A fault autonomous method and system based on cross-modal decision

Abstract

This invention provides a fault autonomy method and system based on cross-modal decision-making, relating to the field of data processing technology. The method includes: acquiring multimodal data; obtaining a three-dimensional data cube based on the multimodal data using a spatiotemporal alignment algorithm; extracting and fusing features from the three-dimensional data cube using a multi-expert fusion model to obtain fused features; the multi-expert fusion model specifically includes: a log semantic parsing module, a performance time-series analysis module, a topological relationship reasoning module, and a feature fusion module. Based on the fused features, a fault root cause feature is determined using an LSTM module; based on the three-dimensional data cube and the fault root cause feature, a repair strategy is generated through reinforcement learning; the effectiveness of the repair strategy is verified using a digital twin model; if effective, fault autonomy is performed according to the repair strategy; otherwise, the parameters of the multi-expert fusion model are adjusted.

Description

Technical Field

[0001] This invention relates to the field of complex system automation, and in particular to a fault autonomous method and system based on cross-modal decision-making. Background Technology

[0002] The rapid development of information technology has led to the widespread adoption of complex systems across various industries. The massive amounts of data generated by these systems pose significant challenges to traditional operations and maintenance (O&M) methods. Generative AI technology, however, can deeply analyze O&M data, predict failure trends, and combine with reinforcement learning to achieve intelligent diagnosis and recovery. Digital twin technology can test fault recovery solutions in virtual environments to improve system reliability, offering new possibilities for solving traditional O&M dilemmas.

[0003] Currently, the relevant technologies mainly fall into three categories: first, traditional operation and maintenance methods, which are used to handle the daily operation and maintenance needs of complex systems; second, generative AI technology, which can deeply analyze operation and maintenance data and predict fault trends, and combine reinforcement learning to carry out intelligent diagnosis and fault recovery; and third, digital twin technology, which can test fault recovery solutions in a virtual environment to help improve the reliability and stability of the system.

[0004] However, existing technologies have several shortcomings: traditional operation and maintenance methods are difficult to adapt to the large amounts of data generated by complex systems, and their processing capabilities are limited; at the same time, the overall technical solutions also suffer from slow information processing speed and complex user operation processes, failing to meet the needs of efficient and convenient operation and maintenance; in addition, due to the existence of data security vulnerabilities, existing solutions are unable to guarantee data security during information processing, and cannot provide users with secure operation and maintenance solutions. Summary of the Invention

[0005] In view of the shortcomings of the prior art, the purpose of this invention is to provide a fault autonomous method based on cross-modal decision-making, which can solve the problems of traditional operation and maintenance methods being unable to adapt to the large amount of data generated by complex systems and having limited processing capabilities; at the same time, the overall technical solution also has the problems of slow information processing speed and complex user operation process, which cannot meet the needs of efficient and convenient operation and maintenance; in addition, due to the existence of data security vulnerabilities, the existing solution is also unable to guarantee data security during information processing, and cannot provide users with a secure operation and maintenance solution.

[0006] A first aspect of this invention proposes a fault autonomy method based on cross-modal decision-making, comprising: S1: Acquire multimodal data.

[0007] S2: Based on multimodal data, a three-dimensional data cube is obtained through a spatiotemporal alignment algorithm.

[0008] S3: Through a multi-expert fusion model, feature extraction and feature fusion are performed on the three-dimensional data cube to obtain fused features.

[0009] The multi-expert fusion model specifically includes: a log semantic parsing module, a performance time series analysis module, a topological relationship reasoning module, and a feature fusion module.

[0010] S4: Based on the fusion characteristics, the root cause characteristics of the fault are determined through the LSTM module.

[0011] S5: Based on the 3D data cube and the root cause features of the fault, a repair strategy is generated through reinforcement learning.

[0012] S6: Verify the effectiveness of the repair strategy using a digital twin model. If effective, implement autonomous fault management according to the repair strategy. Otherwise, adjust the parameters of the multi-expert fusion model.

[0013] A second aspect of this invention proposes a fault autonomous system based on cross-modal decision-making, comprising: a processor and a memory.

[0014] The memory stores a program or instructions that can run on the processor, and when the program or instructions are executed by the processor, they implement the steps of the fault autonomy method based on cross-modal decision-making as described in the first aspect.

[0015] A third aspect of the present invention provides a readable storage medium on which a program or instructions are stored, which, when executed by a processor, implement the steps of the fault autonomy method based on cross-modal decision-making as described in the first aspect.

[0016] The beneficial effects of the technical solutions provided in the embodiments of the present invention include at least the following: In this embodiment of the invention, a multi-expert fusion model and a four-level progressive closed-loop link are used to avoid the limitations of manual processing, significantly improving the adaptability and processing capabilities for large amounts of operational data. Simultaneously, by combining reinforcement learning and digital twin technologies, optimal repair strategies are automatically and efficiently generated, significantly reducing the complexity of user operations. Furthermore, through anomaly detection and digital twin technologies, abnormal access and risky behaviors in data flow can be monitored in real time, reducing the risk of data leakage and tampering during information processing, providing users with a secure operational solution. Attached Figure Description

[0017] The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Throughout the drawings, the same reference numerals denote the same parts. Obviously, the drawings described below are merely some embodiments of the present invention, and those skilled in the art can obtain other drawings based on these drawings without any creative effort.

[0018] Figure 1 This is a flowchart illustrating a fault autonomy method based on cross-modal decision-making provided in an embodiment of the present invention.

[0019] Figure 2 This is a schematic diagram of the structure of a fault autonomous system based on cross-modal decision-making provided in an embodiment of the present invention. Detailed Implementation

[0020] To enable those skilled in the art to better understand the technical solutions in the embodiments of the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. It should be understood that these descriptions are merely exemplary and are not intended to limit the scope of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0021] The fault autonomy method based on cross-modal decision-making provided by the present invention will be described in detail below with reference to the accompanying drawings, through specific embodiments and application scenarios.

[0022] Reference manual attached Figure 1 The diagram shows a flowchart of a fault autonomy method based on cross-modal decision-making provided by an embodiment of the present invention.

[0023] This invention provides a fault autonomy method based on cross-modal decision-making, which may include the following steps: S1: Acquire multimodal data.

[0024] Specifically, multimodal data includes: log stream data, performance metric data, and device data.

[0025] S2: Based on multimodal data, a three-dimensional data cube is obtained through a spatiotemporal alignment algorithm.

[0026] In one possible implementation, S2 specifically includes sub-steps S201 to S209: S201: Preprocess the log stream data using regular expressions to extract key log fields.

[0027] Regular expressions are special strings used to describe text patterns. They enable operations such as matching, searching, extracting, or replacing strings through predefined character rules and syntax.

[0028] Specifically, the preprocessing formula is as follows: ; in, LogFieldr Indicates the first r The target field in the log stream data, RegexExtract represents the regular expression extraction function. RawLog r Indicates the first r One original log entry, Pattern s Indicates the first s A regular expression pattern.

[0029] It should be noted that by preprocessing log stream data and extracting key fields using regular expressions, the pain points of the original log stream being "unstructured, information redundant, and diverse in format" can be efficiently addressed. The extracted standardized key fields can also directly provide structured input for subsequent steps such as log semantic feature extraction and multimodal data fusion, avoiding interference from unstructured data to downstream models and significantly improving the stability and efficiency of the overall fault analysis chain.

[0030] S202: Convert log key fields into log field embedding vectors.

[0031] S203: Based on the log field embedding vector, determine the log anomaly probability and anomaly labeling results using a BiLSTM-based classification model.

[0032] Among them, Bidirectional Long Short-Term Memory (BiLSTM) refers to an improved model based on Recurrent Neural Network (RNN) specifically designed for processing sequence data.

[0033] In one possible implementation, the formula for calculating the log anomaly probability is: ; in, Panorama Indicates the probability of an anomaly. s denoted as Sigmoid activation function, BiLSTM as bidirectional long short-term memory network, and Emb as embedding layer.

[0034] Furthermore, when the probability of an anomaly is greater than a preset probability, the log field is marked as an anomaly log.

[0035] It should be noted that those skilled in the art can set the magnitude of the preset probability of judgment according to actual needs, and this invention does not limit this.

[0036] It's worth noting that BiLSTM's bidirectional temporal modeling capabilities effectively capture the dependencies between log fields, avoiding the omission of contextual information in unidirectional models. Furthermore, the input method based on log field embedding vectors preserves the semantic relationships between fields, making the model more interpretable of the log content. Finally, the anomaly probabilities and anomaly labels output by the classification model provide refined anomaly signals for subsequent fault analysis and ensure the interpretability of anomaly detection, significantly improving the accuracy and practicality of log anomaly detection.

[0037] S204: The feature shift of performance index data is detected through an adaptive sliding window mechanism, and the feature shift detection result is obtained.

[0038] Specifically, the sliding window in the adaptive sliding window mechanism is: ; in, W h ( t )express t The size of the sliding window at any given time. W 0 represents the initial window size. It represents exponential operations with the natural constant as the base. l This represents the adjustment coefficient. Volatility ( t )express t Volatility of performance metrics at any given time.

[0039] In one possible implementation, S204 specifically includes sub-steps S2041 to S2042: S2041: Calculate the JS divergence between the window feature distribution and the historical normal distribution through an adaptive sliding window mechanism.

[0040] Among them, the adaptive sliding window mechanism refers to a time window technology that can dynamically adjust the window size and sliding step size according to data characteristics (such as fluctuation amplitude and frequency) or business needs. Unlike fixed windows, its core is to balance the sensitivity and noise resistance of data processing by adjusting as needed. It is widely used in real-time analysis scenarios of time series data (such as performance indicators and log streams) (such as anomaly detection and trend capture).

[0041] In one possible embodiment, the formula for calculating the JS divergence is: ; in, D t express t The performance index characteristic distribution at any given time. D base Represents the distribution of historical normal performance indicators, JS( Dt , D base )express t The JS divergence values ​​of the performance index feature distribution at time point and the historical normal performance index feature distribution, where KL() represents the KL divergence. M express t The average distribution of performance index characteristics at any given time and the average distribution of historical normal performance index characteristics.

[0042] S2042: When the JS divergence is greater than the preset value, it is determined that the performance index data has drifted, and the feature drift detection result is obtained.

[0043] It should be noted that those skilled in the art can set the value of the preset judgment according to actual needs, and this invention does not limit this.

[0044] In an embodiment of the present invention, S205: Based on device data, construct a network device topology graph using network devices as graph nodes and the physical connections between network devices as edges.

[0045] It should be noted that by abstracting network devices as graph nodes and constructing a topology graph using physical connections as edges, the device relationship structure of a complex network can be presented intuitively, clearly preserving the physical dependencies between devices. This provides a structured foundation for subsequent analysis of fault propagation paths and identification of key nodes, effectively improving the efficiency of network structure cognition and fault location.

[0046] S206: Update the edge weights in the network device topology graph based on real-time connection relationships and time decay factors.

[0047] Among them, the time decay factor is a parameter used to quantify the gradual weakening of the influence of things over time. Its core function is to reduce the weight of historical data on current decision-making and analysis results in time-related scenarios through mathematical rules, so that the system can focus more on recent information.

[0048] In one possible embodiment, the formula for calculating edge weights is: ; in, w ij ( t )express t Moment i Nodes and j Edge weights between nodes β Indicates the real-time state weight. B ij ( t )express t Moment i Nodes and jIndicators of the physical connections between nodes. Indicates the sampling interval. express Moment i Nodes and j Edge weights between nodes c This represents the time decay coefficient.

[0049] It should be noted that combining real-time connection relationships allows edge weights to dynamically reflect the actual connection status between devices (such as link connectivity and transmission quality), avoiding the disconnect between static weights and reality. Introducing a time decay factor can reduce the impact of outdated connection information, making the weights of recent connections more prominent. This allows the edge weights of the topology graph to accurately reflect the real-time dependency strength between devices, providing a reliable basis for fault propagation path analysis and critical link identification, and significantly improving the timeliness and accuracy of fault analysis.

[0050] S207: Based on edge weights and node characteristics, a dynamic adjacency matrix is ​​constructed using a graph attention network.

[0051] Among them, Graph Attention Network (GAT) refers to a model based on an improvement of Graph Neural Network (GNN). Its core is to use an "attention mechanism" to allow nodes in the graph to dynamically assign different weights based on the importance of their neighboring nodes when updating their own features, rather than treating all neighbors equally.

[0052] In one possible embodiment, the specific formula for the dynamic adjacency matrix is: ; in, A ij ( t )express t Time-based dynamic adjacency matrix A ( t ) i line and number j Column elements, w ij ( t )express t Moment i Nodes and j Edge weights between nodes oh ij ( t )express t Moment i Nodes and j Attention scores between nodes; LeakyReLU() represents the activation function. m Represents the attention vector. T This represents the matrix transpose operation. W Represents the weight matrix. hi express i Node characteristics h j express j Node characteristics h c express c Node characteristics c ∈ N ( i )express c Nodes are i A neighboring node of a node.

[0053] It should be noted that graph attention networks can dynamically assign differentiated attention weights to different neighboring nodes based on node characteristics and edge weights, avoiding indiscriminate treatment of all nodes and allowing the adjacency matrix to accurately reflect the differences in node importance. Furthermore, the constructed dynamic adjacency matrix can adapt to the current association state of network devices in real time, rather than being a static, fixed structure. This provides more realistic structured support for subsequent analysis of fault propagation paths and location of core fault nodes, significantly improving the targeting and accuracy of fault analysis.

[0054] S208: Combine the characteristics of the nodes and the dynamic adjacency matrix to obtain the topological relationship data.

[0055] S209: Construct a three-dimensional data cube based on log stream data, performance metric data, and topological relationship data using a spatiotemporal alignment algorithm.

[0056] Among them, the spatiotemporal alignment algorithm refers to a processing technology used to unify the correlation between the time and spatial dimensions of multimodal data. Its core solution is to address the misalignment of timestamps and spatial correlations in data from different sources, ensuring that data can be accurately mapped to the same time segment and the same physical or logical entity, thus providing a consistent spatiotemporal benchmark for multimodal data fusion analysis.

[0057] In one possible implementation, S209 specifically includes sub-steps S2091 to S2094: S2091: Based on the timestamp of the log stream data, synchronize the performance metrics data and topology data, and calculate the time offset: ; in, d t Indicates the time offset. This indicates the point at which the subsequent correlation function Corr reaches its maximum value. value, The time offset parameter is represented by Corr(), which represents the correlation function. LogTime This represents a time series composed of timestamps of log stream data. MetricTimeThis represents the time series of performance indicators in the performance indicator data.

[0058] It should be noted that using log stream timestamps as a unified benchmark can avoid time discrepancies caused by collection delays and inconsistent time standards in performance metrics and topology data. By calculating time offsets, data time differences can be accurately calibrated, eliminating time misalignments between multi-source data, providing a consistent time dimension for subsequent 3D data cube construction, and significantly improving the accuracy of multimodal data association.

[0059] S2092: Map the device topology space to a three-dimensional coordinate system. x The axis indicates the frame number. y The axis indicates the rack number. z Axis indicates equipment level.

[0060] S2093: Calculate the relative coordinates of non-physical devices using a dynamic adjacency matrix. ; in, x i Represents a node i rack number, y i Represents a node i Rack number, z i Represents a node i The equipment level, x j Represents a node j rack number, y j Represents a node j Rack number, z j Represents a node j The equipment level, Represents a node i The local perturbation term.

[0061] It should be noted that by leveraging the real-time device relationships reflected by the dynamic adjacency matrix, relative coordinates can be assigned to non-physical devices without physical locations, solving the problem of their difficulty in being located in the topology map. Simultaneously, the relative coordinates are dynamically updated with the adjacency matrix, accurately matching the real-time association status between non-physical devices and physical devices. Subsequent fault analysis can quickly clarify the location and impact range of non-physical devices in the network structure, avoiding the disruption of fault propagation paths due to the "lack of location" of non-physical devices, and improving the completeness and accuracy of the overall fault analysis.

[0062] S2094: Construct a three-dimensional data cube based on the three-dimensional coordinates of the device topology space in a three-dimensional coordinate system. ; Where Cube represents a three-dimensional data cube. u The device topology space dimension is represented by three-dimensional coordinates ( x , y , z ) is obtained through mapping, v Represents the temporal evolution dimension. w This represents the multimodal feature dimension, which includes log features, performance metrics, and topological features. Norm represents the feature normalization function. Indicates the first w Class features in ( u , v The original value at the coordinates.

[0063] It should be noted that the spatiotemporal alignment algorithm can eliminate spatiotemporal misalignment of multi-source data such as logs, performance metrics, and topological relationships, ensuring precise consistency of data in terms of temporal granularity and spatial correlation. Meanwhile, the three-dimensional data cube structurally integrates multimodal data, clearly presenting the correlation between "time-space-data type," allowing for rapid retrieval of correlated data at specific spatiotemporal levels during subsequent fault analysis, significantly improving the efficiency and accuracy of fault correlation mining.

[0064] In this embodiment of the invention, key fields of logs are extracted using regular expressions, log anomalies are determined using BiLSTM, and performance drift is detected using adaptive windows. Combined with dynamic topology construction, multi-source data is finally integrated into a three-dimensional cube through spatiotemporal alignment. This not only eliminates the format and spatiotemporal misalignment of multi-source data, but also dynamically adapts to device status and data fluctuations, providing structured and real-time multimodal data support for subsequent fault analysis, and significantly improving the accuracy and efficiency of fault location.

[0065] S3: Through a multi-expert fusion model, feature extraction and feature fusion are performed on the three-dimensional data cube to obtain fused features.

[0066] In one possible implementation, S3 specifically includes sub-steps S301 to S309: S301: In the log semantic parsing module, word vectors are generated based on the key fields of the log using a pre-trained word embedding model.

[0067] Among them, pre-trained word embedding models (such as Word2Vec) refer to models that are pre-trained on large-scale general text corpora and can transform discrete words into continuous vectors containing semantic information. The core is to learn the contextual association of words through pre-training, so that the output vectors have semantic features. Subsequent tasks can directly reuse the model without training from scratch.

[0068] It should be noted that the pre-trained word embedding model can reuse the general semantic knowledge learned from large-scale corpora, allowing the word vectors generated from key log fields (such as fault type and device name) to accurately capture semantic relationships (such as similar error vectors being close), without the need for training from scratch. This saves computational resources and provides a high-quality semantic vector foundation for log semantic parsing, improving the accuracy of subsequent analysis.

[0069] S302: Word vectors with a preset ratio of random masking are used to predict word vectors at masking positions through a bidirectional Transformer decoder.

[0070] It should be noted that those skilled in the art can set the size of the preset ratio according to actual needs, and this invention does not limit this.

[0071] Among them, the bidirectional Transformer decoder refers to a decoder variant based on the Transformer architecture. Its core breakthrough is the limitation of traditional unidirectional Transformer decoders (such as the GPT series) that "can only capture context from left to right". It can capture the complete context information of the input sequence in both directions at the same time, and understand semantic associations and logical relationships more accurately.

[0072] Specifically, the bidirectional Transformer decoder consists of a multi-head self-attention mechanism and a feedforward network.

[0073] It should be noted that random masked word vectors can force the model to learn deeper semantic relationships in context. The bidirectional Transformer decoder can capture information from both the preceding and following contexts, improving the accuracy of predicting word vectors at masked positions, thereby enhancing the semantic representation ability of word vectors and providing a more accurate foundation for deep semantic parsing of logs.

[0074] S303: Determine the semantic features of the log based on the word vector prediction results.

[0075] S304: In the performance timing analysis module, the timing sequence of performance indicators is extracted through a three-dimensional data cube.

[0076] It should be noted that the 3D data cube integrates spatiotemporally aligned multi-source data. The extracted performance indicator time series can accurately correspond to specific time granularities and device associations, avoiding time series breaks caused by data misalignment. Simultaneously, it can directly associate log semantic features and topological relationships, providing a complete time series basis for the contextual analysis of performance fluctuations, improving the accuracy and relevance of performance time series analysis.

[0077] S305: Based on the time series of performance indicators, extract performance indicator features through a causal CNN layer.

[0078] Among them, the causal convolutional neural network layer (causal CNN layer) is a convolutional neural network layer specifically designed for processing time-series data. It is used to ensure that the output at a certain moment depends only on the input at that moment and before, strictly follow the causal logic of time-series data, and avoid the distortion of time-series correlation caused by the use of future information in ordinary CNNs.

[0079] In one possible implementation, S305 specifically includes sub-steps S3051 to S3052: S3051: Extracting local temporal features from the time series of performance metrics using a causal CNN layer: ; in, Y l Indicates the first l The output features of a causal convolution layer; Convcausal represents the causal convolution operation. Y l-1 Indicates the first l- Output features of a single causal convolution layer. q l Indicates the first l The kernel size of layered causal convolution. d l Indicates the first l The dilation rate of layered causal convolution. Y 0 represents the output of layer 0. X This represents a time series of performance metrics.

[0080] It should be noted that the causal CNN layer follows temporal causal logic, avoids interference from future information, and can accurately capture the local fluctuation correlations in the temporal sequence of performance indicators. The extracted features closely match the real temporal dependencies, providing a reliable temporal feature basis for subsequent performance anomaly analysis and improving the logic and accuracy of the analysis.

[0081] S3052: Through a multi-head self-attention layer, global temporal dependencies are calculated on local temporal features to obtain performance index features.

[0082] Among them, the multi-head self-attention layer refers to an extended structure based on the self-attention mechanism. Its core is to capture the correlation between elements in the sequence from multiple different feature subspaces through multi-head parallel computing, so that the model can more comprehensively understand the multi-dimensional dependencies of the data (such as semantic, temporal, and structural correlations).

[0083] It should be noted that multi-head self-attention layers can capture the global dependencies of local temporal features in parallel from multiple feature subspaces, making up for the limitations of local features in causal CNNs. The computed global temporal dependencies make performance indicator features contain both local details and overall correlations, providing a more comprehensive temporal basis for the recognition of performance anomaly patterns and improving the completeness and analytical value of features.

[0084] S306: In the topology reasoning module, node embeddings are generated through the GCN layer based on the dynamic adjacency matrix and node features.

[0085] Among them, the graph convolutional network layer (GCN layer) is the core computational layer for processing graph structure data. The core uses a feature aggregation mechanism to ensure that the feature update of each node includes both its own attributes and the features of its neighboring nodes, thereby generating node embeddings that carry local topological association information.

[0086] It's worth noting that the GCN layer automatically aggregates the features of a node itself and those of its neighbors, allowing node embeddings to naturally carry local topological association information. Combined with a dynamic adjacency matrix, node embeddings can be updated in real-time with device connectivity, preventing static features from becoming disconnected from the topology. The generated node embeddings provide accurate feature support for subsequent topological inference, significantly improving the accuracy and timeliness of topological relationship analysis.

[0087] S307: Calculate the mean of node embeddings to obtain topological relationship features.

[0088] It should be noted that by calculating the mean of node embeddings, the local topological association information of all nodes can be integrated to form a global topological relationship feature that reflects the overall network structure, avoiding the local bias of single node features. The mean calculation is simple and efficient, and can reflect the overall topological state in real time with node embedding, providing a unified global topological benchmark for subsequent multimodal feature fusion, and improving the completeness and efficiency of the overall analysis.

[0089] S308: In the feature fusion module, expert weights are calculated through a gating network.

[0090] Among them, gating network refers to a network structure that dynamically controls the transmission and filtering of information through gating mechanism. Its core function is to learn autonomously and adjust the retention or filtering ratio of information based on the feature importance of input data, so as to ensure that the model focuses on key information and suppresses redundant interference.

[0091] In one possible embodiment, the specific formula for expert weights is as follows: ; in, α k Indicates the first k Normalized weighting coefficients for each modality f k Indicates the first k Feature vectors of each modality g ( f k ) indicates the first k Importance score of each modal feature vector w k Indicates the firstk The weight vector of each modality b k Indicates the first k Bias terms for each modality.

[0092] It should be noted that gating networks can dynamically learn the importance of each expert feature based on task requirements, and the calculated expert weights can accurately adapt to the characteristics of real-time data, avoiding the fixed bias of manual weights. This gives key features higher weights, providing a reasonable allocation basis for subsequent feature fusion and improving the targeting and effectiveness of the fused features.

[0093] S309: Combining expert weights, the log semantic feature vector, performance indicator feature vector, and topological relationship feature vector are fused to obtain the fused feature: ; in, f fusion Indicates fusion features, α log The normalized weight coefficients representing the semantic features of the logs. f log Represents the log semantic feature vector. α metric Normalized weighting coefficients representing performance metric characteristics. f metric Represents the feature vector of performance indicators. α topo Normalized weight coefficients representing topological relationship characteristics. f topo Represents the topological relationship feature vector.

[0094] It should be noted that combining expert weights with log semantic feature vectors, performance metric feature vectors, and topological relationship feature vectors allows for dynamic adaptation to data value, avoiding the rigidity of fixed weights. Furthermore, integrating multi-dimensional information from log semantics, performance metrics, and topological relationships compensates for the limitations of single features. The resulting fused features provide more comprehensive and accurate feature support for downstream tasks such as fault location and root cause analysis, significantly improving task effectiveness.

[0095] In this embodiment of the invention, multi-expert modules collaborate to process the data: log semantic parsing captures deep semantics using pre-trained word embeddings and bidirectional Transformers; performance time-series analysis combines causal CNNs and multi-head self-attention to address both local fluctuations and global dependencies; and topological inference aggregates nodes and topological relationships through GCN. Then, a gating network dynamically calculates expert weights to fuse the three types of features. This ensures the accuracy of single-modal features while eliminating the bias of multi-source data through dynamic fusion, providing comprehensive, scenario-adaptive, high-quality fused features for downstream tasks, significantly improving the accuracy and robustness of the analysis.

[0096] S4: Parse each data segment in parallel using the CPU and GPU according to the rearranged order.

[0097] Among them, CPU and GPU parallelism refers to a computing mode in which the central processing unit (CPU) and the graphics processing unit (GPU) work together, each leveraging its hardware advantages to process tasks in parallel.

[0098] In one possible implementation, S4 specifically includes sub-steps S401 to S403: S401: Based on the fusion features, the fault probability is output through the LSTM module.

[0099] Among them, the Long Short-Term Memory (LSTM) module is a variant of the Recurrent Neural Network (RNN) module specifically designed for processing time-series data. Its core function is to solve the gradient vanishing problem when traditional RNNs process long sequences through a gating mechanism, which can effectively capture long-term dependencies in time-series data.

[0100] In one possible embodiment, the specific formula for the failure probability is: ; in, L Indicates the predicted fault category, P fault , L Indicates the fault category as L The probability distribution is given by LSTM(), which represents a Long Short-Term Memory network. f fusion Indicates fusion features, argmax ( ) represents the function for the maximum index. softmax ( ) represents the normalized exponential function. W out This represents the weight matrix of the output layer. h T This represents the hidden state of the LSTM network at the last time step. b out This represents the bias vector of the output layer.

[0101] It should be noted that the fusion feature integrates log stream data, performance index data, and multi-dimensional topology information. The LSTM module can capture the long-term temporal dependencies, and the output fault probability reflects the comprehensive influence of multiple factors and conforms to the dynamic laws of time series, which greatly improves the accuracy and timeliness of fault prediction.

[0102] S402: Determine the warning level based on the probability of failure.

[0103] S403: When the warning level is the preset level, the root cause characteristics of the fault are output through root cause localization guided by the fault knowledge graph.

[0104] It should be noted that those skilled in the art can set the size of the preset judgment level according to actual needs, and this invention does not limit this.

[0105] Root cause analysis refers to the process of tracing and determining the root cause of a fault by analyzing related data (logs, performance metrics, and topology relationships, etc.) starting from the fault symptoms. The core objective is to find the source of the fault (rather than the surface symptoms) and avoid recurring faults by only addressing the symptoms.

[0106] It should be noted that the fault knowledge graph integrates historical fault association rules and expert experience, providing structured knowledge guidance for root cause localization. For preset warning levels, it avoids blind troubleshooting and quickly identifies potential root causes. The output root cause features accurately correlate fault symptoms with their sources, providing a clear basis for fault repair and significantly improving the efficiency and accuracy of root cause localization.

[0107] In this embodiment of the invention, based on fused features, the LSTM module accurately captures the temporal correlation and outputs the fault probability, which is then combined with the warning level to achieve a graded response. For faults of a preset level, the fault knowledge graph guides the root cause localization, forming a complete closed loop of "probability prediction - level classification - precise root cause". This ensures the temporal rationality of fault judgment and improves the pertinence and efficiency of root cause localization, providing reliable support for the entire fault handling process.

[0108] S5: Based on the 3D data cube and the root cause features of the fault, a repair strategy is generated through reinforcement learning.

[0109] Reinforcement learning is an important branch of machine learning. Its core is to learn the optimal behavioral strategy through continuous interaction between an agent and its environment, using a trial-and-error and feedback-based approach. The agent changes the state of the environment by performing actions, and the environment returns corresponding rewards. The agent's goal is to maximize the long-term cumulative rewards through learning, thereby finding the optimal action selection in different states.

[0110] In one possible implementation, S5 specifically includes sub-steps S501 to S503: S501: Construct the state space for reinforcement learning based on fusion features, a three-dimensional data cube, and root cause features of faults.

[0111] It should be noted that the combination of fusion features, 3D data cubes, and root cause features ensures that the constructed state space contains both multimodal integrated features and original spatiotemporal data and root cause information, comprehensively and accurately reflecting the current state of the system. This provides a complete environmental cognitive foundation for reinforcement learning agents, ensuring that subsequent policy learning aligns with real-world scenarios and improves the relevance and effectiveness of decision-making.

[0112] S502: Based on the set of repair actions, construct the action space for reinforcement learning. The set of repair actions includes restarting the device, adjusting bandwidth, and switching routes.

[0113] It should be noted that the set of repair actions covers core operational operations such as restarting devices, adjusting bandwidth, and switching routes, and the constructed action space is both targeted and comprehensive. This provides reinforcement learning agents with explicit and executable action options, avoids ineffective exploration, improves the efficiency and practicality of policy learning, and can adapt to various fault repair scenarios.

[0114] S503: The policy network is obtained by combining a dual critic network with a pruned Surrogate loss and the PPO-Dyna algorithm.

[0115] Among them, Surrogate loss refers to the loss value being limited by setting a threshold to balance the optimization objective and the stability of the strategy.

[0116] Among them, the PPO-Dyna algorithm is a reinforcement learning algorithm that combines the PPO (Proximal Policy Optimization) algorithm with the Dyna framework. Its core is to add environment model learning and virtual experience generation on the basis of PPO policy optimization, so as to balance policy stability and data utilization efficiency.

[0117] Specifically, a dual-commentator network is used to estimate action value and corrects for bias in the following ways: ; in, s The state of reinforcement learning is represented by fused features, root cause features, and a three-dimensional data cube. a Indicates a state repair action. Q min ( s,a ) represents the minimum action value estimate. This represents the action value estimate of the first commentator network. This represents the action value estimate of the second commentator network.

[0118] It should be noted that the dual-critic network can reduce value estimation bias and improve evaluation accuracy. Pruning the Surrogate loss constraint on policy update magnitude ensures training stability. Combining it with the PPO-Dyna algorithm allows for the supplementation of data through virtual experience, improving learning efficiency. The resulting policy network possesses both robustness and adaptability, generating accurate and reliable fault repair policies.

[0119] S504: Based on the experience tuples, efficient experience replay is obtained by sorting by TD-error and priority.

[0120] Among them, experience tuples refer to structured units used in reinforcement learning to store data of a single interaction between an agent and its environment. Their core function is to record key information during the interaction process and provide data support for subsequent policy training.

[0121] Among them, temporal difference error (TD-error) is a core indicator used in reinforcement learning to measure the deviation between the current state value estimate and the value estimate based on the next state. It is the key basis for updating the value function in the temporal difference (TD) method.

[0122] It should be noted that by quantifying the value estimation bias of experience tuples through TD-error, priority ranking can be achieved, allowing more high-error experiences (including key fault interaction information) to be replayed, avoiding redundant experiences that waste computing power. At the same time, it strengthens the targeted learning of effective / ineffective repair experiences, reduces invalid exploration, accelerates policy network convergence, and significantly improves the learning efficiency and accuracy of fault repair strategies.

[0123] S505: Determines remediation strategies by combining an environment simulator with Monte Carlo tree search, policy networks, and efficient experience replay.

[0124] Monte Carlo Tree Search (MCTS) is a decision-making algorithm based on random sampling and tree-like search structure. Its core is to find the optimal strategy in a complex decision space through an iterative exploration and evaluation process, without relying on a complete environmental model. It is especially suitable for scenarios with large state spaces and high uncertainty.

[0125] Furthermore, the process of generating a decision tree through Monte Carlo tree search specifically includes: Select nodes based on the upper confidence bound.

[0126] Add child nodes for the candidate actions to the leaf nodes.

[0127] Perform actions using a simulator and estimate the reward.

[0128] Update the number of visits and average value of nodes on the path.

[0129] Output the remediation strategy, which includes the optimal remediation sequence, contingency plan, and impact assessment matrix.

[0130] It should be noted that the environment simulator can safely simulate the repair effect and avoid real risks. The Monte Carlo tree search, combined with the learning results of the policy network and the high-quality data of efficient experience replay, can accurately generate a comprehensive repair strategy including the optimal sequence and emergency plan, which greatly improves decision-making efficiency and reliability and is suitable for complex fault scenarios.

[0131] In this embodiment of the invention, a comprehensive state space is first constructed using fused features, a three-dimensional data cube, and root cause features of the fault, coupled with a practical action space containing core operational actions. Then, a stable policy network is generated using a dual-critic network, a pruned Surrogate loss, and the PPO-Dyna algorithm, combined with efficient experience replay based on TD-error priority ranking to improve data utilization. Finally, a complete policy containing the optimal repair sequence, emergency plan, and impact assessment matrix is ​​generated through an environment simulator and Monte Carlo tree search, balancing safety, learning efficiency, and fault adaptability, thus efficiently solving complex fault repair decision-making problems.

[0132] S6: Verify the effectiveness of the repair strategy using a digital twin model. If effective, implement autonomous fault management according to the repair strategy. Otherwise, adjust the parameters of the multi-expert fusion model.

[0133] Digital twin models refer to the full-dimensional, dynamic digital mapping of physical entities (such as equipment, systems, and processes). Through real-time data interaction and simulation analysis, they enable the synchronous operation, status monitoring, scenario simulation, and optimization decision-making of the physical world and the digital space. The core is to build a closed-loop linkage between "physical entity and digital mirror".

[0134] In one possible implementation, S6 specifically includes sub-steps S601 to S607: S601: Based on the equipment's physical characteristics and business logic, and in accordance with the repair strategy, construct a digital twin model.

[0135] It should be noted that the high fidelity of the digital twin model is ensured by leveraging the physical characteristics of the equipment, combined with business logic to align with the actual system's operational patterns, and further integrated with repair strategies to focus the model on fault repair scenarios. This approach not only safely simulates the effects of repair actions and avoids the risks of physical operations, but also provides an accurate digital carrier for subsequent repair verification and optimization, improving the reliability of repair strategy implementation.

[0136] S602: Verify the spatiotemporal constraint consistency of the digital twin model using the Z3 solver.

[0137] Among them, Z3 Solver refers to the open-source automated theorem proving and symbolic solving tool developed by Microsoft. Its core is used to determine the satisfiability (SAT) of logical formulas or the constraint satisfaction problem (SMT). It can quickly solve complex mathematical and logical constraints and output specific instances that satisfy the conditions.

[0138] Specifically, the policy constraints are transformed into logical formulas: ; in, Constraint This represents the policy constraints. t 1 indicates the lower limit of the repair action execution time. t2 indicates the upper limit of the repair action execution time. p Represents a network node. CoreNodes Represents a set of nodes. Impact ( a i ,p ) indicates the first i Repair action a i For nodes p The extent of the impact i This indicates the threshold of influence.

[0139] It should be noted that the Z3 solver can efficiently handle complex constraints and comprehensively verify the consistency of the digital twin model's temporal (e.g., repair action sequence) and spatial (e.g., equipment parameter limitations) constraints. This avoids the inefficiency and errors of manual verification while ensuring logical consistency between the model and the physical system, mitigating conflict risks in subsequent repair simulations and practical operations, and significantly improving the reliability of the digital twin model.

[0140] S603: Simulates the evolution of performance metrics under network storm scenarios in a digital twin model using stochastic differential equations.

[0141] Specifically, the formula for the stochastic differential equation is as follows: ; in, X t express t The system state variables at time t. dX t express t System state variables at time 1 X t The instantaneous change m 0 indicates a constant drift coefficient. m 1 indicates the linear drift coefficient. dt Represents a deterministic time infinitesimal element. s 0 represents a constant diffusion coefficient. s 1 represents the linear diffusion coefficient. dW t This represents the infinitesimal element of a stochastic differential equation.

[0142] It should be noted that stochastic differential equations can accurately characterize the randomness and dynamic fluctuations of network storms, adapting to the uncertainties of various scenarios. Simulating these storms in a digital twin model can avoid interference with the real network, ensuring system security. Simultaneously, it can clearly present the real-time evolution of performance indicators, providing data support for risk prediction and optimized response strategies, and improving operational preparedness in extreme scenarios.

[0143] S604: Performs symbolic execution, traverses all possible paths, and performs derivative fault detection.

[0144] Symbolic execution refers to a program analysis and verification technique. Its core is to use symbolic values ​​(rather than specific numerical values) as program input, generate path constraint formulas by tracing the branch conditions in the program execution path, and then use constraint solvers (such as Z3 solvers) to determine whether these constraints can be satisfied, thereby systematically exploring all possible execution paths of the program and discovering potential problems.

[0145] It should be noted that symbolic execution, by traversing all possible paths, overcomes the limitations of traditional detection methods that rely on specific cases, and can comprehensively capture derivative faults that may be caused during the execution of remediation strategies. This avoids potential risks due to missed paths, identifies hidden problems in advance, and provides accurate data for optimizing remediation strategies and improving system stability.

[0146] S605: Compare the predicted values ​​of the digital twin model with the actual observed values ​​and calculate the error.

[0147] Specifically, the error formula is as follows: ; in, e Indicates the prediction error. y Represents the actual observed value. This represents the model's predicted value. W k Indicates the first k One weight parameter, or This represents the learning rate.

[0148] It should be noted that by comparing the predicted values ​​with the actual observed values ​​to calculate the error, the fidelity of the digital twin model can be directly quantified, determining whether it accurately reflects the true state of the physical system. Error data can pinpoint the source of model bias, providing a clear direction for iterative model optimization. It can also verify the reliability of model predictions in advance, avoiding subsequent repair simulations or decision-making biases due to model distortion, and ensuring the accuracy of operational actions.

[0149] S606: Based on the error, verify whether the repair strategy is effective. If so, perform fault autonomy according to the repair strategy. Otherwise, update the parameters of the multi-expert fusion model through gradient descent.

[0150] It should be noted that the error is used as an objective basis to verify the repair strategy, avoiding subjective judgment bias. When effective, direct fault self-management can quickly resolve issues and improve operational efficiency. When ineffective, updating the multi-expert fusion model through gradient descent can continuously optimize model accuracy and reduce subsequent misjudgments. This forms a closed loop of "verification-execution-iteration," ensuring the reliability of current repairs while improving the system's fault handling capabilities in the long term.

[0151] S607: Store the validated strategies, root cause features, and impact assessment results into the knowledge graph, and update the entity relationship weights through a graph neural network.

[0152] Among them, Graph Neural Network (GNN) refers to a deep learning model that is specifically designed to process graph structure data. Its core is to learn the feature representation of nodes and edges through a "message passing mechanism". It can effectively capture the dependencies between entities (nodes) and relationships (edges) in the graph and is suitable for irregular and densely relational data scenarios.

[0153] It should be noted that all content stored in the knowledge graph has been verified, ensuring the reliability of experiential knowledge. The knowledge graph can systematically accumulate fault handling-related information, facilitating rapid reuse later. Graph neural networks update entity relationship weights, making entity associations more closely aligned with real-world scenarios and improving the decision support accuracy of the knowledge graph. Overall, this forms an experiential closed loop, contributing to more efficient and accurate subsequent fault handling.

[0154] In this embodiment of the invention, a high-fidelity digital twin model is constructed based on device characteristics and business logic. Spatiotemporal constraint verification, extreme scenario simulation, and derivative fault detection are achieved through Z3 solvers, stochastic differential equations, and symbolic execution, ensuring the reliability of the model and strategy from multiple dimensions. Error calculation is then used to objectively determine the effectiveness of the strategy; if effective, fault self-management improves efficiency; if ineffective, gradient descent optimizes the model, forming a closed-loop iteration. Finally, the verification content is stored in a knowledge graph, and relation weights are updated using a graph neural network, accumulating experience to aid subsequent decision-making, thus balancing security, accuracy, and long-term optimization capabilities.

[0155] The beneficial effects of the technical solutions provided in the embodiments of the present invention include at least the following: In this embodiment of the invention, the limitations of manual processing are avoided by using a multi-expert fusion model and a four-level progressive closed-loop link, significantly improving the adaptability and processing capabilities for large amounts of operation and maintenance data. At the same time, by combining reinforcement learning and digital twin technology, the optimal repair strategy is automatically and efficiently generated, significantly reducing the excessive complexity of user operations. In addition, through anomaly detection and digital twin technology, abnormal access and risky behavior in data flow can be monitored in real time, reducing the risk of data leakage and tampering during information processing, and providing users with a secure operation and maintenance solution.

[0156] The fault autonomy method based on cross-modal decision-making provided in this application can be executed by a fault autonomy device based on cross-modal decision-making. This application uses the execution of the fault autonomy method based on cross-modal decision-making by a fault autonomy device as an example to illustrate the fault autonomy device based on cross-modal decision-making provided in this application.

[0157] Reference manual attached Figure 2The diagram shows a structural schematic of a fault autonomous system based on cross-modal decision-making provided by an embodiment of the present invention.

[0158] This invention provides a fault autonomous system 20 based on cross-modal decision-making, comprising: a processor 201 and a memory 202; The memory 202 stores programs or instructions that can run on the processor 201. When the program or instructions are executed by the processor 201, they implement the steps of the above-described fault autonomy method based on cross-modal decision-making and achieve the same technical effect. To avoid repetition, the present invention will not elaborate further.

[0159] It should be understood that the processor 201 in this embodiment of the invention may be a central processing unit (CPU), or it may be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor.

[0160] It should also be understood that the memory 202 in the embodiments of the present invention can be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of random access memory are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct memory bus RAM (DR RAM).

[0161] The above embodiments can be implemented, in whole or in part, by software, hardware (such as circuits), firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, all or part of the processes or functions described in the embodiments of the present invention are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more sets of available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium. A semiconductor medium can be a solid-state drive.

[0162] It should be understood that, in various embodiments of the present invention, the sequence number of each process does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0163] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0164] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the devices, apparatuses, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0165] In the several embodiments provided by this invention, it should be understood that the disclosed devices, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another device, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0166] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0167] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0168] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, essentially, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0169] This invention provides a readable storage medium comprising: storing a program or instructions on the readable storage medium, wherein when the program or instructions are executed by a processor, the program or instructions implement the steps of the above-described fault autonomy method based on cross-modal decision-making, and can achieve the same technical effect. To avoid repetition, this invention will not elaborate further.

[0170] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the embodiments of the present invention, and are not intended to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the protection scope of the present invention.

Claims

1. A fault autonomy method based on cross-modal decision-making, characterized in that, include: S1: Acquire multimodal data; S2: Based on the multimodal data, a three-dimensional data cube is obtained through a spatiotemporal alignment algorithm; S3: Using a multi-expert fusion model, feature extraction and feature fusion are performed on the three-dimensional data cube to obtain fused features; S4: Based on the fusion features, determine the root cause features of the fault using the LSTM module; S5: Based on the three-dimensional data cube and the root cause features of the fault, a repair strategy is generated through reinforcement learning; S6: Verify the effectiveness of the repair strategy using a digital twin model; if so, perform fault self-management according to the repair strategy. Otherwise, adjust the parameters of the multi-expert fusion model; The multi-expert fusion model specifically includes: a log semantic parsing module, a performance time-series analysis module, a topological relationship reasoning module, and a feature fusion module. S3 specifically includes: S301: In the log semantic parsing module, word vectors are generated based on the log key fields using a pre-trained word embedding model; S302: The word vectors with a preset ratio of random masking are used to predict the word vectors at the masking positions through a bidirectional Transformer decoder; S303: Determine the log semantic features based on the word vector prediction results; S304: In the performance time series analysis module, the time series sequence of performance indicators is extracted through the three-dimensional data cube; S305: Based on the time series of the performance indicators, extract the performance indicator features through a causal CNN layer; S306: In the topology reasoning module, based on the dynamic adjacency matrix and the node features, node embeddings are generated through the GCN layer; S307: Calculate the mean of the node embeddings to obtain the topological relationship features; S308: In the feature fusion module, expert weights are calculated through a gating network; S309: Combining the expert weights, the log semantic feature vector, the performance index feature vector, and the topological relationship feature vector, the fused feature is obtained.

2. The fault autonomy method based on cross-modal decision-making according to claim 1, characterized in that, The multimodal data specifically includes: log stream data, performance indicator data, and device data; S2 specifically includes: S201: Preprocess the log stream data using regular expressions to extract key log fields; S202: Convert the key log fields into log field embedding vectors; S203: Based on the log field embedding vector, determine the log anomaly probability and anomaly labeling result using a BiLSTM-based classification model; S204: Detect the feature shift of the performance index data through an adaptive sliding window mechanism to obtain the feature shift detection result; S205: Based on the device data, construct a network device topology graph, using network devices as graph nodes and the physical connection relationships between network devices as edges; S206: Update the edge weights in the network device topology graph based on real-time connection relationships and time decay factors; S207: Based on the edge weights and the characteristics of the nodes, construct a dynamic adjacency matrix using a graph attention network; S208: Combine the characteristics of the nodes and the dynamic adjacency matrix to obtain topological relationship data; S209: Based on the log stream data, the performance index data, and the topology data, construct the three-dimensional data cube using the spatiotemporal alignment algorithm.

3. The fault autonomy method based on cross-modal decision-making according to claim 2, characterized in that, S204 specifically includes: S2041: Calculate the JS divergence between the window feature distribution and the historical normal distribution using the adaptive sliding window mechanism; S2042: When the JS divergence is greater than a preset value, it is determined that the performance index data has drifted, and the feature drift detection result is obtained.

4. The fault autonomy method based on cross-modal decision-making according to claim 2, characterized in that, S209 specifically includes: S2091: Using the timestamp of the log stream data as a reference, synchronize the performance index data and the topology data in time and calculate the time offset; S2092: Map the device topology space to a three-dimensional coordinate system, wherein the three-dimensional coordinate system... x The axis indicates the frame number. y The axis indicates the rack number. z Axis indicates equipment level; S2093: Calculate the relative coordinates of non-physical devices using the dynamic adjacency matrix; S2094: Construct the three-dimensional data cube based on the three-dimensional coordinates of the device topology space in the three-dimensional coordinate system.

5. The fault autonomy method based on cross-modal decision-making according to claim 1, characterized in that, Specifically, S305 includes: S3051: Extract local temporal features from the time-series sequence of the performance indicators through a causal CNN layer; S3052: The global temporal dependency is calculated on the local temporal features through a multi-head self-attention layer to obtain the performance index features.

6. The fault autonomy method based on cross-modal decision-making according to claim 1, characterized in that, S4 specifically includes: S401: Based on the fusion features, output the fault probability through the LSTM module; S402: Determine the warning level based on the aforementioned failure probability; S403: When the warning level is a preset level, the root cause characteristics of the fault are output through root cause localization guided by the fault knowledge graph.

7. The fault autonomy method based on cross-modal decision-making according to claim 1, characterized in that, S5 specifically includes: S501: Construct a state space for reinforcement learning based on the fusion features, the three-dimensional data cube, and the root cause features of the fault; S502: Construct a reinforcement learning action space based on the set of repair actions, wherein the set of repair actions includes restarting the device, adjusting bandwidth, and switching routes; S503: The policy network is obtained by combining a dual critic network with a pruning Surrogate loss and the PPO-Dyna algorithm; S504: Based on the experience tuples, sort them by TD-error and priority to obtain efficient experience replay; S505: Determine the repair strategy by using an environment simulator and Monte Carlo tree search, combined with the policy network and the efficient experience replay; The process of generating a decision tree using Monte Carlo tree search specifically includes: Select nodes based on the upper confidence bound; Add child nodes for the candidate actions to the leaf nodes; Perform actions using a simulator and estimate the reward; Update the number of visits and average value of nodes on the path; The remediation strategy is output, which includes the optimal remediation sequence, contingency plan, and impact assessment matrix.

8. The fault autonomy method based on cross-modal decision-making according to claim 1, characterized in that, S6 specifically includes: S601: Based on the equipment's physical characteristics and business logic, construct the digital twin model according to the repair strategy; S602: Verify the spatiotemporal constraint consistency of the digital twin model using the Z3 solver; S603: Simulate the evolution of performance indicators under network storm scenarios in the digital twin model using stochastic differential equations; S604: Performs symbolic execution, traverses all possible paths, and performs derivative fault detection; S605: Compare the predicted values ​​of the digital twin model with the actual observed values, and calculate the error; S606: Based on the error, verify whether the repair strategy is effective; if so, perform fault autonomy according to the repair strategy; otherwise, update the parameters of the multi-expert fusion model through gradient descent. S607: Store the validated strategies, root cause features, and impact assessment results into the knowledge graph, and update the entity relationship weights through a graph neural network.

9. A fault autonomous system based on cross-modal decision-making, characterized in that, include: Processor and memory; The memory stores programs or instructions that can run on the processor, which, when executed by the processor, implement the steps of the fault autonomy method based on cross-modal decision-making as described in any one of claims 1 to 8.

Images