, providing technical support for the accurate location of communication network faults. Because anomalous samples are relatively few in number and their feature values ​​deviate significantly, this method can isolate them in a multidimensional feature space with fewer segmentation steps, thereby improving the sensitivity and reliability of detection.

[0105] First, several isolated trees are trained using feature data collected from the communication network, forming an isolated forest. Then, each sample point is fed into each isolated tree in the forest, and the average height is calculated. Finally, the outlier score for each sample point is calculated. Let the collected sample dataset be a matrix. The first in the matrix The vector of sample points is ,vector It contains feature values ​​with d dimensions, expressed as follows:

[0106] ;

[0107] From the matrix Randomly select m sample points as subsamples As a single tree in an isolated forest, it is placed at its root node. From the sample point vector... From the d dimensions, a dimension q is randomly selected. Within the range of all sample points in the current dimension, a split point p is randomly generated. The split point is generated between the maximum and minimum values ​​of all sample points in the current dimension.

[0108] ;

[0109] The selection of this split point p generates a hyperplane that divides the data space of all sample points in the current dimension into two subspaces. Points with values ​​less than p under the currently selected feature variable are placed in the left branch of the current node, and points with values ​​greater than or equal to p are placed in the right branch of the current node. This splitting is repeated on the left and right branches of the node, continuously constructing new leaf nodes, until a leaf node contains only one data point, indicating that further splitting is not possible, or the number of iterations has reached the set number of algebras.

[0110] vector x i The feature values ​​corresponding to all other dimensions in the d dimensions are segmented according to the above segmentation method to complete the generation of isolated trees for all dimension feature data.

[0111] Finally, for each data point Traverse each isolated tree and calculate the points. Average height in isolated forests Meanwhile, the average height of all data points is normalized. The formula for calculating the outlier score in the feature data collected by the communication network is as follows:

[0112] ;

[0113] In the formula, For sample points exist The anomaly index in the isolated tree formed by the training data of each sample, with a value range of [0,1]; For a given number of samples The average path length is used for sample points. Path length Standardize the process.

[0114] Anomaly detection is categorized as follows: A value closer to 1 indicates a higher probability that the feature data is an outlier; a value closer to 0 indicates a higher probability that the feature data is normal; if most training samples... The values ​​are all close to 0.5, indicating that there are no obvious outliers in the entire dataset.

[0115] Based on the large language model, the above process is transformed into: Figure 2 The code for the isolated forest algorithm in the communication network shown.

[0116] This invention addresses the challenges of algorithm development and application in the field of communication network anomaly detection, as well as the limitations of large language models in handling massive amounts of network data. Leveraging the powerful generative capabilities of large language models in converting natural language to code, the model automatically generates a runnable anomaly detection algorithm through a natural language description and analysis task. Compared to traditional programming paradigms, this method significantly lowers the barrier to algorithm development, allowing more people without in-depth professional knowledge to participate in algorithm applications. It also enhances the model's adaptability to various communication network operation and maintenance scenarios, improving its practicality in different environments. The final generated fault diagnosis algorithm code no longer requires the same amount of input data as the large language model's input token length, effectively enabling the analysis of massive amounts of network status data and providing a more efficient and comprehensive solution for communication network anomaly detection.

[0117] The technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described; only preferred embodiments of the present invention are illustrated. The descriptions are relatively specific and detailed, but they should not be construed as limiting the scope of the present invention. As long as the combination of these technical features does not contradict each other, it should be considered within the scope of this specification.

[0118] It should be noted that those skilled in the art can make various modifications and improvements without departing from the inventive concept, and these all fall within the scope of protection of this invention. Therefore, the scope of protection of this invention should be determined by the appended claims.

Claims

1. A method for fault diagnosis of communication networks based on heuristic matching of large language models, characterized in that, Includes the following steps: Step S1: Obtain the set of fault diagnosis tasks and the candidate set of fault diagnosis algorithms, extract multi-dimensional features of fault diagnosis tasks, and construct heuristic matching features including dimensionality matching degree, sparsity adaptability, semantic adaptability, model complexity penalty and historical performance feedback. Step S2: Quantitatively evaluate the matching degree between the fault diagnosis task and the candidate fault diagnosis algorithm combination based on the heuristic matching features, and calculate the weight of each feature in the heuristic matching features based on historical performance expectation, performance fluctuation standard deviation and expert prior preference; Step S3: Based on the quantization results of the heuristic matching features and the weights, calculate the weighted scoring function of the combination of the fault diagnosis task and the candidate fault diagnosis algorithm, select the fault diagnosis algorithm with the highest score of the weighted scoring function as the optimal recommendation algorithm for the corresponding fault diagnosis task, and drive the large language model to generate the corresponding fault diagnosis algorithm code according to the selected optimal recommendation algorithm and the description of the fault diagnosis task.

2. The communication network fault diagnosis method based on heuristic matching of large language models according to claim 1, characterized in that: The dimension matching degree mentioned in step S1 is used to measure the adaptability of the data feature dimension of the fault diagnosis task to the high-dimensional feature space processing of the candidate fault diagnosis algorithm. When the data feature dimension of the task is high, algorithms with feature compression or reconstruction capabilities are preferred. The expression for the dimension matching degree is: ； In the formula, for and Dimensional matching degree between them; For the first One type of fault task; For the first A fault diagnosis algorithm; For data dimensions; This is the Isolation Forest algorithm; It is a self-encoder.

3. The communication network fault diagnosis method based on heuristic matching of large language models according to claim 1, characterized in that: The sparsity adaptability is used to represent the sparsity of anomalous samples in a fault diagnosis task. The sensitivity of the fault diagnosis algorithm to sparse anomalies is evaluated by calculating the local density distribution and volatility of the anomalous samples. The expression for the sparsity adaptability is: ； In the formula, for and Sparse adaptability between them; The number of samples; For the sample The number of neighbors; For sample set The first in One sample; For the sample The The nearest neighbor.

4. The communication network fault diagnosis method based on heuristic matching of large language models according to claim 1, characterized in that: The semantic fit is used to measure the semantic similarity between the natural language keywords of the fault diagnosis task and the design concept of the fault diagnosis algorithm. The expression for the semantic fit is: ； In the formula, for and Semantic compatibility between them.

5. The communication network fault diagnosis method based on heuristic matching large language model according to claim 1, characterized in that: The model complexity penalty is used to measure the computational complexity of the fault diagnosis algorithm, and the expression for the model complexity penalty is: ； In the formula, for and Model complexity penalty between; These are weight parameters; For the first The total number of parameters for a fault diagnosis algorithm.

6. The communication network fault diagnosis method based on heuristic matching of large language models according to claim 1, characterized in that: The historical performance feedback is used to record the performance of the fault diagnosis algorithm in handling similar fault diagnosis tasks in historical data. The expression for the historical performance feedback is: ； ； In the formula, for and Historical performance feedback between; Fault diagnosis algorithm In fault diagnosis task The average F1 score; for The accuracy rate; for Recall rate.

7. The communication network fault diagnosis method based on heuristic matching large language model according to claim 1, characterized in that: In step S2, an adaptive dynamic weight calculation method is used to determine the weights of each feature in the heuristic matching features. The expression for the weights is: ； In the formula, Let be the weight of the nth matching feature; This is the scaling factor; This represents the expected historical performance for the k-th matching feature. The standard deviation of performance fluctuation corresponding to the k-th matching feature; The prior preference corresponding to the k-th matching feature; This represents the total number of matching features.

8. The communication network fault diagnosis method based on heuristic matching of large language models according to claim 1, characterized in that: In step S3, by employing prompt word engineering techniques and a few-shot learning strategy, the large language model is driven to generate corresponding fault diagnosis algorithm code based on the selected optimal recommendation algorithm and the description of the fault diagnosis task.

9. The communication network fault diagnosis method based on heuristic matching of large language models according to claim 8, characterized in that: The few-shot learning strategy utilizes a cue word structure consisting of the following three core components: System settings: used to define the role, knowledge scope, and behavioral style of the large language model in code generation tasks; User request: Used to carry the task instructions, data source and structure, and analysis objectives input by the end user; Model Response: Outputs automatically generated complete runnable code, necessary explanations, and the model training and inference process.

10. The communication network fault diagnosis method based on heuristic matching of large language models according to claim 1, characterized in that: The fault diagnosis algorithm code generated by the large language model is a complete and runnable program, which includes data loading, model structure definition, training process and anomaly scoring.

Images