A multi-source log root cause analysis method and system based on a large model

Abstract

The application provides a multi-source log root cause analysis method and system based on a large model. The method comprises the following steps: multi-source log real-time collection and preprocessing, long connection differentiated log pushing, support for breakpoint continuation, and log structured analysis and semantic enhancement; a business process template library is constructed, error features are extracted, business processes are matched, and hypotheses are verified by using a large model through multiple rounds of reasoning, and error types, root cause descriptions, confidence and suggested operations are output; a dialogue template library and customer portrait are constructed, personalized guidance dialogue is matched and generated, multi-modal intelligent guidance is realized through real-time channels and state machines; a feedback optimization module collects indicators and constructs a triple tag data set, and the model is incrementally fine-tuned. The application realizes cross-component log full-link root cause positioning, generates dynamic dialogue combined with customer portrait, and continuously improves the accuracy of error analysis and guidance through closed-loop optimization, and is suitable for enterprise-level system operation and maintenance and customer support in the field of financial technology.

Description

Technical Field

[0001] This invention belongs to the field of artificial intelligence and financial technology, specifically relating to a multi-source log root cause analysis method and system based on a large model. Background Technology

[0002] With the deepening of digital transformation in the financial sector, corporate online banking and mobile banking systems have become core platforms for interaction between banks and customers, undertaking key functions such as fund transfers, account management, and business processing. However, these systems currently face numerous severe challenges in terms of operation and maintenance and customer service: 1. Inefficient error localization: The channel system generates GB-level log data daily. The traditional method of relying on manual log analysis to locate the root cause of errors takes more than 30 minutes, which seriously affects the speed of problem response and thus reduces customer experience. 2. Vague descriptions of customer operations: When enterprise customers report problems, they often cannot accurately describe the operation steps, system prompts, and other key information, making it difficult for technical support personnel to reproduce the problem scenario and increasing the difficulty of troubleshooting. 3. High service costs: Traditional customer service relies on human experience and requires customer service representatives to communicate with customers multiple times to confirm issues. This not only prolongs the problem-solving cycle but also causes the cost of solving a single problem to exceed 200 yuan, resulting in high maintenance and service costs. 4. Compliance risk management challenges: Financial systems have strict regulatory requirements for data security and operational auditing. Existing log analysis tools such as Splunk and ELK can only provide basic log query functions and lack intelligent reasoning capabilities and business semantic understanding, making it impossible to achieve automated root cause analysis of errors, real-time risk warnings, and full-process compliance management.

[0003] Therefore, there is an urgent need for a comprehensive solution that combines large language models, real-time log analysis, and multi-turn interactive reasoning to address the shortcomings of existing technologies. Summary of the Invention

[0004] To address the problems of low efficiency in error localization, vague customer operation descriptions, high service costs, and difficulty in compliance risk management in existing channel systems, the purpose of this invention is to provide a method for analyzing the causes of errors in channel systems based on a large model, thereby achieving rapid location of error root causes, personalized intelligent guidance, reduced service costs, and full-process compliance management.

[0005] To address the aforementioned technical problems, the present invention adopts the following technical solution: A multi-source log root cause analysis method based on a large model includes the following steps: Log data is collected from multiple log sources; logs are pushed to the server using long connections, and differentiated push strategies are set according to the error level of the logs; when the network is interrupted, logs are written to the local cache, and read from the cache and continue to push after the network is restored; the received logs are processed by structured parsing, and error codes are semantically annotated according to the business knowledge base; Build a template library that stores standard business operation steps; provide a large model, input the processed logs into the large model, execute multiple rounds of inference in sequence, and output the inference results including misalignment type, root cause description, confidence level and suggested actions; Build a script template library and read customers' historical operation data and attribute information from the business system and customer management system to construct a customer profile feature vector with multiple dimensions; based on the customer profile feature vector and the output error type, match and generate personalized guidance scripts from the script template library; push the script to the client through a real-time communication channel and maintain a session state machine with multiple session states to support stateful multi-turn dialogues; automatically switch communication methods when the network quality is lower than a preset threshold. Regularly collect processing results from the server and compile service quality indicators; construct a labeled dataset of successful and failed cases, and store it in the database after manual review; use incremental fine-tuning methods to fine-tune the large model regularly.

[0006] Furthermore, the multi-round reasoning specifically includes: First round of inference: Input error features into the large model to extract prompt words, and the large model outputs the first intermediate result containing error codes, error information and affected modules; Second round of reasoning: Extract the standard operation step sequence associated with the first intermediate result from the template library containing the standard business operation step sequence, provide the sequence and the first intermediate result together as input to the large model, and input business process matching prompt words into the large model. The large model outputs the second intermediate result containing the deviation steps and operation assumptions. The third round of reasoning involves inputting the first intermediate result, the second intermediate result, and the historical case knowledge base into the large model, along with hypothesis testing prompts. The large model then outputs the reasoning results, which include the error type, root cause description, confidence level, and suggested actions.

[0007] Further, extracting the standard operation step sequence associated with the first intermediate result from the template library includes: retrieving a matching business process template from the template library storing standard business operation step sequences based on the error code or affected module in the first intermediate result, and locating the step node in the process corresponding to the error code.

[0008] Furthermore, the personalized guidance script includes: the time when the error occurred, the operation performed by the customer, the specific reason for the error, and step-by-step operation suggestions.

[0009] Furthermore, the customer profile feature vector includes operation frequency, frequently used functions, historical error types, and operation duration preferences.

[0010] Furthermore, the customer profile feature vector is fully updated every 24 hours, and incrementally updated according to triggered events during real-time sessions; the personalized guidance script is output simultaneously in three forms: text, voice broadcast, and screen operation demonstration; customers submit feedback on the guidance effect through the client by rating it from 1 to 5 stars.

[0011] Furthermore, the session state machine has four states: initial push, client response, step confirmation, and closed-loop settlement.

[0012] Furthermore, the service quality indicators include first-time resolution rate, average processing time, and customer satisfaction.

[0013] Furthermore, the labeled dataset is constructed in a triplet format containing input logs, root cause labels, and utterance labels.

[0014] On the other hand, the present invention provides a multi-source log root cause analysis system based on a large model, comprising: The log collection and preprocessing module is used to collect log data from multiple log sources; push logs to the server using a long connection and set differentiated push strategies based on the error level of the logs; write logs to a local cache when the network is interrupted, and read them from the cache and continue pushing them after the network is restored; perform structured parsing processing on the received logs and semantically annotate error codes based on the business knowledge base; The large model inference module is used to build a template library that stores a sequence of standard business operation steps; it provides a large model, inputs the processed logs into the large model, executes multiple rounds of inference in sequence, and outputs inference results including misalignment type, root cause description, confidence level and suggested operation; The script generation guidance module is used to build a script template library and read customers' historical operation data and attribute information from the business system and customer management system to construct a customer profile feature vector containing multiple dimensions; based on the customer profile feature vector and the output error type, it matches and generates personalized guidance scripts from the script template library; it pushes the script to the client through a real-time communication channel and maintains a session state machine with multiple session states to support stateful multi-turn dialogues; it automatically switches the communication mode when the network quality is lower than a preset threshold. The feedback optimization module is used to periodically collect processing results from the server and statistically analyze service quality indicators; it constructs a labeled dataset of successful and failed cases, which is then manually reviewed and stored in the database; and it uses an incremental fine-tuning method to periodically fine-tune the large model.

[0015] Compared with the prior art, the present invention has the following beneficial effects: 1. This invention revolutionizes error location efficiency: through intelligent analysis of large models, the root cause location time is reduced from 30 minutes to ≤2 seconds, improving efficiency by more than 900 times and significantly accelerating problem response speed; 2. This invention significantly improves customer service quality: Based on the root cause of errors and customer profiles, it automatically generates precise guiding scripts, increasing the first-time resolution rate from 80% to 95%, and improving customer satisfaction scores from 3.5 to 4.8, thus enhancing the customer experience; 3. This invention significantly reduces operation and maintenance costs: it reduces the workload of manual log analysis, lowers the manpower cost of the operation and maintenance team by 60%, and reduces the company's operating costs; 4. Enhanced system stability of the invention: Through early error detection and preventative recommendations, the system's major failure rate is reduced by 30%, and the mean time between failures is increased by 40%, ensuring the stable operation of the channel system; 5. This invention enhances compliance and risk control capabilities: it enables full-process operation auditing, real-time risk monitoring, and sensitive information protection, fully meeting the compliance requirements of financial regulatory agencies and reducing compliance risks. Attached Figure Description

[0016] Figure 1 This is an overall interaction diagram of an embodiment of the present invention; Figure 2 This is a flowchart illustrating the multi-source log collection process according to an embodiment of the present invention. Figure 3 This is a sequence diagram of multi-round inference for a large model in an embodiment of the present invention, showing the interaction sequence and output results of each stage of inference. Detailed Implementation

[0017] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0018] Example 1 like Figure 1 As shown, this embodiment provides a multi-source log root cause analysis method based on a large model, including the following steps: Step 1: Collect log data from multiple log sources; push logs to the server using long connections and set differentiated push strategies based on the error level of the logs; write logs to the local cache when the network is interrupted, and read them from the cache and continue pushing them after the network is restored; perform structured parsing on the received logs and semantically annotate the error codes based on the business knowledge base; Step 2: Build a template library that stores the sequence of standard business operation steps; provide a large model, input the processed logs into the large model, execute multiple rounds of inference in sequence, and output the inference results including misalignment type, root cause description, confidence level and suggested operation; Step 3: Build a script template library and read historical operation data and attribute information of customers from the business system and customer management system to construct a customer profile feature vector containing multiple dimensions; based on the customer profile feature vector and the output error type, match and generate personalized guidance scripts from the script template library; push the script to the client through a real-time communication channel and maintain a session state machine with multiple session states to support stateful multi-turn dialogues; automatically switch communication methods when the network quality is lower than a preset threshold. Step 4: Regularly collect processing results from the server and compile service quality indicators; construct a labeled dataset of successful and failed cases, and store it in the database after manual review; use incremental fine-tuning methods to fine-tune the large model regularly.

[0019] like Figure 2 As shown, in step 1 of this embodiment, the collection scope covers all components such as front-end applications, back-end microservices, database operations, and network middleware to ensure the integrity of log data; the log collector synchronously collects four types of logs: front-end applications, back-end microservices, database operations, and network middleware, and distinguishes the push strategy according to the error level; real-time log push is achieved using WebSocket long connection, and when the error level is set to ≥WARN, it is reported immediately, and INFO level logs are uploaded in batches at 1-minute intervals, balancing real-time performance and transmission efficiency; When the network is interrupted, local caching (..\logs.db) is enabled, supporting breakpoint resumption. After the network is restored, the breakpoint will be automatically resumed to ensure that the logs are not lost. The logs are structured and parsed according to the preset JSON format, removing non-business-related noise logs such as debugging logs and heartbeat detection logs. Error codes are semantically enhanced and annotated based on the business knowledge base to improve the availability of log data.

[0020] In this embodiment 2, the specific components include: Build a standard business process template library to store the standard operating steps for each business, such as the six-step process for corporate transfers: "Login - Select function - Enter information - Set amount - Authorize approval - Complete transfer"; The DeepSeek-V3 model is deployed on an inference cluster with two NVIDIA A100 graphics cards. Root cause localization is achieved through three rounds of inference driven by structured cue word engineering: The first round uses "error feature extraction cue words" to guide the model in analyzing direct error information from logs, outputting a JSON object containing errorCode, errorMessage, and the affected module, which serves as the input context for the second round. The second round uses "business process matching cue words" to compare the first round's output with a business process template library, retrieving the step node most relevant to errorCode from the standard process template, inferring the specific step where the customer might have misoperated, and outputting a JSON object containing the deviated step and operational hypothesis, which is then fed into the third round. The third round uses "hypothesis verification cue words" to merge the outputs of the first two rounds, verifying the hypothesis's rationality using a historical case knowledge base, and outputting the final root cause description, confidence level, and suggested actions in JSON format. The inference output includes a JSON format result containing root cause descriptions, confidence levels, and suggested actions, ensuring the accuracy and usability of the output results.

[0021] Specifically, such as Figure 3 As shown, taking errorCode=TRF_1002 as an example, the time sequence from log input to dialogue push is displayed, clearly presenting the logical progression of the three rounds of reasoning and the interaction nodes of each module; the large model reasoning engine first obtains the corresponding business process template from the business knowledge base, and starts the three rounds of reasoning based on the enhanced logs; The first round analyzes direct error information in the logs; the second round combines business processes to locate possible operational errors; and the third round verifies hypotheses by matching historical cases to ensure the accuracy of root cause analysis. The inference results are output in a preset JSON format, including root cause description, confidence level and suggested actions. When the confidence level is ≥0.8, the results are pushed to the guidance generation layer to generate personalized guidance scripts and push them to the client.

[0022] In step 3 of this embodiment, customer historical operation logs (last 90 days) and enterprise types (such as micro-enterprises and medium-sized enterprises) and industry classifications in the CRM system are synchronized from the business system database as data sources to construct a customer profile feature vector with 12 dimensions, including operation frequency, commonly used functions, historical error types, and operation duration preferences. The profile data is fully updated every 24 hours and incrementally updated according to triggered events during real-time sessions. Based on the above feature vectors and combined with the current error type, the most suitable script template is retrieved from the template library through similarity matching to generate personalized guidance scripts, supporting multimodal forms such as text, voice broadcast, and screen operation demonstration. Instructions are pushed to clients in real time via WebSocket. An innovative session state machine management mechanism is introduced on the basis of standard long connection. The interactive session is divided into four states: "initial push", "customer response", "step confirmation" and "closed-loop settlement". It supports 30 minutes of stateful multi-round dialogue. When the network quality is lower than the threshold, it automatically degrades to HTTP long polling mode to ensure reliable delivery of instructions. Customers can give feedback on the effectiveness of the instructions in 1-5 stars. The script includes the time the error occurred, the business operation, the specific reason, and detailed operational suggestions to ensure that the customer can quickly understand and resolve the problem.

[0023] In step 4 of this embodiment, key indicators such as first-time resolution rate, average processing time, and customer satisfaction are monitored, and processing results are synchronized to the model training platform every 5 minutes. Successful and failed cases are collected to construct a labeled dataset. The labeling specification adopts the triple format of "input log-root cause label-sales pitch label". Only samples with an accuracy rate of ≥95% after manual review are included in the database. With the root cause identification accuracy and first-time resolution rate as fine-tuning targets, the LoRA low-rank adaptation method is used to incrementally fine-tune the DeepSeek-V3 model once a week. The evaluation indicators include test set root cause accuracy, average confidence bias, and first-time resolution rate. Only when all three indicators meet the standards can the model be launched. A virtuous cycle of "analysis-guidance-feedback-optimization" is achieved through feedback loop to continuously improve the accuracy of error analysis and customer guidance.

[0024] In addition, this embodiment also includes end-to-end security and compliance management: Data transmission is encrypted using the TLS 1.3 protocol, and storage is encrypted using AES-256. Sensitive information such as ID card numbers and bank card numbers is automatically de-identified to ensure data security. Based on the RBAC (Role-Based Access Control) model, three levels of permissions are defined: the operations and maintenance administrator role is bound to full log read and write, model configuration, and audit viewing permissions; the customer service specialist role can only access anonymized customer-related logs and script templates, and is prohibited from accessing internal system configurations; the ordinary customer role can only view the operation records and guidance results of the current session; the permission token uses the JWT format, is valid for 15 minutes, and automatically expires and forces re-authentication after the expiration time, and all access behaviors are recorded in the audit log; Log data is retained for 180 days, which complies with financial regulatory requirements. It monitors abnormal operation patterns in real time, triggers risk control rules, and strengthens compliance and risk control capabilities.

[0025] The key data format, interface definition, and processing logic in this embodiment are as follows: 1. Standard Log Data Format The standard JSON format reported by the log collection layer is as follows: {"timestamp":"2025-01-01T10:00:00.000Z", "level":"ERROR", "module":"transfer-service", "errorCode":"TRF_1002", "message":"transfer amount exceeded", "userId":"U123456", "sessionId":"S789012", "clientIp":"192.168.1.x", "deviceId":"D345678"}; the preprocessing layer adds semantic annotation fields "semanticTag" (such as "exceeded limit for corporate transfers") and "bizProcessId" (the matched business process template ID, such as "corporate_transfer_v3") on top of this.

[0026] 2. Definition of Large Model Inference Interface The large model inference engine exposes a REST interface POST / api / v1 / inference. The request body contains three fields: enhancedLog (enhanced log JSON), bizProcessTemplate (business process template object), and roundContext (previous round inference context, empty for the first round). The return body contains four fields: rootCause (root cause description string), confidence (confidence floating-point number, range 0-1), suggestedAction (suggested action list), and nextRoundContext (next round inference context). The three rounds of inference call this interface sequentially, with each round using the nextRoundContext of the previous round as the roundContext of the next round, realizing the chained transmission of inference information.

[0027] 3. Definition of the script delivery interface After the script is generated, a standard message body is pushed to the client with the corresponding sessionId via WebSocket: {"msgType":"guidance", "sessionId":"S789012", "errorTime":"2025-01-01T10:00:00Z", "bizAction":"Corporate Transfer", "rootCause":"Transfer amount exceeds the daily single transaction limit", "steps":["Log in to online banking - Settings menu - Transfer limit adjustment"], "mediaType":"text"}; After receiving the message, the client renders the corresponding text, voice or demonstration animation, and sends the user operation and rating results back to the feedback interface POST / api / v1 / feedback.

[0028] Example 2 This embodiment provides a multi-source log root cause analysis system based on a large model, including: The log collection and preprocessing module is used to collect log data from multiple log sources; push logs to the server using a long connection and set differentiated push strategies based on the error level of the logs; write logs to a local cache when the network is interrupted, and read them from the cache and continue pushing them after the network is restored; perform structured parsing processing on the received logs and semantically annotate error codes based on the business knowledge base; The large model inference module is used to build a template library that stores a sequence of standard business operation steps; it provides a large model, inputs the processed logs into the large model, executes multiple rounds of inference in sequence, and outputs inference results including misalignment type, root cause description, confidence level and suggested operation; The script generation guidance module is used to build a script template library and read customers' historical operation data and attribute information from the business system and customer management system to construct a customer profile feature vector containing multiple dimensions; based on the customer profile feature vector and the output error type, it matches and generates personalized guidance scripts from the script template library; it pushes the script to the client through a real-time communication channel and maintains a session state machine with multiple session states to support stateful multi-turn dialogues; it automatically switches the communication mode when the network quality is lower than a preset threshold. The feedback optimization module is used to periodically collect processing results from the server and statistically analyze service quality indicators; it constructs a labeled dataset of successful and failed cases, which is then manually reviewed and stored in the database; and it uses an incremental fine-tuning method to periodically fine-tune the large model.

[0029] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention.

[0030] Obviously, those skilled in the art can make various modifications and variations to the embodiments of the present invention without departing from the spirit and scope of the embodiments of the present invention. Thus, if these modifications and variations to the embodiments of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention also intends to include these modifications and variations.

[0031] All other parts not described in detail are existing technologies.

Claims

1. A multi-source log root cause analysis method based on a large model, characterized in that, Includes the following steps: Log data is collected from multiple log sources; logs are pushed to the server using long connections, and differentiated push strategies are set according to the error level of the logs; when the network is interrupted, logs are written to the local cache, and read from the cache and continue to push after the network is restored; the received logs are processed by structured parsing, and error codes are semantically annotated according to the business knowledge base; Build a template library that stores standard business operation steps; provide a large model, input the processed logs into the large model, execute multiple rounds of inference in sequence, and output the inference results including misalignment type, root cause description, confidence level and suggested actions; Build a script template library and read customers’ historical operation data and attribute information from the business system and customer management system to construct a customer profile feature vector with multiple dimensions. Based on the customer profile feature vector and the output error type, a personalized guidance script is generated by matching from the script template library; the script is pushed to the client through a real-time communication channel, and a session state machine with multiple session states is maintained to support stateful multi-turn dialogues; the communication method is automatically switched when the network quality is lower than a preset threshold. Regularly collect processing results from the server and compile service quality indicators; construct a labeled dataset of successful and failed cases, and add it to the database after manual review; The large model is periodically fine-tuned using an incremental fine-tuning method.

2. The multi-source log root cause analysis method based on a large model according to claim 1, characterized in that, The multi-round reasoning specifically includes: First round of inference: Input error features into the large model to extract prompt words, and the large model outputs the first intermediate result containing error codes, error information and affected modules; Second round of reasoning: Extract the standard operation step sequence associated with the first intermediate result from the template library containing the standard business operation step sequence, provide the sequence and the first intermediate result together as input to the large model, and input business process matching prompt words into the large model. The large model outputs the second intermediate result containing the deviation steps and operation assumptions. The third round of reasoning involves inputting the first intermediate result, the second intermediate result, and the historical case knowledge base into the large model, along with hypothesis testing prompts. The large model then outputs the reasoning results, which include the error type, root cause description, confidence level, and suggested actions.

3. The multi-source log root cause analysis method based on a large model according to claim 2, characterized in that, Extracting the standard operation step sequence associated with the first intermediate result from the template library includes: retrieving a matching business process template from the template library storing standard business operation step sequences based on the error code or affected module in the first intermediate result, and locating the step node in the process corresponding to the error code.

4. The multi-source log root cause analysis method based on a large model according to claim 1, characterized in that, The personalized guidance script includes: the time the error occurred, the action taken by the customer, the specific reason for the error, and step-by-step operation suggestions.

5. The multi-source log root cause analysis method based on a large model according to claim 1, characterized in that, The customer profile feature vector includes operation frequency, frequently used functions, historical error types, and operation duration preferences.

6. The multi-source log root cause analysis method based on a large model according to claim 1, characterized in that, The customer profile feature vector is fully updated every 24 hours and incrementally updated according to triggered events during real-time sessions; the personalized guidance script is output simultaneously in three forms: text, voice broadcast, and screen operation demonstration; customers submit a rating of 1 to 5 stars for the guidance effect through the client.

7. The multi-source log root cause analysis method based on a large model according to claim 1, characterized in that, The session state machine has four states: initial push, client response, step confirmation, and closed-loop settlement.

8. The multi-source log root cause analysis method based on a large model according to claim 1, characterized in that, The service quality indicators include first-time resolution rate, average processing time, and customer satisfaction.

9. The multi-source log root cause analysis method based on a large model according to claim 1, characterized in that, The labeled dataset is constructed in a triplet format containing input logs, root cause labels, and utterance labels.

10. A multi-source log root cause analysis system based on a large model, characterized in that, include: The log collection preprocessing module is used to collect log data from multiple log sources; Long-lived connections are used to push logs to the server, and differentiated push strategies are set according to the error level of the logs. When the network is interrupted, logs are written to a local cache. After the network is restored, logs are read from the cache and pushed again. The received logs are processed in a structured parsing manner, and error codes are semantically annotated based on the business knowledge base. The large model inference module is used to build a template library that stores a sequence of standard business operation steps; it provides a large model, inputs the processed logs into the large model, executes multiple rounds of inference in sequence, and outputs inference results including misalignment type, root cause description, confidence level and suggested operation; The script generation guidance module is used to build a script template library and read customers' historical operation data and attribute information from the business system and customer management system to build a customer profile feature vector containing multiple dimensions. Based on the customer profile feature vector and the output error type, a personalized guidance script is generated by matching from the script template library; the script is pushed to the client through a real-time communication channel, and a session state machine with multiple session states is maintained to support stateful multi-turn dialogues; the communication method is automatically switched when the network quality is lower than a preset threshold. The feedback optimization module is used to periodically collect processing results from the server and statistically analyze service quality indicators; it also builds a labeled dataset of successful and failed cases, which is then manually reviewed and stored in the database. The large model is periodically fine-tuned using an incremental fine-tuning method; The large-model-based multi-source log root cause analysis system is used to perform the steps in the large-model-based multi-source log root cause analysis method according to any one of claims 1-9.

Images