An operation and maintenance fault intelligent early warning system based on a large language model

Abstract

The application is suitable for the technical field of computers, and provides an operation and maintenance fault intelligent early warning system based on a large language model, comprising: a multi-source operation and maintenance data acquisition module, which is used for collecting multi-source operation and maintenance data of a target operation and maintenance system in real time; a data preprocessing and vectorization module, which is connected with the multi-source operation and maintenance data acquisition module and is used for preprocessing the multi-source operation and maintenance data and converting the multi-source operation and maintenance data into a vectorized representation; and a dynamic context construction module, which is connected with the data preprocessing and vectorization module and is used for dynamically generating prompt context according to the vectorized representation and historical fault cases. In the application, multi-source operation and maintenance data such as log data, time series index data and change event data are fused, and the semantic understanding and reasoning capability of the large language model is utilized, so that the limitation of traditional methods which only rely on a single data source or fixed rules is overcome.

Description

Technical Field

[0001] This invention belongs to the field of computer technology, and in particular relates to an intelligent early warning system for operation and maintenance faults based on a large language model. Background Technology

[0002] Operational fault early warning is a crucial link in ensuring the stable operation of information systems. With the popularization of cloud computing and microservice architecture, modern operation and maintenance systems exhibit significant characteristics such as large scale, complex dependencies between components, and highly diverse data modalities. Before a fault occurs, the system state often contains precursory information through the abnormal evolution patterns of multi-source heterogeneous data. These patterns involve dynamic coupling and temporal correlation between data. However, how to timely and accurately identify such precursors from massive, high-dimensional operational data streams and generate actionable early warning prompts has become a core challenge in the field of intelligent operation and maintenance.

[0003] Existing technical solutions have systemic flaws in dealing with such problems.

[0004] The first type of method, based on static thresholds or rules, relies on manually set fixed thresholds or predefined rules to trigger alarms. Although it is simple to implement, it cannot adapt to the dynamic evolution of system behavior and is difficult to capture the complex interaction characteristics of faults among multi-dimensional data such as logs, time-series indicators and change events, resulting in frequent false alarms and missed alarms.

[0005] The second category of methods, based on traditional machine learning, such as isolated forests or time series prediction models, can automatically learn the data distribution of a single indicator, but they usually only focus on time series indicator data, ignoring the semantic value of log text and the triggering effect of change events on faults. They cannot integrate multi-source information for comprehensive judgment, thus limiting the accuracy of early warnings.

[0006] The third type of deep learning-based methods, such as recurrent neural networks or graph neural networks, have improved feature extraction, but model training is often limited to specific failure modes or single data sources, lacking the ability to fuse and reason about multi-source heterogeneous data.

[0007] These shortcomings collectively result in significant deficiencies in existing solutions regarding dynamic context understanding, multi-source knowledge fusion, and interpretable early warning output, making it difficult to meet the demands of modern operation and maintenance systems for accurate and intelligent early warning. Therefore, existing technologies urgently need improvement to address these issues. Summary of the Invention

[0008] The purpose of this invention is to provide an intelligent early warning system for operation and maintenance faults based on a large language model, in order to solve the above-mentioned problems.

[0009] This invention is implemented as follows: an intelligent early warning system for operation and maintenance faults based on a large language model, comprising: The multi-source operation and maintenance data acquisition module is used to collect multi-source operation and maintenance data of the target operation and maintenance system in real time; The data preprocessing and vectorization module is connected to the multi-source operation and maintenance data acquisition module and is used to preprocess the multi-source operation and maintenance data and convert it into a vectorized representation. A dynamic context construction module, connected to the data preprocessing and vectorization module, is used to dynamically generate a prompt context based on the vectorized representation and historical fault cases. The large language model reasoning module, which is equipped with a large language model and connected to the dynamic context construction module, is used to input the prompting context into the large language model to obtain the fault prediction result. The early warning level output module is connected to the large language model inference module and is used to output early warning signals of the corresponding level based on the fault prediction results.

[0010] In a further technical solution, the multi-source operation and maintenance data includes at least log data, time-series indicator data, and change event data.

[0011] In a further technical solution, the data preprocessing and vectorization module is specifically used for: The multi-source operation and maintenance data is subjected to structured cleaning, time alignment, and outlier processing. The processed data is sliced ​​into operation and maintenance scenario instances according to time windows; The text data in each operation and maintenance scenario instance is transformed into a corresponding text feature vector using a pre-trained embedding model.

[0012] In a further technical solution, the data preprocessing and vectorization module uses a sliding window mechanism to slice the data into time windows, and there is some data overlap between adjacent time windows.

[0013] A further technical solution is that the dynamic context construction module includes: The real-time status encoding unit is used to encode the vectorized representation of the operation and maintenance data corresponding to the current time window into a summary of the current system status. The similarity fault retrieval unit is used to perform cosine similarity retrieval in the historical fault case library using the current system state summary as the query condition, and to obtain the historical fault segment with the highest similarity and its root cause; wherein, each fault segment and its root cause in the historical fault case library is pre-calculated and stored by the pre-trained embedding model. The Change Impact Analysis unit is used to parse change event data and generate change impact description text. The prompt word assembly unit is used to assemble the current system status summary, the historical fault fragments and their root causes, and the change impact description text into the prompt context according to a preset instruction template.

[0014] A further technical solution is that the large language model is a fine-tuned large language model, and the fine-tuning process includes: Obtain a training dataset containing historical operation and maintenance scenario instances and corresponding real fault labels; A parameter-efficient fine-tuning method is adopted, which fixes most of the original parameters of the model and only updates a small number of trainable parameters. With the optimization objective of minimizing the difference between the predicted fault type and the actual fault label, domain adaptation fine-tuning is completed.

[0015] In a further technical solution, the fault prediction result includes fault type, fault occurrence probability, and root cause inference link.

[0016] A further technical solution involves the early warning grading output module comparing the probability of fault occurrence with multiple preset dynamic thresholds to determine and output an early warning signal of the corresponding level, while simultaneously outputting the root cause inference link; wherein the dynamic thresholds are calculated according to the following formula: First, calculate the average value of the historical fault prediction probability for the same fault type. Then, add this value to the value obtained by multiplying the preset coefficient by the standard deviation of the historical fault prediction probability. Finally, limit the sum to the range of 0 to 1 to obtain the dynamic threshold for the corresponding level. Different warning levels correspond to different preset coefficients, and the higher the warning level, the larger the preset coefficient.

[0017] Compared with the prior art, the beneficial effects of the present invention are as follows: In this invention, by integrating multi-source operation and maintenance data such as log data, time-series indicator data, and change event data, and by utilizing the semantic understanding and reasoning capabilities of a large language model, the limitations of traditional methods that rely on only a single data source or fixed rules are overcome, significantly improving the accuracy and comprehensiveness of fault early warning and effectively reducing false alarm and false negative rates.

[0018] In this invention, the dynamic context construction module combines real-time system status summaries, similar historical fault fragments and their root causes, and descriptions of the impact of changes to provide rich contextual information for the large language model. This enables the model to output interpretable prediction results that include fault type, occurrence probability, and root cause inference links. Maintenance personnel can directly obtain the cause and evolution path of the fault, greatly shortening the fault investigation and recovery time.

[0019] In this invention, a sliding window mechanism is used to slice multi-source data over time while preserving data overlap, ensuring the continuity of system state evolution and preventing abnormal precursor information from being truncated by the window boundary. At the same time, a pre-trained embedding model is used to transform text data into semantically rich vector representations, laying a high-quality data foundation for subsequent high-precision retrieval and large language model inference.

[0020] In this invention, the early warning grading output module performs multi-level early warnings based on the probability of fault occurrence and dynamic thresholds. The dynamic thresholds integrate the mean and standard deviation of historical fault prediction probabilities, which can adaptively adjust the judgment boundary of each level of early warning and achieve fine classification of risk levels. At the same time, it links the output root cause inference link, which improves the operability of early warnings and the pertinence of operation and maintenance decisions, and realizes the leap from "discovering anomalies" to "understanding anomalies and providing solutions". Attached Figure Description

[0021] Figure 1 This is a logical diagram of the overall system architecture. Figure 2 For data preprocessing and vectorized flow graphs; Figure 3 Construct a convergence logic graph for dynamic contexts; Figure 4 The system calculates and outputs a judgment chart for early warning classification. Detailed Implementation

[0022] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0023] The specific implementation of the present invention will be described in detail below with reference to specific embodiments.

[0024] like Figures 1-4 As shown, an intelligent early warning system for operation and maintenance faults based on a large language model is provided in one embodiment of the present invention, comprising: The multi-source operations and maintenance data acquisition module is used to collect multi-source operations and maintenance data from the target operations and maintenance system in real time. This module can be configured to periodically poll a database or file system to obtain system logs and performance metrics. For example, it can read new lines from log files at fixed time intervals (e.g., every 5 minutes) and pull metrics such as CPU utilization and memory usage from a monitoring agent. This module can also receive event streams from different service components by listening to specific network ports or message queues. For example, when a service experiences a start-up, stop, or error event, this module can capture these event information in real time. Furthermore, this module can integrate specific API interfaces to obtain configuration change records from third-party monitoring tools or configuration management systems. For example, when the system configuration is modified, this module can call the corresponding API to obtain change details.

[0025] The data preprocessing and vectorization module, connected to the aforementioned multi-source operation and maintenance data acquisition module, is used to preprocess multi-source operation and maintenance data and convert it into a vectorized representation. This module can perform simple word segmentation on the raw text logs and convert them into sparse vectors using the bag-of-words model or TF-IDF method. For example, it maps each word in the log to a unique index and counts its frequency of occurrence in the log. For time-series metric data, this module can perform normalization processing and directly use the normalized numerical sequence as a vector representation. For example, it scales metrics such as CPU utilization and memory utilization to a range of 0 to 1. For event data, this module can convert it into one-hot encoded vectors to represent whether a specific event has occurred. For example, it encodes the "service restart" event as [0, 1, 0].

[0026] The dynamic context building module, connected to the aforementioned data preprocessing and vectorization module, dynamically generates prompt context based on the vectorized representations and historical fault cases. This module can simply concatenate all vectorized data within the current time period to form a long vector representing the current system state. For example, it can directly concatenate log vectors, metric vectors, and event vectors. For historical fault cases, this module can pre-label and store typical fault descriptions and their corresponding root causes. When context building is needed, this module can select several of the most relevant cases from these pre-stored cases based on keyword matching of the current system state. Then, the module performs a simple text concatenation between the vector representation of the current system state and the text descriptions of the selected historical fault cases to form the final prompt context. For example, inputting in the format "Current system state: [vector representation]; Historical fault cases: [case description]".

[0027] The large language model inference module, deployed with a large language model and connected to the aforementioned dynamic context construction module, is used to input the aforementioned prompt context into the large language model to obtain fault prediction results. This module can use a general-purpose large language model (e.g., a pre-trained model not trained for a specific domain), directly inputting the constructed prompt context and requesting it to output fault prediction results. For example, a publicly available base model can be used, providing a general instruction such as "Please predict the possible fault type and cause based on the following information." This module can be configured to call a remotely deployed large language model service via API, sending the prompt context to the service and receiving the returned prediction results. Alternatively, this module can deploy a smaller-scale general-purpose large language model locally for direct inference computation.

[0028] The early warning tiered output module, connected to the aforementioned large language model inference module, is used to output early warning signals of corresponding levels based on the fault prediction results. This module can determine the existence of potential faults based on whether the text description output by the large language model contains keywords such as "fault" or "abnormality." For example, if the model output contains "potential database connection problem," an early warning is triggered. This module can set a single fixed threshold; for example, if the confidence score of the model output is higher than 0.7, a uniform "high-risk warning" is output. Early warning signals can be easily sent to a pre-defined list of maintenance personnel via email or SMS.

[0029] In this embodiment, the dynamic context construction module and the large language model reasoning module of this application dynamically assemble the current system state, historical fault cases, and the impact of changes into a prompt context. Utilizing the reasoning capabilities of the large language model, it can not only predict the fault type but also output the fault occurrence probability and root cause inference chain. For example, it directly provides the fault type "database connection pool exhausted" and the root cause inference "database connection pool parameter adjustment leading to insufficient connection count." This greatly improves the interpretability and guidance of the warning results, enabling maintenance personnel to quickly locate and resolve problems, significantly shortening fault response time.

[0030] Therefore, the early warning hierarchical output module of this application can output early warning signals of corresponding levels based on the fault prediction results, and correlate them with the root cause inference link, thus realizing refined management of early warnings. This contrasts sharply with the single and vague alarm information in traditional methods, effectively solving the pain points of low early warning accuracy, lack of comprehensive contextual understanding and causal reasoning ability, and inability to output interpretable early warning results in existing technologies. Overall, by introducing a large language model and constructing a dynamic context mechanism, this application achieves a leap from "discovering anomalies" to "understanding anomalies and providing solutions" in operation and maintenance fault early warning, providing a new technical path and solution for the field of intelligent operation and maintenance.

[0031] In a preferred embodiment of the present invention, the multi-source operation and maintenance data includes at least log data, time-series indicator data, and change event data.

[0032] In this embodiment, the solution of this application lays a solid data foundation for subsequent intelligent analysis by clearly defining the specific composition of multi-source operation and maintenance data. The multi-source operation and maintenance data acquisition module, through configuration, can selectively collect these specific types of data in real time. Log data provides semantic information about system operation and can reflect unstructured abnormal behavior; time-series index data provides quantitative measurements of system performance and can intuitively display resource consumption and load fluctuations; change event data provides external triggers that lead to changes in system state and is a key clue for analyzing the root causes of faults. The fusion and acquisition of these three types of data overcomes the limitation of incomplete information coverage in fault early warning from a single data source. This comprehensive data input enables the data preprocessing and vectorization modules to perform preprocessing and vectorization representation based on richer and more relevant contextual information, thereby providing high-quality input for the dynamic context construction module and ultimately improving the ability of the large language model inference module to capture fault precursors and the accuracy of root cause inference in complex operation and maintenance scenarios.

[0033] In a preferred embodiment of the present invention, the data preprocessing and vectorization module is specifically used for: The multi-source operation and maintenance data is subjected to structured cleaning, time alignment, and outlier processing. The processed data is sliced ​​into operation and maintenance scenario instances according to time windows; The text data in each operation and maintenance scenario instance is transformed into a corresponding text feature vector using a pre-trained embedding model.

[0034] In this embodiment, the solution of this application provides high-quality, high-semantic-density input data for large language models by performing refined preprocessing and structured transformation of multi-source operation and maintenance data, thereby significantly improving the accuracy and reliability of fault prediction.

[0035] Specifically, the raw operation and maintenance data collected in real time by the multi-source operation and maintenance data acquisition module first enters the data preprocessing and vectorization module. In this module, the raw data undergoes structure cleaning, time alignment, and outlier handling to eliminate noise, standardize the format, and ensure data quality. Subsequently, the processed data is sliced ​​by time window to form a series of discrete operation and maintenance scenario instances, each representing a snapshot of the system's state within a specific time period. For the text data in these operation and maintenance scenario instances, a pre-trained embedding model transforms it into semantically rich text feature vectors. These high-quality, structured, and vectorized operation and maintenance scenario instances are then sent to the dynamic context construction module as the basis for building the prompt context. This processing flow ensures that the data input to the large language model inference module is not only accurate and consistent but also rich in semantic information, greatly enhancing the large language model's ability to understand complex operation and maintenance scenarios and the accuracy of identifying early warning signs. In this way, the data preprocessing and vectorization module provides a solid data foundation for the entire intelligent early warning system, enabling the subsequent large language model to more effectively perform fault prediction and root cause inference.

[0036] In a preferred embodiment of the present invention, the data preprocessing and vectorization module uses a sliding window mechanism to slice the data into time windows, and there is some data overlap between adjacent time windows.

[0037] In this embodiment, the proposed solution introduces a sliding window mechanism by optimizing the time slicing method of multi-source operation and maintenance data in the data preprocessing and vectorization module, and specifically emphasizes the partial data overlap between adjacent time windows. Specifically, after receiving multi-source operation and maintenance data, the data preprocessing and vectorization module no longer simply divides the data into fixed, non-overlapping time periods, but instead continuously slides a fixed-size time window across the data stream. During each slide, the module extracts a time period from the continuous operation and maintenance data stream based on the current position of the window, forming an operation and maintenance scenario instance. Crucially, each slide does not completely skip the previous window, but only moves forward by a step size smaller than the window length, thus ensuring a certain degree of time data overlap between the newly generated operation and maintenance scenario instance and the previous instance. This overlap mechanism ensures that the evolution of operation and maintenance data can be continuously captured in the time dimension, avoiding the truncation or omission of key anomaly information due to window boundary division. For example, a precursor to a fault might occur at the boundary of two fixed windows. If the windows do not overlap, the precursor might be segmented into incomplete fragments, making it difficult to identify. However, by overlapping, the precursor information will appear completely in at least one or two overlapping windows. This provides a more complete and context-sensitive input for subsequent pre-trained embedding models to transform text data into corresponding text feature vectors and for dynamic context building modules. This approach enables the system to more comprehensively perceive subtle changes and abnormal evolution trends in the system state, providing high-quality input for the large language model's inference module, thereby improving the accuracy and robustness of fault prediction.

[0038] In a preferred embodiment of the present invention, the dynamic context construction module includes: The real-time status coding unit aims to extract and encode preprocessed and vectorized operational data within the current time window into a concise and informative summary of the current system status. Its role is to provide an accurate, real-time baseline of system operation for subsequent fault analysis. Implementation methods can include: employing attention-based neural network models, such as the Transformer encoder, to extract and compress features from the vectorized operational data, generating a fixed-length vector as the status summary; or utilizing dimensionality reduction techniques such as Principal Component Analysis (PCA) or autoencoders to map the high-dimensional vectorized representation to a low-dimensional space, thereby forming a summary information that represents the current system status.

[0039] The similarity fault retrieval unit is used to find and extract the most similar historical fault information to the current system state from a pre-built historical fault case library based on the current system state summary. Its core purpose is to transform past fault handling experience into referable knowledge, assisting the large language model in fault judgment and root cause inference. Implementation methods can include: using efficient vector retrieval libraries such as Faiss to perform fast cosine similarity retrieval on pre-computed and stored vectors in the historical fault case library to obtain the fault segment with the highest similarity and its root cause; or constructing an approximate nearest neighbor search algorithm based on a tree structure to index the historical fault case library, thereby achieving fast and accurate similar fault retrieval in massive amounts of data.

[0040] The Change Impact Analysis unit is responsible for parsing change event data in the system and transforming it into descriptive text that may affect the system's state. Its role is to fill the cognitive gaps regarding human intervention factors in simple indicator analysis, providing more comprehensive contextual information for large language models, especially in the analysis of the correlation between faults and change events. Implementation methods can include: using a rule engine or expert knowledge base to perform pattern matching and semantic parsing on information such as the type, content, and time of change events, generating structured change impact description text. For example, identifying key information such as "database upgrade" and "configuration modification" and generating descriptions such as "database upgrade may cause performance fluctuations"; or using natural language processing techniques, such as text classification or sequence labeling models, to analyze change event logs, automatically extract key elements of the change, and combine them with preset templates to generate readable change impact description text.

[0041] The prompt word assembly unit integrates the current system status summary generated by the real-time status coding unit, historical fault fragments and their root causes obtained by the similar fault retrieval unit, and change impact description text generated by the change impact analysis unit, according to a preset instruction template, to form the final prompt context input to the large language model. Its function is to structure and semantically represent multi-source heterogeneous information, presenting it to the large language model in the most effective way, guiding it to perform accurate fault prediction and root cause inference. Implementation methods can include: defining a flexible template language that allows operations personnel or system administrators to configure different prompt word templates according to actual needs; for example, the template may contain placeholders, into which the prompt word assembly unit fills in the corresponding information; or, employing a semantic understanding-based assembly strategy, dynamically adjusting the position and weight of each part in the prompt context based on the importance or relevance of different information to optimize the understanding effect of the large language model.

[0042] The dynamic context construction module of this application aims to provide high-quality, multi-dimensional contextual information for the reasoning module of a large language model, overcoming the shortcomings of traditional methods in utilizing historical experience and analyzing change events. This module first uses a real-time state encoding unit to vectorize the current time window operation and maintenance data output by the data preprocessing and vectorization module, encoding it into a concise summary of the current system state. This summary captures the current operational characteristics of the system, laying the foundation for subsequent analysis. Subsequently, a similar fault retrieval unit uses this current system state summary as a query condition to perform efficient cosine similarity retrieval in a pre-built and stored historical fault case library containing vectorized historical fault fragments and their root causes. In this way, the system can quickly identify historical fault patterns similar to the current state and extract these valuable experiences (including fault fragments and root causes), providing valuable lessons for the large language model. Simultaneously, the change impact analysis unit independently parses change event data, generating descriptive text that may affect the system, thus incorporating the important human factor of common change operations in operation and maintenance into consideration. Finally, the prompt assembly unit structurally integrates the aforementioned real-time system status summary, relevant historical fault experience, and description text of change impacts according to a preset instruction template, forming a comprehensive and logical prompt context. This prompt context is then input into the large language model inference module, enabling the large language model to perform comprehensive analysis and inference based on multi-dimensional information such as the current system status, historical fault modes, and potential change impacts, thereby outputting more accurate and interpretable fault prediction results. Through this working mechanism, the solution of this application significantly enhances the depth of understanding and inference ability of the large language model in complex operation and maintenance scenarios, effectively solving the problems that it is difficult to fully utilize historical fault experience and lack deep correlation analysis of system change events by relying solely on simple vectorized representations.

[0043] In a preferred embodiment of the present invention, the large language model is a fine-tuned large language model, and the fine-tuning process includes: Obtain a training dataset containing historical operation and maintenance scenario instances and corresponding real fault labels; A parameter-efficient fine-tuning method is adopted, which fixes most of the original parameters of the model and only updates a small number of trainable parameters. With the optimization objective of minimizing the difference between the predicted fault type and the actual fault label, domain adaptation fine-tuning is completed.

[0044] In this embodiment, the fine-tuned large language model refers to a model adapted to a specific domain task through additional training, building upon a general large language model. General large language models are typically pre-trained on massive amounts of general text data, possessing powerful language understanding and generation capabilities, but may lack domain-specific expertise and reasoning patterns. Through fine-tuning, the model can learn and internalize domain-specific knowledge and fault patterns, thereby improving its predictive performance in that domain.

[0045] The acquisition of a training dataset containing historical operation and maintenance scenario instances and corresponding real-world fault labels refers to preparing specialized data for the fine-tuning process. Historical operation and maintenance scenario instances can be snapshots of system status collected from actual operation and maintenance environments within a specific time window, including combinations of various operation and maintenance data (such as logs, metrics, change events, etc.). Real-world fault labels are the actual fault types and root causes determined manually or through expert systems for these scenario instances. This dataset provides the model with a benchmark for learning specific logic and fault modes in the operation and maintenance domain.

[0046] The aforementioned parameter-efficient fine-tuning method, which fixes most of the original model parameters and updates only a small number of trainable parameters, means that during the fine-tuning process, the entire parameter set of the large language model is not retrained. Instead, a small number of additional parameters are introduced, or only the parameters of specific layers or modules in the model are updated. This method can effectively reduce computational resource consumption, shorten training time, and avoid overfitting problems that may occur when performing full parameter fine-tuning on small-scale domain data, while preserving the original general language understanding capabilities of the large language model.

[0047] The optimization objective of minimizing the difference between the predicted fault type and the actual fault label, to achieve domain adaptation fine-tuning, refers to defining a loss function during the fine-tuning training process to quantify the inconsistency between the model's predictions and the true labels. The model continuously adjusts its trainable parameters to minimize the value of this loss function. This optimization objective guides the model to learn how to accurately map operational scenario instances to the correct fault types and root causes, thereby achieving deep adaptation to the operational domain.

[0048] The proposed solution significantly enhances the professional capabilities of a large language model in predicting operational and maintenance (O&M) faults by performing targeted domain-specific fine-tuning on the large language model. Specifically, the multi-source O&M data acquisition module collects multi-source O&M data from the target O&M system in real time. After preprocessing and vectorization by the data preprocessing and vectorization module, the dynamic context construction module dynamically generates a prompt context based on these vectorized representations and historical fault cases. At this point, the large language model inference module inputs this prompt context into the fine-tuned large language model. Because this large language model has been domain-specifically adapted and fine-tuned, learning the logic and fault patterns of the O&M domain, it can more accurately understand the complex information in the prompt context, identify potential fault characteristics, and perform deep causal reasoning. This enables the model to output more accurate fault prediction results, including fault type, fault probability, and root cause inference chain. Finally, the early warning grading output module can output corresponding levels of early warning signals based on these high-precision prediction results, thereby effectively improving the accuracy and reliability of the entire intelligent early warning system for O&M faults.

[0049] In a preferred embodiment of the present invention, the fault prediction result includes fault type, fault occurrence probability, and root cause inference link.

[0050] In this embodiment, the large language model inference module deploys a large language model. Upon receiving the contextual prompts generated by the dynamic context building module, this large language model no longer simply outputs a simple anomaly signal or score. Instead, it is trained and optimized to generate richer and more structured information. First, the large language model can identify and output specific fault types, such as "network latency," "database connection timeout," or "memory leak," enabling operations personnel to quickly understand the nature of the anomaly. Second, the large language model also outputs the probability of the fault occurring, a quantitative indicator representing the likelihood of that fault type occurring in the current system state. This probability value provides operations personnel with a basis for decision-making, helping them assess risk levels and prioritize high-probability potential faults. Finally, and most importantly, the large language model can infer and output root cause inference chains. This means the model not only indicates what faults might occur but also attempts to explain why they occur and how the fault evolved from an initial trigger to its current state. For example, it might indicate that "recent configuration changes caused service A to fail to restart, which in turn affected the normal operation of dependent service B, ultimately manifesting as user access latency." In this way, the proposed solution elevates the output of the large language model inference module from a single anomaly detection result to multi-dimensional, interpretable fault diagnosis information. This multi-dimensional output, especially the root cause inference link, enables operations and maintenance personnel to intuitively understand the ins and outs of the fault, fundamentally solving the problem of insufficient depth and interpretability of early warning information in traditional methods. This not only improves the accuracy and practicality of fault early warning but also greatly shortens the time for fault troubleshooting and recovery, thereby improving the efficiency and stability of the entire operations and maintenance system.

[0051] In a preferred embodiment of the present invention, the early warning classification output module compares the probability of fault occurrence with multiple preset dynamic thresholds to determine and output an early warning signal of the corresponding level, and simultaneously outputs the root cause inference link; wherein, the dynamic thresholds are calculated according to the following formula: ; in Indicates the first The dynamic threshold corresponding to the Level 1 warning has a value range of [0, 1]. The arithmetic mean of the historical fault prediction probabilities output by the large language model inference module for the same fault type; The standard deviation of the predicted probability of the historical faults; For the first The preset coefficients corresponding to the level of early warning, and satisfying the following conditions. ; This represents the total number of warning levels. in , Both the probability of the fault occurrence and the probability of the fault occurrence are dimensionless probability values.

[0052] In this embodiment, the early warning grading output module receives the fault prediction results output by the large language model inference module, which includes the fault occurrence probability and root cause inference chain. Its core function is to compare the fault occurrence probability with a series of dynamically calculated thresholds to determine the severity of the current potential fault and output the corresponding early warning level. Simultaneously, to provide more comprehensive early warning information, this module outputs the early warning signal along with the corresponding root cause inference chain, enabling maintenance personnel to quickly understand the potential causes of the fault. This comparison and judgment process can be implemented by a dedicated decision logic unit, for example, by implementing conditional judgment statements through programming, or by configuring a rule engine.

[0053] The dynamic threshold calculation method aims to enable the warning threshold to be adaptively adjusted, wherein... The dynamic threshold corresponding to the i-th level warning is limited to the range [0, 1], ensuring its effectiveness. This dynamic calculation method makes the threshold no longer fixed but adjustable based on historical data, thus better adapting to changes in system operating status. This calculation can be implemented by a separate threshold calculation service or module, such as integrating a statistical analysis component within the warning classification output module, or by calling an external statistical calculation library.

[0054] This represents the historical average predicted probability of a specific fault type, serving as a benchmark for dynamic threshold calculation and reflecting the common occurrence probability level of that fault type in the system. This average value can be obtained by statistically analyzing historical data; for example, the system can maintain a historical fault prediction probability database and periodically calculate the average probability of various fault types.

[0055] It measures the degree of fluctuation or dispersion of historical predicted probabilities for a specific fault type, and together with μ, provides a statistical basis for the dynamic threshold, enabling it to reflect the statistical distribution characteristics of fault occurrence. The calculation of this standard deviation can be combined with... The calculations are performed simultaneously, for example, by maintaining historical data and applying standard statistical formulas.

[0056] These are weighting coefficients set for different warning levels, determining the offset of each level's threshold relative to the average value, based on μ and σ. By setting... This ensures that as the warning level increases, the corresponding threshold also increases, thus achieving a progressively higher level of warning. These coefficients can be manually configured based on operational experience, business importance, or risk tolerance, or they can be optimized and adjusted using machine learning methods.

[0057] This represents the total number of warning levels defined in the system, typically determined during system initialization or configuration. It includes all relevant probability values, including... , Both the probability of failure and the probability of occurrence are dimensionless probability values ​​between 0 and 1, ensuring the correctness and consistency of the formula calculation.

[0058] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A smart early warning system for operation and maintenance faults based on a large language model, characterized in that, include: The multi-source operation and maintenance data acquisition module is used to collect multi-source operation and maintenance data of the target operation and maintenance system in real time; The data preprocessing and vectorization module is connected to the multi-source operation and maintenance data acquisition module and is used to preprocess the multi-source operation and maintenance data and convert it into a vectorized representation. A dynamic context construction module, connected to the data preprocessing and vectorization module, is used to dynamically generate a prompt context based on the vectorized representation and historical fault cases. The large language model reasoning module, which is equipped with a large language model and connected to the dynamic context construction module, is used to input the prompting context into the large language model to obtain the fault prediction result. The early warning level output module is connected to the large language model inference module and is used to output early warning signals of the corresponding level based on the fault prediction results.

2. The system according to claim 1, characterized in that, The multi-source operation and maintenance data includes at least log data, time-series indicator data, and change event data.

3. The system according to claim 1, characterized in that, The data preprocessing and vectorization module is specifically used for: The multi-source operation and maintenance data is subjected to structured cleaning, time alignment, and outlier processing. The processed data is sliced ​​into operation and maintenance scenario instances according to time windows; The text data in each operation and maintenance scenario instance is transformed into a corresponding text feature vector using a pre-trained embedding model.

4. The system according to claim 3, characterized in that, The data preprocessing and vectorization module uses a sliding window mechanism to slice the data into time windows, and there is some data overlap between adjacent time windows.

5. The system according to claim 1, characterized in that, The dynamic context construction module includes: The real-time status encoding unit is used to encode the vectorized representation of the operation and maintenance data corresponding to the current time window into a summary of the current system status. The similarity fault retrieval unit is used to perform cosine similarity retrieval in the historical fault case library using the current system state summary as the query condition, and to obtain the historical fault segment with the highest similarity and its root cause; wherein, each fault segment and its root cause in the historical fault case library is pre-calculated and stored by the pre-trained embedding model. The Change Impact Analysis unit is used to parse change event data and generate change impact description text. The prompt word assembly unit is used to assemble the current system status summary, the historical fault fragments and their root causes, and the change impact description text into the prompt context according to a preset instruction template.

6. The system according to claim 1, characterized in that, The large language model is a fine-tuned large language model, and the fine-tuning process includes: Obtain a training dataset containing historical operation and maintenance scenario instances and corresponding real fault labels; A parameter-efficient fine-tuning method is adopted, which fixes most of the original parameters of the model and only updates a small number of trainable parameters. With the optimization objective of minimizing the difference between the predicted fault type and the actual fault label, domain adaptation fine-tuning is completed.

7. The system according to claim 1, characterized in that, The fault prediction results include fault type, fault occurrence probability, and root cause inference link.

8. The system according to claim 7, characterized in that, The early warning classification output module compares the probability of fault occurrence with multiple preset dynamic thresholds to determine and output an early warning signal of the corresponding level, and simultaneously outputs the root cause inference link; wherein, the dynamic thresholds are calculated according to the following formula: First, calculate the average value of the historical fault prediction probability for the same fault type. Then, add this value to the value obtained by multiplying the preset coefficient by the standard deviation of the historical fault prediction probability. Finally, limit the sum to the range of 0 to 1 to obtain the dynamic threshold of the corresponding level.

Images