An alarm processing method, device, equipment, storage medium and product

Abstract

The application discloses an alarm processing method, device, equipment, storage medium and product. The method comprises the following steps: obtaining alarm information to be processed; obtaining a plurality of first historical alarm information similar to the alarm information to be processed; generating a first prompt word according to a processing scheme of each first historical alarm information and the alarm information to be processed; obtaining a processing scheme of the alarm information to be processed according to the first prompt word by using a preset alarm processing model; and the alarm processing model is obtained by fine-tuning based on a large language model. The embodiment of the application can improve the alarm processing efficiency and accuracy, and is suitable for various complex scenes.

Description

Technical Field

[0001] This application relates to the field of alarm processing technology, and in particular to an alarm processing method, apparatus, device, storage medium and product. Background Technology

[0002] Network alarms are alerts triggered by network monitoring systems when they detect abnormalities in network devices, services, or performance indicators. These alarms are crucial for operations and maintenance (O&M) personnel to identify and resolve network problems. Manually analyzing each alarm to resolve issues places high demands on the technical skills of O&M personnel and is insufficient to meet the real-time and accuracy requirements of network O&M. To address the inefficiency of manual alarm analysis and processing, traditional alarm handling methods primarily include rule-based alarm processing and correlation-based alarm processing based on statistical analysis.

[0003] Rule-based alarm handling methods predefine rule bases for various alarm handling types. By matching alarm names with corresponding alarm causes and handling solutions, this method improves the automation of alarm handling. However, relying solely on rule matching does not fully utilize alarm information, and the rule base needs to be manually and continuously optimized and improved to cope with complex and ever-changing network environments, making it difficult to achieve efficient and accurate alarm handling.

[0004] The statistical analysis-based correlation alarm handling method mines frequent itemsets and association rules in alarm data to analyze the potential correlations between various alarms, thereby uncovering and addressing the root causes of alarms. This method can improve the efficiency of operation and maintenance personnel in handling alarms to a certain extent. However, its drawbacks are that it can only mine a small number of alarms with strong correlations, the alarm categories are not diverse, the accuracy decreases when dealing with complex or changing network environments, and the rules need to be updated regularly. Summary of the Invention

[0005] This application provides an alarm processing method, apparatus, device, storage medium, and product to solve the problems of low efficiency and low accuracy in alarm processing in the prior art, which cannot cope with complex scenarios.

[0006] To achieve the above objectives, embodiments of this application provide an alarm processing method, including:

[0007] Obtain pending alarm information;

[0008] Acquire several first historical alarm messages that are similar to the alarm message to be processed;

[0009] Based on the processing scheme for each of the first historical alarm messages and the alarm messages to be processed, a first prompt word is generated;

[0010] Using a preset alarm processing model, a processing scheme for the alarm information to be processed is obtained based on the first prompt word; wherein, the alarm processing model is obtained by fine-tuning a large language model.

[0011] As an improvement to the above solution, the step of obtaining several first historical alarm information similar to the alarm information to be processed includes:

[0012] Acquire several alarm events; the alarm events include at least second historical alarm information;

[0013] Based on the aforementioned alarm events, construct an alarm event library;

[0014] Based on the alarm event database, several pieces of the first historical alarm information are obtained according to the semantic similarity between the alarm information to be processed and the second historical alarm information.

[0015] As an improvement to the above solution, based on the alarm event database, several pieces of the first historical alarm information are obtained according to the semantic similarity between the alarm information to be processed and the second historical alarm information, including:

[0016] The alarm information to be processed is vectorized to obtain a first vector;

[0017] The semantic similarity is obtained based on at least one of the first cosine similarity and the second cosine similarity; the first cosine similarity is determined by the cosine similarity between the first vector and the second vector of the second historical alarm information, and the second cosine similarity is determined by each cosine similarity between the third vector of each keyword of the alarm information to be processed and each of the second vectors.

[0018] Obtain the second historical alarm information with the highest semantic similarity, and use it as several first historical alarm information.

[0019] As an improvement to the above scheme, obtaining the semantic similarity based on at least one of the first cosine similarity and the second cosine similarity includes:

[0020] Calculate the cosine similarity between the first vector and the second vector to obtain the first cosine similarity;

[0021] Each keyword of the alarm information to be processed is vectorized to obtain each third vector, and a corresponding weight is assigned to each third vector according to a preset importance level.

[0022] The second cosine similarity is obtained by weighted summation based on each cosine similarity between each of the third vectors and the second vector, and the weights thereof.

[0023] The semantic similarity is obtained based on the first cosine similarity and the second cosine similarity.

[0024] As an improvement to the above scheme, the processing scheme for the first historical alarm information includes at least one of a first historical processing scheme and a first candidate processing scheme;

[0025] The first candidate processing scheme is obtained through the following steps:

[0026] Based on the preset thought chain example and the first historical alarm information, generate a second prompt word;

[0027] Using the alarm processing model, the first candidate processing scheme is obtained based on the second prompt word.

[0028] As an improvement to the above solution, the alarm processing model is obtained through the following steps;

[0029] Obtain the fine-tuning dataset; the dataset includes several third-historical alarm information and corresponding third-historical processing schemes;

[0030] The self-attention layer in the Transformer layer of the large language model is taken as the target layer.

[0031] The query matrix of the target layer is decomposed into a query low-yield matrix, and the value matrix of the fine-tuning target layer is decomposed into a value low-yield matrix;

[0032] The fine-tuning dataset is input into the large language model, and the fine-tuning target layer is adjusted during the forward propagation process using the query low-yield matrix and the value low-yield matrix to obtain the alarm processing model; the query low-yield matrix includes: a first low-yield matrix, a second low-yield matrix, a third low-yield matrix, and a fourth low-yield matrix, and the value low-yield matrix includes: a fifth low-yield matrix, a sixth low-yield matrix, a seventh low-yield matrix, and an eighth low-yield matrix.

[0033] To achieve the above objectives, embodiments of this application also provide an alarm processing device, including:

[0034] The first acquisition module is used to acquire alarm information to be processed.

[0035] The second acquisition module is used to acquire several first historical alarm messages that are similar to the alarm message to be processed;

[0036] The generation module is used to generate a first prompt word based on the processing scheme of each of the first historical alarm information and the alarm information to be processed;

[0037] The alarm processing module is used to obtain a processing scheme for the alarm information to be processed based on the first prompt word using a preset alarm processing model; wherein, the alarm processing model is obtained by fine-tuning a large language model.

[0038] To achieve the above objectives, this application also provides an alarm processing device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, it implements the alarm processing method as described above.

[0039] To achieve the above objectives, embodiments of this application also provide a computer-readable storage medium, the computer-readable storage medium including a stored computer program; wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform the alarm processing method as described above.

[0040] To achieve the above objectives, embodiments of this application also provide a computer program product, including a computer program / instruction, which, when executed by a processor, implements the alarm processing method as described above.

[0041] Compared with existing technologies, the alarm processing method, apparatus, device, storage medium, and product provided in this application embodiment acquire alarm information to be processed; acquire a plurality of first historical alarm information similar to the alarm information to be processed; generate a first prompt word according to the processing scheme of each first historical alarm information and the alarm information to be processed; and obtain the processing scheme of the alarm information to be processed based on the first prompt word using a preset alarm processing model; wherein the alarm processing model is obtained by fine-tuning a large language model. Therefore, the alarm processing model obtained by fine-tuning the large language model in this application embodiment can reduce reliance on operation and maintenance personnel, help them analyze network problems more systematically and comprehensively, improve alarm processing efficiency and accuracy, and is applicable to various complex scenarios. Moreover, generating the first prompt word using the processing scheme of the first historical alarm information can solve the illusion problem that may occur when the processing scheme directly output by the alarm processing model. Attached Figure Description

[0042] Figure 1 This is a flowchart of an alarm processing method provided in an embodiment of this application;

[0043] Figure 2 This is a flowchart of a thought chain construction method provided in an embodiment of this application;

[0044] Figure 3 This is a flowchart of a mind chain application provided in an embodiment of this application;

[0045] Figure 4 This is a flowchart illustrating the construction of an alarm event library according to an embodiment of this application;

[0046] Figure 5 This is a flowchart illustrating an alarm information extraction method provided in an embodiment of this application;

[0047] Figure 6 This is a structural block diagram of an alarm processing device provided in an embodiment of this application;

[0048] Figure 7 This is a structural block diagram of an alarm processing device provided in an embodiment of this application. Detailed Implementation

[0049] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of the embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0050] See Figure 1 , Figure 1 This is a flowchart of an alarm processing method provided in an embodiment of this application. The alarm processing method includes:

[0051] S1. Obtain alarm information to be processed;

[0052] S2. Obtain several first historical alarm messages that are similar to the alarm message to be processed;

[0053] S3. Generate a first prompt word based on the processing scheme for each of the first historical alarm information and the alarm information to be processed;

[0054] S4. Using a preset alarm processing model, a processing scheme for the alarm information to be processed is obtained based on the first prompt word; wherein, the alarm processing model is obtained by fine-tuning a large language model.

[0055] It is worth noting that the alarm processing model, after fine-tuning, has achieved the learning and internalization of a large amount of knowledge. However, in real-world scenarios, if only a single alarm message to be processed is input, the alarm processing model may not be able to directly generate the actual required processing solution due to the lack of a clear requirement description and task guidance. Therefore, multiple interactions are needed to guide the model to understand its requirements, which affects alarm processing efficiency. Therefore, to enable the alarm processing model to think autonomously and deduce the final answer step by step, thereby efficiently outputting a more expected response, this embodiment of the application uses the processing solution of the first historical alarm information to generate a first prompt word. This provides sufficient guidance information for the alarm processing model to generate a processing solution, solving the illusion problem that may occur when the alarm processing model directly outputs a processing solution, and outputting a more expected response.

[0056] The alarm processing model obtained by fine-tuning the large language model in this application can reduce the reliance on operation and maintenance personnel, help them analyze network problems more systematically and comprehensively, improve alarm processing efficiency and accuracy, and is applicable to various complex scenarios.

[0057] It is worth noting that the embodiments of this application are not limited to the field of network operation and maintenance, but can also be applied to other scenarios that require real-time anomaly monitoring or rapid response. They can automatically analyze and generate processing solutions suitable for the specific scenario, such as in the medical and transportation fields. Correspondingly, the alarm information to be processed is not only network alarm information, but can also be other types of alarm information, such as medical alarm information, which will not be listed here. For ease of description, the term "alarm information to be processed" will be used consistently.

[0058] Optionally, the alarm information to be processed includes at least one of the following: alarm target name, main alarm name, other alarm names, and alarm time. The alarm target name may be the base station name.

[0059] The first historical alarm information includes at least one of the following: alarm target name, main alarm name, other alarm names, and alarm time.

[0060] The processing scheme for the alarm information to be processed includes countermeasures to resolve the alarm; furthermore, it may also include the cause of the alarm.

[0061] In one optional embodiment, acquiring a plurality of first historical alarm information similar to the alarm information to be processed includes:

[0062] Acquire several alarm events; the alarm events include at least second historical alarm information;

[0063] Based on the aforementioned alarm events, construct an alarm event library;

[0064] Based on the alarm event database, several pieces of the first historical alarm information are obtained according to the semantic similarity between the alarm information to be processed and the second historical alarm information.

[0065] In this embodiment, by using the semantic similarity between the alarm information to be processed and the second historical alarm information, several first historical alarm information that are semantically similar to the alarm information to be processed are obtained, and then the processing scheme of the first historical alarm information is used to generate a first prompt word, which can solve the illusion problem that may occur when the processing scheme directly output by the alarm processing model.

[0066] Optionally, the second historical alarm information includes at least one of the following: alarm target name, main alarm name, other alarm names, and alarm time; the alarm event database includes at least one of the second historical alarm information and a second vector of the second historical alarm information. Specifically, vectorizing the second historical alarm information to obtain the second vector facilitates subsequent semantic similarity calculations and improves computational efficiency. Correspondingly, the alarm event database includes: several pieces of second historical alarm information and / or several second vectors. Optionally, an embedding model is used for vectorization.

[0067] To facilitate the association of processing solutions in the alarm event database and enable rapid retrieval of corresponding processing solutions, such as processing solutions for first historical alarm information, thereby improving retrieval and alarm processing efficiency, the alarm event also includes processing solutions for second historical alarm information. This processing solution includes at least one of a second historical processing solution and a second candidate processing solution; the second historical processing solution refers to a processing solution that actually existed in the past. To enrich the alarm events, a thought chain technique is used to populate the database, resulting in second candidate processing solutions for the second historical alarm information. The specific population method is similar to the method for obtaining the first candidate processing solution for the first historical alarm information described below, and will not be elaborated further here.

[0068] Correspondingly, the alarm event database also includes several processing schemes. That is, the alarm event database presents the following: the second historical alarm information and its processing scheme; or, the second vector and its processing scheme; or, the second historical alarm information, the second vector, and the processing scheme.

[0069] By pre-associating corresponding processing solutions in the alarm event database, it facilitates the acquisition of processing solutions for the first historical alarm information, enabling quick retrieval of processing solutions from the alarm event database and improving retrieval and alarm processing efficiency.

[0070] Optionally, the step of constructing an alarm event library based on a plurality of the alarm events includes:

[0071] Each of the second historical alarm messages is vectorized to obtain a second vector;

[0072] The second vector is associated with the processing scheme of the second historical alarm information to form the alarm event library.

[0073] In an optional embodiment, the step of obtaining several pieces of the first historical alarm information based on the alarm event database and according to the semantic similarity between the alarm information to be processed and the second historical alarm information includes:

[0074] The alarm information to be processed is vectorized to obtain a first vector;

[0075] The semantic similarity is obtained based on at least one of the first cosine similarity and the second cosine similarity; the first cosine similarity is determined by the cosine similarity between the first vector and the second vector of the second historical alarm information, and the second cosine similarity is determined by each cosine similarity between the third vector of each keyword of the alarm information to be processed and each of the second vectors.

[0076] Obtain the second historical alarm information with the highest semantic similarity, and use it as several first historical alarm information.

[0077] In this embodiment of the application, the semantic similarity between the alarm information to be processed and the second historical alarm information is calculated by using at least one of two types of cosine similarity, and then the k second historical alarm information with the largest semantic similarity are obtained. These k second historical alarm information are several first historical alarm information. This method is intuitive and easy to implement.

[0078] One type of cosine similarity (i.e., the first cosine similarity) is to directly calculate the cosine similarity between the first vector of the alarm information to be processed and the second vector of the second historical alarm information. Through vector calculation, the semantic similarity between sentences is directly represented, that is, the semantic similarity between the alarm information to be processed and the second historical alarm information.

[0079] Another type of cosine similarity (i.e., second cosine similarity) is determined by the cosine similarity between the third vector of each keyword in the alarm information to be processed and the second vector of the second historical alarm information. This method compares the keywords of the alarm information to be processed with the second vector respectively, indirectly representing the semantic similarity between sentences, that is, the semantic similarity between the alarm information to be processed and the second historical alarm information.

[0080] The embodiments of this application can directly use the first cosine similarity as the semantic similarity between the alarm information to be processed and the second historical alarm information, or directly use the second cosine similarity as the semantic similarity between the alarm information to be processed and the second historical alarm information, or combine these two types of cosine similarity as the semantic similarity between the alarm information to be processed and the second historical alarm information. This can improve the accuracy of semantic similarity calculation between the alarm information to be processed and the second historical alarm information, and further improve the output accuracy of the alarm processing model.

[0081] In an optional embodiment, obtaining the semantic similarity based on at least one of a first cosine similarity and a second cosine similarity includes:

[0082] Calculate the cosine similarity between the first vector and the second vector to obtain the first cosine similarity;

[0083] Each keyword of the alarm information to be processed is vectorized to obtain each third vector, and a corresponding weight is assigned to each third vector according to a preset importance level.

[0084] The second cosine similarity is obtained by weighted summation based on each cosine similarity between each of the third vectors and the second vector, and the weights thereof.

[0085] The semantic similarity is obtained based on the first cosine similarity and the second cosine similarity.

[0086] In this embodiment of the application, in order to further improve the output accuracy of the alarm processing model, when calculating semantic similarity, different weights are assigned to the third vector of each keyword of the alarm information to be processed according to the preset importance, so that more important keywords occupy more important positions and ensure that the retrieved first historical alarm information is more in line with the requirements.

[0087] For example, the importance of keywords appearing earlier in the alarm information to be processed is considered, and a corresponding weight is assigned to the third vector of each keyword in the alarm information to be processed. Specifically, the keywords in the alarm information to be processed are sorted from left to right according to their importance. For example, the keywords in the alarm information to be processed are concatenated into a text sentence in the order of "base station name, main alarm name, alarm time, other alarm names" as input; each keyword is vectorized to obtain each third vector; according to... Weights are assigned to each of the third vectors sequentially from left to right; the second cosine similarity is calculated as follows: Semantic similarity is calculated using the following formula:

[0088]

[0089] In the formula, α represents the first preset weight, and β represents the second preset weight. w represents the weight assigned to the i-th keyword in the pending alarm information, n represents the number of keywords in the pending alarm information, and w i S represents the third vector of the i-th keyword in the alarm information to be processed, s1 represents the first vector, s2 represents the second vector, and S... n This represents the total number of keywords in the pending alarm messages. cos(s1,s2) represents the cosine similarity between the first vector and the second vector, and cos(w i (s2) represents the cosine similarity between the third vector and the second vector of the i-th keyword in the alarm information to be processed. Here, the set of third vectors of the keywords in the alarm information to be processed is denoted as K. s1 ={w1,w2,...,w n ,}, the adjustment range of α is set to 0.5~1, α+β=1.

[0090]

[0091] In the formula, s1 j Let s1 represent the j-th word, and s2 represent the word in the first vector s1. j Let represent the j-th word of the second vector s2, and m represent the number of words in either the first vector s1 or the second vector s2.

[0092]

[0093] In the formula, s2 j Let represent the j-th word of the second vector s2.

[0094] In one optional embodiment, the processing scheme for the first historical alarm information includes at least one of a first historical processing scheme and a first candidate processing scheme;

[0095] The first candidate processing scheme is obtained through the following steps:

[0096] Based on the preset thought chain example and the first historical alarm information, generate a second prompt word;

[0097] Using the alarm processing model, the first candidate processing scheme is obtained based on the second prompt word.

[0098] It is understandable that the first historical solution refers to the solution that actually existed in history.

[0099] It's worth noting that the thought chain technology is a type of advanced prompting engineering, a method of generating answers to questions through step-by-step thinking and reasoning. The model's thought chain is triggered by prompt words. When invoking the alarm handling model, it is combined with the user's question as input. This allows the alarm handling model to think in a structured Prompt manner and invoke tools to execute tasks. Through a small amount of learning and practice, it generates answers that are more suitable for network operation and maintenance scenarios. This application proposes a thought chain construction method for network operation and maintenance scenarios, guiding the alarm handling model to automatically retrieve other alarms closest to the time of the fault occurrence and perform thought chain reasoning, thereby improving the performance and accuracy of the alarm handling model in the task of generating handling solutions.

[0100] The thought process chain generated by the solution is as follows Figure 2 The system is driven by five steps. After inputting the base station name and the main alarm name, the system first performs a data query: it calls the encapsulated alarm query interface to search for other alarm names within a preset time period (e.g., 15 minutes) before and after the current time of the base station; secondly, it combines the main alarm name and other alarm names to analyze the cause of the alarm and the handling strategy for resolving the alarm; finally, it generates the final handling solution and outputs it.

[0101] This application provides 10 sets of alarm information and processing solutions through expert experience annotation, forming a preset thought chain example for few-shot in-context learning. Table 1 provides a complete set of prompt word examples:

[0102] Table 1

[0103]

[0104]

[0105] Using a pre-defined thought chain example, the alarm handling model can automatically generate a handling solution, as follows: Figure 3 As shown, the second prompt word (Prompt) formed by the preset thought chain example (Q1 A1-Q10 A10) and the alarm information to be processed (Q) is input into the alarm processing model. The alarm processing model deduces the processing solution (Reply) of the alarm information to be processed according to the five steps of the preset thought chain example.

[0106] For example, in conjunction with the aforementioned alarm event database, to improve retrieval and alarm processing efficiency, an alarm event database can be pre-built. This database includes processing solutions for second historical alarm information. Then, after retrieving similar first historical alarm information, the processing solution for the first historical alarm information is retrieved from the alarm event database. The construction process of the alarm event database is as follows: Figure 4First, several alarm events are acquired. For the second historical alarm information of each alarm event, prompt words are formed one by one using preset thought chain examples to obtain the second candidate processing scheme of the second historical alarm information. Then, the second vector of the second historical alarm information and the second candidate processing scheme are associated; and / or, the second vector of the second historical alarm information and the second historical processing scheme of the second historical alarm information are directly associated.

[0107] In one optional embodiment, the alarm processing model is obtained through the following steps;

[0108] Obtain the fine-tuning dataset; the dataset includes several third-historical alarm information and corresponding third-historical processing schemes;

[0109] The self-attention layer in the Transformer layer of the large language model is taken as the target layer.

[0110] The query matrix of the target layer is decomposed into a query low-yield matrix, and the value matrix of the fine-tuning target layer is decomposed into a value low-yield matrix;

[0111] The fine-tuning dataset is input into the large language model, and the fine-tuning target layer is adjusted during the forward propagation process using the query low-yield matrix and the value low-yield matrix to obtain the alarm processing model; the query low-yield matrix includes: a first low-yield matrix, a second low-yield matrix, a third low-yield matrix, and a fourth low-yield matrix, and the value low-yield matrix includes: a fifth low-yield matrix, a sixth low-yield matrix, a seventh low-yield matrix, and an eighth low-yield matrix.

[0112] It is worth noting that large model fine-tuning is an important technique for achieving fine-tuning of models on specific tasks. By fine-tuning large language models on specific datasets, a large amount of general knowledge learned during pre-training can be transferred to specific tasks, effectively reducing the computational resources required to train large language models from scratch and saving a lot of expenses.

[0113] LoRA fine-tuning is a reparameterized fine-tuning method that first introduces new parameters into the large language model for fine-tuning, and then integrates these new parameters back into the original model. The advantage of this method is that the parameter fusion process does not generate additional parameters, thus avoiding additional inference overhead and ensuring that the large language model can flexibly adapt to new tasks. Traditional LoRA models update parameters by superimposing the weight matrix of the large language model. Let the original weight matrix in the large language model be W0, where W0∈R. d×k The cumulative gradient update during the adaptation process is ΔW, which is a low-rank matrix with rank r. The traditional LoRA fine-tuning method decomposes ΔW into two matrices B and A, and limits its update range by training only matrices A and B. The formula is as follows:

[0114] W0+ΔW=W0+BA

[0115] For input x, the training process can be represented as:

[0116] h=W0 x+ΔW x=W0 x+BA x+b0

[0117] Traditional LoRA fine-tuning methods can learn changes in the weight space, but they cannot effectively learn the scaling and shifting of feature changes. When performing transfer learning from large models, both the feature space and weight space need flexibility. Therefore, this application proposes an improved LoRA fine-tuning method for large model fine-tuning in network operation and maintenance scenarios. Based on the traditional LoRA fine-tuning method, two increment matrices are added: one for scaling the weights and the other for shifting the weights. This enables large language models to learn changes in the feature space of downstream tasks and effectively learn the scaling and shifting of text feature changes.

[0118] The self-attention layer is a core component of large language models, responsible for weighting the importance of different keywords in the input alert information. By adjusting these weights, the model can better capture task-related information. In this embodiment, the weight increment matrix is ​​injected into the self-attention layer, decomposed into trainable low-yield matrices, and then superimposed on the original weights to obtain the updated weights. Furthermore, the self-attention layer includes three learnable parameter matrices: a query matrix W... q Key matrix W k And the Value matrix; to balance performance and effectiveness, this embodiment selects W. q and W v The weights are updated by adding a scale matrix θ and a shift matrix T to expand the keyword feature space. Specifically:

[0119] The self-attention layer in the Transformer layer of the large language model is used as the target layer; the query matrix W of the target layer is... q Decompose the query low-yield matrix (the query low-yield matrix includes: the first low-yield matrix, the second low-yield matrix, the third low-yield matrix, and the fourth low-yield matrix), and fine-tune the value matrix W of the target layer. v The model is decomposed into low-yield value matrices (the low-yield value matrices include: the fifth low-yield matrix, the sixth low-yield matrix, the seventh low-yield matrix, and the eighth low-yield matrix); the fine-tuning dataset is input into the large language model, and the fine-tuning target layer is adjusted during the forward propagation process by querying the low-yield matrix and the low-yield value matrices to obtain the alarm processing model.

[0120] For query matrix W q, the forward propagation is represented by the following formula, and the forward propagation process is updated as:

[0121] h q =(W 0q +W 0q θ q +T q )x + b 0q

[0122] where, W 0q represents the original weight matrix of query matrix W q , W 0q ∈R d×k ; θ q represents the first scaling matrix, θ q ∈R k ×k , used to scale the weights; T q represents the first shift matrix, T q ∈R d×k , used to shift the weights; b 0q represents the first bias matrix, which can make the model easier to learn the complex features of the input data, better adapt to the fine-tuning dataset, and accelerate the convergence speed; θ q is decomposed into the first low-rank matrix A q , the second low-rank matrix B q , T q is decomposed into the third low-rank matrix C q , the fourth low-rank matrix D q , and the above formula becomes:

[0123] h q =(W 0q +W 0q B q A q +D q C q )x + b 0q

[0124] where, B q ∈R k×r , A q ∈R r×k , D q ∈R d×r , C q ∈R r×k , r << min(d, k), R is the set of real numbers.

[0125] For the value matrix W v , the forward propagation is represented by the following formula, and the forward propagation process is updated as:

[0126] h v =(W 0v +W0v θ v +T v )x + b 0v

[0127] Where, W 0v represents the original weight matrix of the value matrix W v of, W 0v ∈ R d×k ; θ v represents the second scaling matrix, θ v ∈ R k×k , used to scale the weights; T v represents the second translation matrix, T v ∈ R d×k , used to translate the weights; b 0v represents the second bias matrix, which can make the model easier to learn the complex features of the input data, better adapt to the fine-tuning dataset, and accelerate the convergence speed; decomposing θ v into the fifth low-rank matrix A v , the sixth low-rank matrix B v , and decomposing T v into the seventh low-rank matrix C v , the eighth low-rank matrix D v , the above formula is:

[0128] h v =(W 0v +W 0v B v A v +D v C v )x + b 0v

[0129] Where, B v ∈ R k×r , D v ∈ R d×r , C v ∈ R r×k , r << min(d, k), R is the set of real numbers.

[0130] During the fine-tuning process, only A q , B q , C q , D q , A v , B v , C v , D v are updated by gradient, so as to achieve parameter-efficient fine-tuning for the processing solution generation task, and can effectively learn the scaling and translation of text feature changes. It has been verified that the accuracy of the generated processing solution by this improved fine-tuning method has been improved.

[0131] Optionally, the large language model is Qwen-14B, which is a large language model based on the Transformer structure. Its main body consists of modules such as Embedding, hidden stage, Decoder layer, and RMSNorm.

[0132] The third historical alarm information includes at least one of the following: alarm target name, main alarm name, other alarm names, and alarm time.

[0133] In one optional embodiment, obtaining the fine-tuning dataset includes:

[0134] Obtain several historical alarm events;

[0135] Extract the third historical alarm information and the third historical processing scheme from each of the aforementioned historical alarm events;

[0136] Using the third historical alarm information as the question and the historical processing scheme of the third historical alarm information as the answer, several question-answer pairs are formed, which serve as the fine-tuning dataset.

[0137] Specifically, the extraction of the third historical alarm information and the third historical processing scheme from each of the historical alarm events includes:

[0138] Define a window to iterate through several of the historical alert events; the initial window size is 0.

[0139] Determine if the current window contains keywords related to the solution category; if it does not contain keywords related to the solution category, move the right edge of the current window to the next character; if it contains keywords related to the solution category, move the right edge of the current window to the next character, and determine if the current window contains keywords related to the alarm name category.

[0140] If the alarm name category keyword is not included, the right edge of the current window moves to the next character, and it is determined whether the right edge of the current window overflows. If it overflows, each historical alarm event is segmented according to the keyword category to obtain the third historical alarm information and the third historical processing solution. If the alarm name category keyword is included, the information of the current window is saved, and the left edge of the current window is set to equal the right edge. The process then returns to the step of determining whether the current window contains the solution category keyword.

[0141] It is understandable that the third historical solution refers to the solution that actually existed in history.

[0142] For ease of understanding, combined with Figure 5The above extraction steps are explained in detail:

[0143] (1) Collect keywords from each guidance document that represent the semantic descriptions of "alarm cause" and "solution (i.e., handling measures to resolve the alarm)," and maintain a keyword list covering all alarm names, as shown in Table 2. The guidance documents for network alarms are specifically designed for network maintenance personnel by the operator's provincial and municipal branches in conjunction with equipment manufacturers. Due to differences in network scale and complexity across provinces and cities, and varying skill and experience levels among maintenance personnel, the maintenance guidance measures may differ. While the wording of the guidance documents may vary, they all include alarm name, alarm cause, and solution in their structure, meaning the structure of the manuals from different provinces and cities is basically consistent.

[0144] Table 2

[0145]

[0146] (2) Divide all historical alarm events into paragraphs using “\n”.

[0147] (3) Define a window with an initial size of 0.

[0148] (4) Determine whether each segment contains the keyword "solution": if it does not, move the right edge of the window to the next character; if it does, move the right edge of the window to the next character and execute step (5).

[0149] (5) Starting from the next paragraph, check whether each paragraph contains the keyword "alarm name": if it does not contain it, move the right edge of the window to the next character. If the right edge overflows, proceed to step (6); if it does contain it, it means that the paragraph is a new alarm. Save the information of the current window, set the left edge of the window to the right edge, and continue to proceed to step (4).

[0150] (6) Right boundary overflow indicates that all historical alarm events have been traversed. At this time, each historical alarm event is segmented to obtain the third historical alarm information and the third historical processing solution. For example, by locating the keyword "alarm reason", "alarm name" and "alarm reason + solution" are segmented. "Alarm name" is the third historical alarm information, and "alarm reason + solution" is the third historical processing solution.

[0151] This application embodiment uses a self-adjusting window to extract historical alarm information and historical processing schemes, making full use of the text structure characteristics of historical alarm events, improving the accuracy and efficiency of extraction, and providing data support for the subsequent construction of large model fine-tuning datasets.

[0152] The process uses the third historical alarm information as the question and the historical processing solutions of the third historical alarm information as the answer, forming several question-answer pairs, which constitute the fine-tuning dataset, including:

[0153] Add a primary alarm name identifier to the first alarm name in the third historical alarm information;

[0154] Add relevant alarm identifiers to other alarm names in the third historical alarm information;

[0155] Add an alarm cause identifier and a solution identifier to the third historical processing scheme;

[0156] The questions and answers are concatenated to form several question-answer pairs, which serve as the fine-tuning dataset.

[0157] Table 3 shows an example of a set of question-and-answer (QA) pairs.

[0158] Table 3

[0159]

[0160]

[0161] This application embodiment encapsulates the third historical alarm information and the corresponding third historical processing scheme as questions and answers into question-answer pair data, which can help the alarm processing model better understand and adapt to the terminology and context of the application scenario.

[0162] See Figure 6 , Figure 6 This is a structural block diagram of an alarm processing device 10 provided in an embodiment of this application. The alarm processing device 10 includes:

[0163] The first acquisition module 11 is used to acquire alarm information to be processed;

[0164] The second acquisition module 12 is used to acquire several first historical alarm information that is similar to the alarm information to be processed;

[0165] The generation module 13 is used to generate a first prompt word based on the processing scheme of each of the first historical alarm information and the alarm information to be processed;

[0166] The alarm processing module 14 is used to obtain a processing scheme for the alarm information to be processed based on the first prompt word using a preset alarm processing model; wherein the alarm processing model is obtained by fine-tuning a large language model.

[0167] Optionally, the second acquisition module 12 is further configured to:

[0168] Acquire several alarm events; the alarm events include at least second historical alarm information;

[0169] Based on the aforementioned alarm events, construct an alarm event library;

[0170] Based on the alarm event database, several pieces of the first historical alarm information are obtained according to the semantic similarity between the alarm information to be processed and the second historical alarm information.

[0171] Optionally, the second acquisition module 12 is further configured to:

[0172] The alarm information to be processed is vectorized to obtain a first vector;

[0173] The semantic similarity is obtained based on at least one of the first cosine similarity and the second cosine similarity; the first cosine similarity is determined by the cosine similarity between the first vector and the second vector of the second historical alarm information, and the second cosine similarity is determined by each cosine similarity between the third vector of each keyword of the alarm information to be processed and each of the second vectors.

[0174] Obtain the second historical alarm information with the highest semantic similarity, and use it as several first historical alarm information.

[0175] Optionally, the second acquisition module 12 is further configured to:

[0176] Calculate the cosine similarity between the first vector and the second vector to obtain the first cosine similarity;

[0177] Each keyword of the alarm information to be processed is vectorized to obtain each third vector, and a corresponding weight is assigned to each third vector according to a preset importance level.

[0178] The second cosine similarity is obtained by weighted summation based on each cosine similarity between each of the third vectors and the second vector, and the weights thereof.

[0179] The semantic similarity is obtained based on the first cosine similarity and the second cosine similarity.

[0180] Optionally, the processing scheme for the first historical alarm information includes at least one of a first historical processing scheme and a first candidate processing scheme;

[0181] The alarm processing device 10 further includes:

[0182] The third acquisition module is used to generate a second prompt word based on a preset thought chain example and the first historical alarm information; and to obtain the first candidate processing scheme based on the second prompt word using the alarm processing model.

[0183] Optionally, the alarm processing device 10 further includes:

[0184] A fine-tuning module is used to acquire a fine-tuning dataset; the dataset includes several third historical alarm information and corresponding third historical processing schemes; the self-attention layer in the Transformer layer of the large language model is used as the target layer; the query matrix of the target layer is decomposed into a query low-yield matrix, and the value matrix of the fine-tuning target layer is decomposed into a value low-yield matrix; the fine-tuning dataset is input into the large language model, and the fine-tuning target layer is adjusted during the forward propagation process using the query low-yield matrix and the value low-yield matrix to obtain the alarm processing model; the query low-yield matrix includes: a first low-yield matrix, a second low-yield matrix, a third low-yield matrix, and a fourth low-yield matrix, and the value low-yield matrix includes: a fifth low-yield matrix, a sixth low-yield matrix, a seventh low-yield matrix, and an eighth low-yield matrix.

[0185] It is worth noting that the working process of each module in the alarm processing device 10 described in this application embodiment can refer to the working process of the alarm processing method described in the above embodiment, and will not be repeated here.

[0186] An alarm processing device 10 provided in this application embodiment acquires alarm information to be processed; acquires a plurality of first historical alarm information similar to the alarm information to be processed; generates a first prompt word according to the processing scheme of each first historical alarm information and the alarm information to be processed; and obtains the processing scheme of the alarm information to be processed based on the first prompt word using a preset alarm processing model; wherein the alarm processing model is obtained by fine-tuning a large language model. Therefore, the alarm processing model obtained by fine-tuning the large language model in this application embodiment can reduce reliance on operation and maintenance personnel, help them analyze network problems more systematically and comprehensively, improve alarm processing efficiency and accuracy, and is applicable to various complex scenarios. Moreover, generating the first prompt word using the processing scheme of the first historical alarm information can solve the illusion problem that may occur when the processing scheme directly output by the alarm processing model.

[0187] Furthermore, this application also provides a computer-readable storage medium, which includes a stored computer program; wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform the alarm processing method as described in any of the above embodiments.

[0188] Furthermore, this application also provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the alarm processing method as described in any of the above embodiments.

[0189] See Figure 7 , Figure 7 This is a structural block diagram of an alarm processing device 20 provided in an embodiment of this application. The alarm processing device 20 includes: a processor 21, a memory 22, and a computer program stored in the memory 22 and executable on the processor 21. When the processor 21 executes the computer program, it implements the steps in the above-described alarm processing method embodiments. Alternatively, when the processor 21 executes the computer program, it implements the functions of each module / unit in the above-described device embodiments.

[0190] For example, the computer program may be divided into one or more modules / units, which are stored in the memory 22 and executed by the processor 21 to complete this application. The one or more modules / units may be a series of computer program instruction segments capable of performing a specific function, which describe the execution process of the computer program in the alarm processing device 20.

[0191] The alarm processing device 20 may include, but is not limited to, a processor 21 and a memory 22. Those skilled in the art will understand that the schematic diagram is merely an example of the alarm processing device 20 and does not constitute a limitation on the alarm processing device 20. It may include more or fewer components than illustrated, or combine certain components, or different components. For example, the alarm processing device 20 may also include input / output devices, network access devices, buses, etc.

[0192] The processor 21 can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor. The processor 21 is the control center of the alarm processing device 20, connecting all parts of the alarm processing device 20 via various interfaces and lines.

[0193] The memory 22 can be used to store the computer programs and / or modules. The processor 21 implements various functions of the alarm processing device 20 by running or executing the computer programs and / or modules stored in the memory 22 and calling the data stored in the memory 22. The memory 22 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the mobile phone (such as audio data, phonebook, etc.). In addition, the memory 22 may include high-speed random access memory, and may also include non-volatile memory, such as hard disk, memory, plug-in hard disk, smart media card (SMC), secure digital card (SD) card, flash card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0194] If the modules / units integrated in the alarm processing device 20 are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by the processor 21, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc.

[0195] It should be noted that the device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Furthermore, in the accompanying drawings of the device embodiments provided in this application, the connection relationships between modules indicate that they have communication connections, which can be specifically implemented as one or more communication buses or signal lines. Those skilled in the art can understand and implement this without any creative effort.

[0196] The above description is the preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications are also considered to be within the scope of protection of this application.

Claims

1. An alarm processing method, characterized in that, include: Obtain pending alarm information; Acquire several first historical alarm messages that are similar to the alarm message to be processed; Based on the processing scheme for each of the first historical alarm messages and the alarm messages to be processed, a first prompt word is generated; Using a preset alarm processing model, a processing scheme for the alarm information to be processed is obtained based on the first prompt word; wherein, the alarm processing model is obtained by fine-tuning a large language model.

2. The alarm processing method as described in claim 1, characterized in that, The acquisition of several first historical alarm messages similar to the alarm message to be processed includes: Acquire several alarm events; the alarm events include at least second historical alarm information; Based on the aforementioned alarm events, construct an alarm event library; Based on the alarm event database, several pieces of the first historical alarm information are obtained according to the semantic similarity between the alarm information to be processed and the second historical alarm information.

3. The alarm processing method as described in claim 2, characterized in that, Based on the alarm event database, and according to the semantic similarity between the alarm information to be processed and the second historical alarm information, several pieces of the first historical alarm information are obtained, including: The alarm information to be processed is vectorized to obtain a first vector; The semantic similarity is obtained based on at least one of the first cosine similarity and the second cosine similarity; the first cosine similarity is determined by the cosine similarity between the first vector and the second vector of the second historical alarm information, and the second cosine similarity is determined by each cosine similarity between the third vector of each keyword of the alarm information to be processed and each of the second vectors. Obtain the second historical alarm information with the highest semantic similarity, and use it as several first historical alarm information.

4. The alarm processing method as described in claim 3, characterized in that, The step of obtaining the semantic similarity based on at least one of the first cosine similarity and the second cosine similarity includes: Calculate the cosine similarity between the first vector and the second vector to obtain the first cosine similarity; Each keyword of the alarm information to be processed is vectorized to obtain each third vector, and a corresponding weight is assigned to each third vector according to a preset importance level. The second cosine similarity is obtained by weighted summation based on each cosine similarity between each of the third vectors and the second vector, and the weights thereof. The semantic similarity is obtained based on the first cosine similarity and the second cosine similarity.

5. The alarm processing method as described in claim 1, characterized in that, The processing scheme for the first historical alarm information includes at least one of a first historical processing scheme and a first candidate processing scheme; The first candidate processing scheme is obtained through the following steps: Based on the preset thought chain example and the first historical alarm information, generate a second prompt word; Using the alarm processing model, the first candidate processing scheme is obtained based on the second prompt word.

6. The alarm processing method as described in claim 1, characterized in that, The alarm processing model is obtained through the following steps; Obtain the fine-tuning dataset; the dataset includes several third-historical alarm information and corresponding third-historical processing schemes; The self-attention layer in the Transformer layer of the large language model is taken as the target layer. The query matrix of the target layer is decomposed into a query low-yield matrix, and the value matrix of the fine-tuning target layer is decomposed into a value low-yield matrix; The fine-tuning dataset is input into the large language model, and the fine-tuning target layer is adjusted during the forward propagation process using the query low-yield matrix and the value low-yield matrix to obtain the alarm processing model. The query low-yield matrix includes: a first low-yield matrix, a second low-yield matrix, a third low-yield matrix, and a fourth low-yield matrix; the value low-yield matrix includes: a fifth low-yield matrix, a sixth low-yield matrix, a seventh low-yield matrix, and an eighth low-yield matrix.

7. An alarm processing device, characterized in that, include: The first acquisition module is used to acquire alarm information to be processed. The second acquisition module is used to acquire several first historical alarm messages that are similar to the alarm message to be processed; The generation module is used to generate a first prompt word based on the processing scheme of each of the first historical alarm information and the alarm information to be processed; The alarm processing module is used to obtain a processing scheme for the alarm information to be processed based on the first prompt word using a preset alarm processing model; wherein, the alarm processing model is obtained by fine-tuning a large language model.

8. An alarm processing device, characterized in that, The system includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor, when executing the computer program, implements the alarm processing method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored computer program; wherein, when the computer program is executed, it controls the device in which the computer-readable storage medium is located to perform the alarm processing method as described in any one of claims 1 to 6.

10. A computer program product, characterized in that, It includes a computer program / instruction that, when executed by a processor, implements the alarm processing method as described in any one of claims 1 to 6.

Images