Alarm Information Processing Methods and Systems

Abstract

This invention provides an alarm information processing method and system. The method includes: performing feature semantic aggregation on standardized multi-source alarm data of a target operation and maintenance environment to obtain target event clusters; constructing an event context graph corresponding to the target event clusters based on the configuration association information between the target event clusters and the target operation and maintenance environment; retrieving target knowledge fragments associated with the event context graph in an operation and maintenance knowledge base to obtain a knowledge-enhanced input set; inputting the event context graph and the knowledge-enhanced input set into a pre-trained inference model to obtain structured inference results; and generating structured work order data corresponding to the target event clusters based on the structured inference results. This invention achieves global context semantic association of multi-source alarm data, dynamic causal inference based on knowledge enhancement, and automated generation of structured work orders, so as to efficiently provide more reliable and interpretable structured root cause inference and disposal dispatch results in complex operation and maintenance scenarios.

Description

Technical Field

[0001] This invention relates to the field of operation and maintenance management technology, and in particular to an alarm information processing method and system. Background Technology

[0002] With the continuous expansion of the scale of operating environments such as data centers and cloud platforms and the increasing complexity of system architectures, accurate root cause inference of massive multi-source alarm information and automatic generation of effective handling strategies have become the key to ensuring the safe and stable operation of operation and maintenance systems.

[0003] Existing technologies typically rely on manually setting static thresholds or using single-dimensional matching tools to identify anomalies in multi-source alarm data in order to achieve operational and maintenance management of system failure risks.

[0004] However, when faced with complex and dynamic system topology dependencies and massive concurrent data, the fixed processing logic of this technology makes it difficult to efficiently provide reliable and interpretable structured root cause inference and disposal results in complex operation and maintenance scenarios. Summary of the Invention

[0005] This invention provides an alarm information processing method and system to address the shortcomings of existing technologies in efficiently providing reliable and interpretable structured root cause inference and disposal results in complex operation and maintenance scenarios. It achieves global contextual semantic association of multi-source alarm data, dynamic causal reasoning based on knowledge enhancement, and automated generation of structured work orders, so as to efficiently provide more reliable and interpretable structured root cause inference and disposal results in complex operation and maintenance scenarios.

[0006] This invention provides an alarm information processing method, comprising: Acquire standardized multi-source alarm data for the target operation and maintenance environment; The multi-source alarm data is subjected to feature semantic aggregation to obtain target event clusters. Based on the configuration association information of the target event clusters and the target operation and maintenance environment, an event context graph corresponding to the target event clusters is constructed. In the operation and maintenance knowledge base, target knowledge fragments associated with the event context graph are retrieved to obtain a knowledge enhancement input set; The event context graph and the knowledge-enhanced input set are input into a pre-trained inference model to obtain the structured inference results corresponding to the target event cluster; the structured inference results include root cause explanation information, evidence link information, and processing recommendation information. Based on the structured reasoning results, structured process data corresponding to the target event cluster is generated.

[0007] According to an alarm information processing method provided by the present invention, the step of retrieving target knowledge fragments associated with the event context graph in the operation and maintenance knowledge base to obtain a knowledge enhancement input set includes: Based on the event context graph, obtain graph semantic features; Based on the graph semantic features, as well as the device model features, firmware version features, and alarm tag features corresponding to the target event cluster, at least one target knowledge fragment is retrieved from the operation and maintenance knowledge base; By combining all the target knowledge fragments, the knowledge-enhanced input set is constructed.

[0008] According to an alarm information processing method provided by the present invention, the step of retrieving at least one target knowledge fragment from the operation and maintenance knowledge base based on the graph semantic features, and the device model features, firmware version features, and alarm tag features corresponding to the target event cluster includes: Calculate the semantic relevance between each candidate document in the operation and maintenance knowledge base and the graph semantic features, and determine at least one target document in the operation and maintenance knowledge base based on the semantic relevance. Extract knowledge fragments from each of the target documents and construct a candidate knowledge fragment set; Based on the device model characteristics, the firmware version characteristics, and the alarm tag characteristics, calculate the matching weight between each candidate knowledge fragment in the candidate knowledge fragment set and the event context graph; The candidate knowledge fragments are sorted according to the matching weights. Based on the sorting results, at least one of the target knowledge fragments is selected from the set of candidate knowledge fragments.

[0009] According to the alarm information processing method provided by the present invention, the step of inputting the event context graph and the knowledge-enhanced input set into a pre-trained inference model to obtain the structured inference result corresponding to the target event cluster includes: Determine the target instruction template based on the event type corresponding to the target event cluster; The event context graph and the knowledge-enhanced input set are filled into the target instruction template to obtain the target prompt information; The target prompt information is input into the pre-trained inference model to obtain the structured inference result.

[0010] According to an alarm information processing method provided by the present invention, the step of inputting the target prompt information into the pre-trained inference model to obtain the structured inference result includes: The target prompt information is input into the pre-trained inference model to obtain multiple candidate inference schemes; the multiple candidate inference schemes are obtained by the pre-trained inference model classifying the event type of the target event cluster according to the target prompt information, and constructing multiple causal links according to the event type and the target prompt information; Based on the configuration association information and each target case data, multiple candidate reasoning schemes are logically consistent and filtered to obtain a target reasoning scheme; the target case data is historical case data that matches the event type. The structured reasoning result is generated based on the target reasoning scheme and the intermediate semantic link records generated during the construction of the causal link by the pre-trained reasoning model.

[0011] According to an alarm information processing method provided by the present invention, the step of generating structured work order data corresponding to the target event cluster based on the structured reasoning result includes: Using a policy-based intelligent agent, the disposal recommendation information in the structured reasoning results is scripted and its executableness is verified to obtain standard disposal step information; Using a service response agent, the target event cluster is evaluated based on its event severity and business importance characteristics to obtain the target response level and completion time limit information. Using a task scheduling agent, the responsible team information and approval process information corresponding to the target event cluster are mapped and obtained based on the organizational structure information of the target operation and maintenance environment. Based on the event type of the target event cluster, load the target work order template from the work order template library; Based on the structured reasoning results, the standard handling steps, the target response level, the completion time limit, the responsible team information, and the approval process information, the target work order template is updated to obtain the structured work order data.

[0012] According to an alarm information processing method provided by the present invention, the step of performing feature semantic aggregation on the multi-source alarm data to obtain a target event cluster includes: Obtain the semantic similarity between the alarm text features of each alarm data in the multi-source alarm data, the index similarity between the index sequence features of each alarm data, and the shortest path distance between the device nodes corresponding to each alarm data; The semantic similarity, the index similarity, and the shortest path distance are weighted and fused to obtain the aggregate confidence score among the alarm data. Based on the aggregated confidence level, the multi-source alarm data is aggregated to obtain the target event cluster.

[0013] According to an alarm information processing method provided by the present invention, after generating the structured process order data corresponding to the target event cluster, the method further includes: Extract disposal instructions from the structured chemical single data; If the disposal instruction matches any operation command in the command whitelist, and the trigger time corresponding to the disposal instruction is within the operation authorization time window, then according to the configuration association information, a topological impact simulation is performed on the disposal instruction to obtain the predicted impact range data. If the predicted impact range data is less than or equal to the operation impact safety threshold, then the execution status of the structured chemical order data is configured to automatic approval status; If the predicted impact range data is greater than the operation impact safety threshold, then the execution status of the structured chemical order data will be configured to manual approval status.

[0014] According to an alarm information processing method provided by the present invention, after generating the structured process order data corresponding to the target event cluster, the method further includes: Obtain target feedback data generated after performing maintenance operations on the structured work order data; the target feedback data includes work order execution results, manual feedback information, and service level achievement rate. Based on the target feedback data, the inference performance parameters corresponding to the structured chemical order data are obtained; the inference performance parameters include inference accuracy parameters, confidence bias parameters, and treatment effectiveness parameters. Based on the inference performance parameters, the target parameters and / or the operation and maintenance knowledge base are updated; the target parameters include the parameters of the instruction template of the pre-trained inference model, the retrieval matching weights of the operation and maintenance knowledge base, and the policy parameters of each agent performing the structured chemical order data generation operation.

[0015] The present invention also provides an alarm information processing system, comprising: The data access unit is used to acquire standardized multi-source alarm data of the target operation and maintenance environment; The context modeling unit is used to perform feature semantic aggregation on the multi-source alarm data to obtain target event clusters, and to construct an event context graph corresponding to the target event clusters based on the configuration association information of the target event clusters and the target operation and maintenance environment. The knowledge enhancement unit is used to retrieve target knowledge fragments associated with the event context graph in the operation and maintenance knowledge base to obtain a knowledge enhancement input set; A semantic reasoning unit is used to input the event context graph and the knowledge-enhanced input set into a pre-trained reasoning model to obtain a structured reasoning result corresponding to the target event cluster; the structured reasoning result includes root cause explanation information, evidence link information, and processing recommendation information; The decision generation unit is used to generate structured document data corresponding to the target event cluster based on the structured reasoning results.

[0016] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the alarm information processing method as described above.

[0017] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the alarm information processing method as described above.

[0018] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the alarm information processing method as described above.

[0019] The alarm information processing method and system provided by this invention firstly acquires standardized multi-source alarm data and constructs an event context graph by combining it with configuration information. This breaks down heterogeneous data barriers and effectively eliminates alarm storms, achieving deep event perception based on global topology and temporal correlation. Secondly, by retrieving the operation and maintenance knowledge base to construct a knowledge-enhanced input set, authoritative domain experience is provided to the model in real time, effectively overcoming the problem of fact illusion in large models in vertical scenarios. Subsequently, the context graph and enhanced knowledge are jointly input into the pre-trained inference model, abandoning traditional static matching rules and achieving highly transparent and traceable cross-system dynamic causal inference, accurately identifying the root cause of underlying faults and evidence links. Finally, structured work order data is automatically generated based on the structured inference results, seamlessly transforming natural language conclusions into standardized and executable operation and maintenance dispatch tasks. This method completely establishes an intelligent closed loop across the entire chain, from massive alarm noise reduction and parsing to automatic work order dispatch, significantly improving fault response speed, decision accuracy, and knowledge reuse efficiency in complex operation and maintenance environments. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0021] Figure 1 This is one of the flowcharts illustrating the alarm information processing method provided by the present invention.

[0022] Figure 2 This is the second flowchart of the alarm information processing method provided by the present invention.

[0023] Figure 3 This is a schematic diagram of the alarm information processing system provided by the present invention.

[0024] Figure 4 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0025] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0026] All actions involving the acquisition of signal information or data in this application are carried out in accordance with the relevant data protection laws and policies of the country where the application is located, and with the authorization granted by the owner of the relevant device.

[0027] With the rapid development of cloud computing, edge computing, and large data centers, the scale and complexity of information technology (IT) systems are growing exponentially. Operations personnel must handle tens of thousands of alerts daily from monitoring, logs, performance metrics, and security systems. Accurate semantic understanding, root cause inference, and automatic generation of effective action orders for massive amounts of multi-source alerts have become crucial for ensuring the safe and stable operation of IT systems.

[0028] However, in existing technologies, operation and maintenance alarm handling still mainly relies on human experience or analysis tools based on static threshold rules and keyword matching algorithms. Current intelligent alarm solutions mostly focus on alarm clustering and rule optimization, lacking contextual semantic understanding and cross-system causal reasoning capabilities, making it difficult to infer alarm causes based on historical work orders, change records, and topological dependencies. Meanwhile, existing work order systems mostly rely on manual input and experience-based judgment, resulting in long processing cycles, susceptibility to human error, and difficulty in knowledge accumulation and reuse. This leads to problems such as alarm storms, duplicate reporting, and priority errors in multi-dimensional dynamic environments, making it difficult to accurately identify the root cause and scope of impact of alarms.

[0029] In recent years, Large Language Models (LLMs) have demonstrated powerful reasoning and generative capabilities in natural language understanding and knowledge extraction. However, general-purpose models suffer from issues such as knowledge mismatch, insufficient interpretability, and uncontrollable security in operational scenarios. Directly applying them to alarm processing can lead to unstable decision outputs. Therefore, there is an urgent need for an intelligent alarm interpretation and work order generation technology that combines domain-specific large models, knowledge retrieval-augmented generation (RAG), and policy constraint mechanisms to achieve end-to-end intelligent processing from semantic recognition and causal analysis to task dispatch in complex operational environments.

[0030] To address these shortcomings, such as insufficient semantic understanding of alarms, low efficiency of manual analysis, difficulty in knowledge reuse, and uninterpretable results in existing technologies, this application provides an alarm information processing method. This method can perform feature semantic aggregation on multi-source alarm data, automatically identify and reduce noise to extract target event clusters; integrate multi-source operation and maintenance knowledge, and construct an event context graph based on the configuration association information of the target operation and maintenance environment; use a retrieval enhancement mechanism to retrieve real historical documents and experience fragments from the operation and maintenance knowledge base as knowledge enhancement input; combine the event context graph and enhanced knowledge, perform causal inference based on a pre-trained inference model, and output a structured inference result containing root cause explanation, evidence chain, and processing recommendation information; and automatically generate structured work order data with operation steps, root cause description, scope of impact, handling instructions, Service Level Agreement (SLA) time limits, rollback strategies, and handling priorities based on the structured inference result. Thus, by deeply integrating natural language semantic understanding, graph-based context modeling, retrieval-enhanced knowledge fusion, and causal reasoning technologies, a fully automated closed-loop process is achieved from multi-source heterogeneous alarm input to structured work order dispatch. This enables intelligent prediction and visual explanation of potential root causes when alarms occur, and provides precise and actionable work order handling guidance, significantly reducing the cost of manual analysis and work order preparation, and significantly improving the fault response speed, automation level, and knowledge reuse efficiency of the operation and maintenance system.

[0031] Figure 1 This is one of the flowcharts illustrating the alarm information processing method provided by the present invention; Figure 2 This is the second flowchart of the alarm information processing method provided by the present invention.

[0032] The main implementing body of this method is the alarm information processing system (hereinafter referred to as the system). This method is primarily applied to intelligent operation and maintenance scenarios in complex IT system environments, particularly addressing the needs for multi-source alarm semantic understanding, causal reasoning, and automated work order generation in data centers, cloud platforms, network infrastructure, and enterprise-level IT operation and maintenance automation scenarios. It provides end-to-end intelligent root cause explanation and explainable closed-loop guidance for handling alarms after they are received. For example... Figure 1 As shown, the method includes the following steps: Step 110: Obtain standardized multi-source alarm data for the target operation and maintenance environment.

[0033] like Figure 2 As shown, before performing intelligent operation and maintenance alarm understanding and work order generation, the alarm information processing system's pre-built data access layer (also known as the data access unit) needs to collect alarm data from different sources in real time from the complex operation and maintenance environment and perform unified standardized processing to eliminate barriers between heterogeneous data. This data access layer supports multiple protocol inputs, such as Hypertext Transfer Protocol (HTTP), Kafka, Message Queuing Telemetry Transport (MQTT), and Syslog, etc., which are not specifically limited in this embodiment.

[0034] Specifically, the data access layer can collect raw alarm data from multiple different maintenance endpoints in real time through different protocols, resulting in multi-source raw alarm data. The target operation and maintenance environment here refers to the underlying hardware and software operating environment and network infrastructure upon which cloud computing platforms, edge computing nodes, large data centers, or enterprise applications rely. Multi-source raw alarm data refers to unstructured or semi-structured alarm event streams from multiple protocols input from different monitoring tools, logging systems, performance indicator platforms, and security devices, including but not limited to monitoring alarms, log events, indicator sequences, change records, and sensor data.

[0035] Because the aforementioned multi-source raw alarm data is characterized by its heterogeneity, inconsistent formats, and frequent alarm storms, direct processing can easily lead to excessive load and difficulty in identifying the true intent. Therefore, it is necessary to perform standardization processing on the collected multi-source raw alarm data. This standardization process includes data cleaning, timestamp correction, and unique event identifier assignment. By standardizing the data formats of different platforms through a unified data model, various metrics, logs, and events are transformed into unified structured alarm objects. During this process, the system can also perform data anonymization, field mapping, and tag normalization operations, enabling metrics from different vendors such as CPUs, disks, and networks to be uniformly identified within the system.

[0036] In addition, dynamic clustering algorithms can be used to identify duplicate or noisy alarms. Duplicate reports can be merged and compressed through a joint judgment mechanism based on the same source, time window, and similar content, ensuring that downstream processing only receives high-confidence data.

[0037] Through the above collection and standardization process, the originally isolated and complex raw alarm data is transformed into a high-quality, computer-readable, standardized data stream, which yields standardized multi-source alarm data, providing a highly consistent input foundation for subsequent context modeling and semantic reasoning.

[0038] Step 120: Perform feature semantic aggregation on the multi-source alarm data to obtain target event clusters. Based on the configuration association information of the target event clusters and the target operation and maintenance environment, construct the event context graph corresponding to the target event clusters.

[0039] Optionally, after obtaining a standardized, high-quality alarm data stream, the process proceeds to the multi-source alarm aggregation and context building stage to restore the global semantic association of alarm events in the real topology.

[0040] Specifically, an event merging engine is used to perform feature semantic aggregation on multi-source alarm data. In this process, alarms originating from the same device, the same service, or the same link within the same time window can be dynamically clustered through multi-dimensional feature matching at both the semantic and topological levels, thereby aggregating them into target event clusters. These target event clusters represent a set of alarm events with highly intrinsic correlations.

[0041] For example, the specific process of performing semantic and topological aggregation on the aforementioned multi-source alarm data, in order to overcome the omissions that are easily caused by single-dimensional clustering, in one possible implementation, involves performing feature semantic aggregation on the multi-source alarm data to obtain target event clusters, including: Obtain the semantic similarity between the alarm text features of each alarm data in the multi-source alarm data, the index similarity between the index sequence features of each alarm data, and the shortest path distance between the device nodes corresponding to each alarm data; The semantic similarity, the index similarity, and the shortest path distance are weighted and fused to obtain the aggregate confidence score among the alarm data. Based on the aggregated confidence level, the multi-source alarm data is aggregated to obtain the target event cluster.

[0042] Optionally, the alarm text portion of each incoming alarm data is first extracted and mapped to alarm text features. Semantic similarity, such as cosine similarity, is then calculated between the alarm text features of each alarm data. Furthermore, a similarity algorithm, such as Dynamic Time Warping (DTW), is used to calculate the matching score between the indicator sequence features of each alarm data to obtain the corresponding indicator similarity. Simultaneously, based on the topology map of the business system corresponding to the target operation and maintenance environment, the shortest path distance between the device nodes corresponding to each alarm data is obtained.

[0043] Subsequently, a weighted fusion calculation was performed on semantic similarity, indicator similarity, and shortest path distance to obtain the aggregate confidence level among the alarm data.

[0044] After calculating the aggregate confidence of each pair of alarm data, a confidence threshold is set. Multiple batches of alarm data with an aggregate confidence higher than the threshold are identified as having a strong homogeneous relationship and are merged and aggregated, thereby generating and defining the target event cluster.

[0045] Here, by combining deep learning text representation similarity, temporal curve alignment, and graph theory topological distance, a multi-dimensional feature cross-checking mechanism is implemented, achieving a much higher convergence rate and aggregation accuracy than traditional keyword filtering when dealing with alarm storms, which can significantly reduce the analysis load of upper-layer models.

[0046] Subsequently, using graph modeling methods, an event context graph is constructed by combining target event clusters and configuration association information.

[0047] Specifically, firstly, based on the configuration association information of the target operation and maintenance environment, the underlying infrastructure topology is established. Specifically, using graph modeling methods, the objectively existing architectural elements recorded in the configuration association information, such as devices, services, network nodes, and business components, are extracted and mapped as node entities. The dependencies, service call relationships, and logical influence relationships between these entities are then mapped as edge relationships, thereby constructing the infrastructure topology of the target operation and maintenance environment.

[0048] Subsequently, the target event cluster is deeply integrated into the infrastructure topology, thereby generating a dynamic topology semantic graph. In practice, the various interrelated alarm events contained in the target event cluster can be accurately attached or mapped to node entities in the infrastructure topology, so as to transform the infrastructure topology graph into a contextual relationship graph with dynamic fault state representation.

[0049] Furthermore, based on the directed edge relationships and the spatiotemporal distribution of abnormal nodes in the topological semantic graph, the critical path and propagation chain of this fault are automatically identified. For example, it can intuitively identify a complete fault propagation chain spanning from the physical layer to the business layer, such as "power module failure -> server restart -> virtual machine offline -> service response timeout," along the topological edge relationships.

[0050] Furthermore, each event node in this topological semantic graph is accompanied and encapsulated with corresponding multimodal attributes. These multimodal attributes specifically include information such as indicator sequences, log text, and screenshot features extracted from the original alarm data. Through the concatenation of the above graph structure and the attachment of multimodal features, a rich, structured context is formed that can be directly read and deeply understood by subsequent pre-trained inference models, thus ultimately constructing an event context graph. Therefore, by cleverly mapping dynamically clustered event clusters to a static architectural topology generated from configuration information, the real-world scenario of the fault occurrence is accurately reconstructed. This context aggregation step not only fully preserves the semantic continuity of alarm data in its spatiotemporal evolution but also provides indispensable key correlation information for large-scale models to perform causal inference and knowledge enhancement in subsequent steps, thereby achieving semantic unification from isolated alarms at the lower level to a global event perspective.

[0051] Step 130: In the operation and maintenance knowledge base, retrieve the target knowledge fragments associated with the event context graph to obtain the knowledge enhancement input set.

[0052] Optionally, after completing the event context construction, the knowledge retrieval and dynamic enhancement stage can be entered, which is used to match the most relevant domain knowledge for the target event cluster.

[0053] Specifically, the event context graph is first vectorized to obtain graph semantic features. These features are then input into a vector retrieval engine, where a similarity search is performed in a pre-built operations and maintenance knowledge base to obtain target knowledge fragments associated with the event context graph. This process then constructs a knowledge-enhanced input set. The operations and maintenance knowledge base here refers to a pre-built and continuously updated enterprise-level multimodal knowledge data center, whose content extensively covers multi-dimensional data assets such as equipment operation manuals, standard operating procedures (SOP) documents, established change policies, official vendor risk announcements, verified historical work orders, and expert experience summaries.

[0054] The knowledge-enhanced input set here is a core prompting context built on the Retrieval-Augmented Generation (RAG) mechanism, which enables subsequent artificial intelligence models to not only rely on their own inherent parameter weights when understanding alerts, but also to call external real and reliable domain documents in real time.

[0055] Here, by introducing a retrieval-enhanced generation mechanism to dynamically add external knowledge from the operation and maintenance domain, the problem of knowledge mismatch and factual illusion in general artificial intelligence models in vertical operation and maintenance scenarios is effectively solved. This enables the large model to make decisions based on real and verifiable historical evidence, which greatly improves the reliability of root cause analysis and the feasibility of the solutions.

[0056] For example, in order to provide a multi-feature clue mechanism with fine-grained and accurate matching during the knowledge retrieval stage, in one possible implementation, the step of retrieving target knowledge fragments associated with the event context graph in the operation and maintenance knowledge base to obtain a knowledge-enhanced input set includes: Based on the event context graph, obtain graph semantic features; based on the graph semantic features, as well as the device model features, firmware version features, and alarm tag features corresponding to the target event cluster, retrieve at least one target knowledge fragment from the operation and maintenance knowledge base; combine all the target knowledge fragments to construct the knowledge enhancement input set.

[0057] Optionally, firstly, a graph neural network algorithm is used to jointly encode and extract the structure and node attributes of the event context graph generated above, obtaining the corresponding dimensionality-reduced high-density dense vector, i.e., graph semantic features. Next, the basic metadata of the target event cluster is extracted simultaneously, specifically including the device model features, running system firmware version features, and pre-classified alarm tag features of its underlying dependent entities. Then, the graph semantic features, along with the device model features, firmware version features, and alarm tag features, are combined to perform a multi-dimensional feature hybrid retrieval in the operation and maintenance knowledge base to lock in at least one target knowledge fragment that best meets the conditions. Finally, all the extracted target knowledge fragments are merged to construct the final knowledge-enhanced input set. This hybrid retrieval can involve fusing multi-dimensional features to obtain a comprehensive feature, then using the comprehensive feature as an index to perform a global similarity calculation in the operation and maintenance knowledge base to retrieve the target knowledge fragment; or, according to the retrieval priority of different features, performing a multi-level cascaded distributed retrieval in the operation and maintenance knowledge base, etc. This embodiment does not specifically limit this approach.

[0058] The method provided in this embodiment combines the semantic features of the deep topology graph with shallow, intuitive metadata features such as device model, firmware version, and alarm tags to perform multi-dimensional hybrid constraint retrieval in the operation and maintenance knowledge base. This effectively avoids the risk of cross-environment or cross-model knowledge mismatch caused by relying solely on semantic generalization. This mechanism ensures that the extracted knowledge fragments are not only highly semantically related to the current alarm, but also accurately match the target specific node in terms of physical and software environment. This provides a reliable context with domain knowledge constraints and semantic completion capabilities for the pre-trained inference model, significantly improving the reliability and accuracy of subsequent root cause inference and handling suggestions.

[0059] For example, in order to achieve accurate quantitative ranking of the knowledge retrieval process under multiple feature constraints, in one possible implementation, the step of retrieving at least one target knowledge fragment from the operation and maintenance knowledge base based on the graph semantic features, as well as the device model features, firmware version features, and alarm tag features corresponding to the target event cluster, includes: Calculate the semantic relevance between each candidate document in the operation and maintenance knowledge base and the graph semantic features, and determine at least one target document in the operation and maintenance knowledge base based on the semantic relevance; extract knowledge fragments from each target document to construct a candidate knowledge fragment set; calculate the matching weight between each candidate knowledge fragment in the candidate knowledge fragment set and the event context graph based on the device model features, firmware version features, and alarm tag features; sort each candidate knowledge fragment according to the matching weight; and select at least one target knowledge fragment from the candidate knowledge fragment set based on the sorting result.

[0060] Optionally, the retrieval process includes an initial screening and re-ranking mechanism. Specifically, firstly, similarity calculation is performed on the embedded vectors of the graph semantic features and the massive number of candidate documents in the operation and maintenance knowledge base to assess the semantic relevance between them, and documents with semantic relevance greater than the screening threshold are selected as the initial target documents. Next, the text of the established target documents is segmented into paragraphs to construct a high-density set of candidate knowledge fragments. Then, the process moves to the metadata deep verification and weighting stage, calculating the matching degree between each candidate knowledge fragment and the actual device model features, firmware version features, and alarm tag features, and weighting and fusing the matching degrees corresponding to each feature to obtain the matching weight corresponding to each candidate knowledge fragment. Then, according to the matching weight, the candidate knowledge fragments are sorted in descending order. Finally, based on the ranking results, the top K knowledge fragments are selected as the final target knowledge fragments. Here, K can be configured according to actual needs, such as K being 3, 4, or 5, etc.

[0061] The method provided in this embodiment first completes the initial screening of candidate documents through vector semantic relevance calculation. Then, it superimposes strong constraints such as device model, firmware version and alarm tags to perform matching weight calculation and re-ranking verification. This hybrid screening strategy can accurately remove semantically similar but environmentally mismatched interference information, effectively ensuring the authority and fine-grained applicability of the external documents finally sent to the pre-trained inference model. It significantly eliminates the knowledge mismatch and illusion problems that the pre-trained inference model often faces when dealing with vertical professional operation and maintenance scenarios from the source of data input, and significantly improves the security and executability of the final generated work order handling solution.

[0062] Step 140: Input the event context graph and the knowledge enhancement input set into the pre-trained inference model to obtain the structured inference results corresponding to the target event cluster; the structured inference results include root cause explanation information, evidence link information and processing recommendation information.

[0063] Optionally, after obtaining an event context graph that integrates global topological physical dependencies and a knowledge-enhanced input set supported by professional domain knowledge, deep semantic understanding and causal reasoning of the target event cluster can be further performed.

[0064] Specifically, the event context graph and its matching knowledge-enhanced input set are merged and encapsulated, and then fed into the pre-trained inference model. This pre-trained inference model (also known as the large model) specifically refers to a large-scale operations knowledge model (Ops-LLM) built upon existing large language models. It utilizes massive amounts of IT operations log analysis examples, anonymized configuration scripts, and specialized operations corpora such as technical standard manuals to perform instruction fine-tuning and domain knowledge alignment. Leveraging the model's powerful natural language understanding and generalization capabilities, the model assesses the ripple effects of upstream and downstream resource topology changes and performs a comprehensive analysis in conjunction with historical response experiences from the knowledge-enhanced input set.

[0065] Through deep semantic inference of the model, the final output is a structured inference result corresponding to the target event cluster. This structured inference result not only provides the location information and logical basis of the final source point that triggered the alarm (i.e., root cause explanation information), but also carries the ripple verification and derivation records found in the graph operation (i.e., evidence chain information), and outputs operational guidance-based processing recommendations converted from knowledge fragments and experiences. Thus, it achieves cross-system causal inference capabilities that surpass the threshold of traditional static rules, and forces the model to output structured results containing root causes, evidence chains, and handling suggestions, ensuring a high degree of interpretability and traceability of the analysis and judgment results.

[0066] For example, to standardize the boundary constraints of input received by large models and optimize their inference context, in one possible implementation, the step of inputting the event context graph and the knowledge-enhanced input set into a pre-trained inference model to obtain the structured inference result corresponding to the target event cluster includes: Based on the event type corresponding to the target event cluster, a target instruction template is determined; the event context graph and the knowledge enhancement input set are filled into the target instruction template to obtain target prompt information; the target prompt information is input into the pre-trained inference model to obtain the structured inference result.

[0067] Optionally, the event type corresponding to the target event cluster is first identified; the event type includes specific event types such as performance bottleneck, storage anomaly, or environmental storm.

[0068] Then, based on the event type, the target instruction template for guiding the model role and output framework is dynamically loaded and determined. Next, the event context information or content summary corresponding to the event context graph, along with the knowledge-enhanced input set, is populated into the target instruction template to obtain target prompt information. Finally, this target prompt information is used to trigger the pre-trained inference model to perform forward evolutionary inference, outputting structured inference results to provide a clear decision-making basis for work order generation.

[0069] Here, by dynamically matching and loading corresponding target instruction templates based on the specific fault event type, and by normalizing and filling the event context graph containing the global topology with the knowledge-enhanced input set of external experience, the inference context boundary received by the pre-trained inference model is effectively optimized. This significantly reduces the error rate and information omission risk in instruction understanding when the large language model handles complex operational contexts. Simultaneously, it ensures that the final output inference results strictly adhere to the preset structural constraint framework, providing a highly stable, uniformly formatted, and machine-readable decision input source for the subsequent automated breakdown and dispatch of work orders.

[0070] Further, in one possible implementation, the step of inputting the target prompt information into the pre-trained inference model to obtain the structured inference result includes: The target prompt information is input into the pre-trained inference model to obtain multiple candidate inference schemes; the multiple candidate inference schemes are obtained by the pre-trained inference model classifying the event type of the target event cluster according to the target prompt information, and constructing multiple causal links according to the event type and the target prompt information; Based on the configuration association information and each target case data, multiple candidate reasoning schemes are logically consistent and filtered to obtain a target reasoning scheme; the target case data is historical case data that matches the event type. The structured reasoning result is generated based on the target reasoning scheme and the intermediate semantic link records generated during the construction of the causal link by the pre-trained reasoning model.

[0071] Optionally, after the target prompt information is input into the pre-trained inference model, the pre-trained inference model can adopt the following staged inference mechanism: First, the event types of the target event cluster are classified based on the target prompt information. Then, to improve the reliability of inference, the pre-trained inference model enables a multi-candidate output mechanism during the generation phase. Specifically, the pre-trained inference model concurrently constructs multiple potential causal links based on the identified event types and the event context graph in the target prompt information, inferring the root cause and scope of impact of the alarm to obtain multiple candidate inference schemes. To ensure the information completeness of a single scheme, each candidate inference scheme is configured to include root cause hypothesis information, scope of impact information, confidence score information, and action recommendation information.

[0072] Next, the generated candidate inference schemes need to be verified, i.e., logical consistency screening is performed on the candidate inference schemes. Specifically, based on objective configuration association information (i.e., the underlying real topology relationship) and target case data matching the event type (i.e., historical real cases), the rationality of the causal link inference in each candidate inference scheme is verified, assumptions that violate physical topology or do not conform to objective laws are eliminated, and finally the most reliable target inference scheme is selected. For example, when the monitoring shows an alarm for storage node input / output (IO) delay, and the change record of the configuration association information shows that a firmware upgrade event has occurred, logical consistency screening can accurately infer that the firmware upgrade is the potential root cause of the delay, and the target inference scheme can directly provide the recommended information for performing firmware rollback.

[0073] Finally, to meet the transparency requirements of enterprise-level applications for operational decisions and to ensure the interpretability of the entire reasoning process for subsequent auditing and traceability, the system also records snapshots of intermediate reasoning steps generated by the pre-trained inference model during the construction of the aforementioned causal chain. These snapshots are stored as intermediate semantic chain records, i.e., chain-of-thought logs. The selected target inference scheme is then merged and encapsulated with these intermediate semantic chain records to generate a structured inference result, thereby achieving interpretability and audit traceability of the pre-trained inference model's output.

[0074] The method provided in this embodiment introduces a phased reasoning and multi-candidate output mechanism, and combines objective environmental topology and historical cases for strict logical consistency screening. This effectively avoids the factual illusion and non-compliant logical judgment caused by sampling fluctuations in a single generative model, greatly improving the accuracy and reliability of root cause inference. At the same time, the reasoning and evolution process within the model's black box is output in the form of an externally visible thought chain and bound as an evidence chain, completely breaking the black box dilemma of model decision-making. This makes each automated handling suggestion have strong interpretability, transparency, and compliance audit traceability.

[0075] Step 150: Based on the structured reasoning results, generate structured process data corresponding to the target event cluster.

[0076] Optionally, after the structured reasoning results are inferred, the disposal strategy generation module (or decision generation unit) receives the structured reasoning results and is responsible for converting these reasoning conclusions, which were originally described in natural language, into structured work order data that can be directly executed and dispatched to specific personnel or automated platforms. Specifically, this can be implemented by a single intelligent agent or multiple intelligent agents.

[0077] For example, in order to automatically decompose and transform a natural language-based reasoning system into an operation and maintenance work order processing solution that covers multiple standard approval and direct operation steps, so as to achieve a closed loop of fine-grained task orchestration and fully automated dispatch, in one possible embodiment, generating structured work order data corresponding to the target event cluster based on the structured reasoning result includes: Using a policy-based intelligent agent, the disposal recommendation information in the structured reasoning results is scripted and its executableness is verified to obtain standard disposal step information; Using a service response agent, the target event cluster is evaluated based on its event severity and business importance characteristics to obtain the target response level and completion time limit information. Using a task scheduling agent, the responsible team information and approval process information corresponding to the target event cluster are mapped and obtained based on the organizational structure information of the target operation and maintenance environment. Based on the event type of the target event cluster, load the target work order template from the work order template library; Based on the structured reasoning results, the standard handling steps, the target response level, the completion time limit, the responsible team information, and the approval process information, the target work order template is updated to obtain the structured work order data.

[0078] Optionally, the work order generation task can be automatically decomposed and arranged through a multi-agent collaboration mechanism, so that different agents are responsible for the transformation of work order elements in different dimensions.

[0079] Specifically, firstly, a policy agent is used to extract the recommended actions from the structured reasoning results and convert the recommended actions in natural language into machine-readable execution scripts. Simultaneously, executability verification is performed in the underlying instruction library to compile safe and reliable standard action steps (i.e., specific operations and actions). In parallel, a service response agent is used to comprehensively evaluate the severity characteristics of the target event clusters extracted from the underlying monitoring and the importance characteristics of the business corresponding to the event. Based on the evaluation score, the corresponding target response level and the required completion time limit information of the system are determined. Additionally, a task scheduling agent is used to query the organizational structure information of the enterprise where the current target operation and maintenance environment is located, and based on this information, accurately map and deduce the responsible team information and approval process information corresponding to the target event cluster.

[0080] Subsequently, a template adaptive mechanism is adopted to dynamically match and load the corresponding target work order template from the preset work order template library according to the specific event type of the identified target event cluster, such as hardware work order templates, virtualization work order templates, or network link work order templates.

[0081] Finally, the standard handling steps, target response level, completion deadline, responsible team information, and approval process information generated by each intelligent agent, along with the initial structured reasoning result ontology (including fields such as issue title, event summary, root cause description, scope of impact, and rollback plan), are all populated and embedded into the reserved slots of the target work order template for updating and integration. This ultimately generates complete and standardized structured work order data. After this structured work order data is generated, it can be automatically pushed to the enterprise IT Service Management (ITSM) platform or instant messaging system via an Application Programming Interface (API), allowing the automation platform to directly read and execute it or for operations personnel to take over the response.

[0082] The method provided in this embodiment introduces a multi-agent collaborative decision-making generation framework and a template adaptive mechanism to automatically and structurally transform the natural language inference results output by a large language model into standard work orders that include execution scripts, response time limits, responsible teams, and approval processes. This mechanism precisely replaces the tedious traditional manual operations of querying multiple systems, comparing and confirming, and manually filling in work order attributes. It not only significantly shortens the work order creation and circulation cycle but also achieves seamless connection and fully automated closed loop from the underlying alarm parsing to the top-level task dispatch, significantly improving the execution efficiency and response speed of operation and maintenance decisions.

[0083] The method provided in this embodiment firstly constructs an event context graph by acquiring standardized multi-source alarm data and combining it with configuration information, breaking down heterogeneous data barriers and effectively eliminating alarm storms, achieving deep event perception of global topology and temporal correlation. Secondly, it constructs a knowledge-enhanced input set by retrieving the operation and maintenance knowledge base, providing authoritative domain experience support to the model in real time, effectively overcoming the factual illusion problem of large models in vertical scenarios. Subsequently, it jointly inputs the context graph and enhanced knowledge into the pre-trained inference model, abandoning traditional static matching rules, and achieving highly transparent and traceable cross-system dynamic causal inference, accurately locking the root cause of underlying faults and evidence links. Finally, it automatically generates structured work order data based on the structured inference results, seamlessly transforming natural language conclusions into standardized and executable operation and maintenance dispatch tasks. This method completely opens up a fully intelligent closed loop from massive alarm noise reduction and parsing to automatic work order dispatch, significantly improving fault response speed, decision accuracy, and knowledge reuse efficiency in complex operation and maintenance environments.

[0084] Based on the above embodiments, in order to ensure that automated operation and maintenance operations are performed within a safe boundary and to prevent cross-domain misoperations and destructive cascading failures, in one possible implementation, after generating the structured work order data corresponding to the target event cluster, the method further includes: Extract disposal instructions from the structured chemical single data; If the disposal instruction matches any operation command in the command whitelist, and the trigger time corresponding to the disposal instruction is within the operation authorization time window, then according to the configuration association information, a topological impact simulation is performed on the disposal instruction to obtain the predicted impact range data. If the predicted impact range data is less than or equal to the operation impact safety threshold, then the execution status of the structured chemical order data is configured to automatic approval status; If the predicted impact range data is greater than the operation impact safety threshold, then the execution status of the structured chemical order data will be configured to manual approval status.

[0085] like Figure 2 As shown, after generating structured chemical order data, the process enters the security compliance verification and execution decision-making stage. This stage typically involves multi-layered verification and restrictions handled by the policy engine.

[0086] Specifically, the first step is to extract the handling instructions from the structured chemical data. These handling instructions refer to the specific recommended operation steps or automated script parameters generated through prior reasoning. After extraction, it is verified whether the handling instructions match any operation command in the pre-defined command whitelist to ensure that the recommended operations are all within the enterprise-approved set of safe commands. Furthermore, it is determined whether the trigger time corresponding to the handling instructions falls within the authorized operation time window for allowing changes. This authorized operation time window refers to the safe time period for modifying system configurations, defined based on business characteristics.

[0087] If both of the above static checks pass, then based on the configuration association information of the underlying mapping, a topology impact simulation is performed on the handling command in the topology simulation module. This topology impact simulation refers to assessing the potential impact of the operation command, once executed, on key factors in the network topology, such as adjacent nodes or downstream services, thereby quantifying the prediction and obtaining the predicted impact range data to prevent downstream services from being mistakenly triggered.

[0088] Subsequently, the predicted impact range data obtained from the simulation is compared with the preset operational impact safety threshold. If the comparison result shows that the predicted impact range data is less than or equal to the operational impact safety threshold, it indicates that the operational risk is controllable, and the execution status of the structured work order data is configured to automatic approval status. Work orders in this status can be directly taken over by the automation platform and automatically dispatched and predefined recovery operations can be performed.

[0089] Conversely, if the predicted impact range data is detected to be greater than the operation impact safety threshold, or the disposal instruction is not in the command whitelist, or the trigger time corresponding to the disposal instruction is not within the operation authorization time window, it indicates that it is a high-risk operation. Here, an automatic downgrade interception operation is performed to configure the execution status of the structured chemical order data to manual approval status.

[0090] Simultaneously, this decision-making process generates an explanatory and security assessment report, which is then submitted to senior engineers for manual review. Furthermore, this stage includes behavioral auditing and logging to ensure all automated actions are traceable and meet compliance requirements.

[0091] The method provided in this embodiment constructs a rigorous multi-layered, interconnected security and compliance verification mechanism by introducing command whitelist matching, change window detection, dynamic topology impact simulation, and security threshold limits. This mechanism effectively controls the execution boundaries of automated commands, preventing the unauthorized issuance of erroneous commands and blocking potentially high-risk cascading operations. While ensuring the flexibility of intelligent operation and maintenance decision-making, it also ensures the safety, controllability, and reliability of the actual operation and maintenance execution process, perfectly meeting the deployment requirements of production-level information technology systems.

[0092] Based on the above embodiments, and in order to establish an autonomous evolution mechanism for experience-based self-learning and continuous optimization, thereby continuously improving the inference performance and policy reliability of the alarm information processing system, in one possible implementation, after generating the structured process data corresponding to the target event cluster, the method further includes: Obtain target feedback data generated after performing maintenance operations on the structured work order data; the target feedback data includes work order execution results, manual feedback information, and service level achievement rate. Based on the target feedback data, the inference performance parameters corresponding to the structured chemical order data are obtained; the inference performance parameters include inference accuracy parameters, confidence bias parameters, and treatment effectiveness parameters. Based on the inference performance parameters, the target parameters and / or the operation and maintenance knowledge base are updated; the target parameters include the parameters of the instruction template of the pre-trained inference model, the retrieval matching weights of the operation and maintenance knowledge base, and the policy parameters of each agent performing the structured chemical order data generation operation.

[0093] like Figure 2 As shown, after the action is completed, the result feedback and self-learning optimization stage can be entered to dynamically optimize the previously called models and strategies in a closed loop.

[0094] Specifically, the first step is to comprehensively acquire the target feedback data generated after performing maintenance operations on structured work order data. This target feedback data comes from the evaluation basis of actual maintenance sites, specifically covering the actual execution results of work orders after dispatch, the manual feedback information generated by senior handling specialists during the review or execution process for supplementary modifications and confirmations, and the service level achievement rate obtained by assessing the work order completion time limit indicators.

[0095] Subsequently, based on the target feedback data, the inference performance parameters corresponding to the structured chemical order data are obtained and written back to the system's learning database. These inference performance parameters are a set of core indicators that quantify the intelligent performance of the alarm information processing system. Specifically, they include: an inference accuracy parameter to evaluate the precision of the pre-trained inference model in locating the root cause of the fault; a confidence deviation parameter to measure the fluctuation between the confidence level of the pre-trained inference model in generating conclusions and the actual facts; and a handling effectiveness parameter to evaluate the proportion of recommended handling information in the structured chemical order data that is effectively adopted and successfully resolved in actual operation.

[0096] Finally, the evolutionary mechanism is activated to update the target parameters and / or the operation and maintenance knowledge base based on the inference performance parameters. On the one hand, techniques such as prompt word optimization and reinforcement learning based on human feedback are used to continuously fine-tune the target parameters. These target parameters specifically cover the parameters of the instruction template used to guide the pre-trained inference model, the retrieval matching weights of the operation and maintenance knowledge base used to control the external experience screening preferences, and the policy parameters of each agent (such as the policy agent, service response agent, task scheduling agent, etc.) responsible for the execution of structured work order data generation operations. On the other hand, the operation and maintenance knowledge base is updated simultaneously. Newly generated, verified valid work orders and successful handling cases are automatically summarized and vectorized and written into the database, transforming them into structured knowledge assets that can be reused in the future. Thus, after multiple iterations, the alarm information processing system can adaptively adjust the inference mode and policy priority, achieving continuous improvement in inference performance and automatic evolution of the knowledge system, ultimately forming an intelligent operation and maintenance closed-loop system with autonomous learning and evolution capabilities.

[0097] The method provided in this embodiment, by constructing a self-learning optimization mechanism based on real execution results and human feedback, can continuously and dynamically fine-tune the prompt templates, retrieval weights, and agent strategies of a large model using reinforcement learning and prompt optimization techniques, and store newly generated effective cases in a database. This mechanism completely breaks free from the rigidity of traditional static rules that are prone to becoming outdated, and can adaptively adjust the inference mode and strategy priority, achieving continuous improvement in model performance and automatic evolution of the enterprise operation and maintenance knowledge system, ultimately forming an intelligent operation and maintenance closed-loop system with highly autonomous learning and evolution capabilities.

[0098] In summary, compared with existing operation and maintenance alarm analysis systems based on static rules, keyword matching, or single models, the alarm information processing method provided in this application has the following significant advantages: (1) Possesses the ability to understand context through multi-source fusion. This application constructs an event context graph, which integrates heterogeneous information from multiple sources such as monitoring alarms, logs, configurations, change records, and business topologies. This enables semantic-level association and temporal understanding of complex operation and maintenance events, allowing for automatic identification of alarms from the same source, propagation links, and upstream and downstream dependencies. This provides a global perspective during the root cause analysis phase and significantly improves the accuracy of alarm aggregation and root cause localization.

[0099] (2) Knowledge-enhanced semantic reasoning of a large model was achieved. By introducing a retrieval enhancement generation mechanism and a domain-specific large-scale operation and maintenance knowledge model (i.e., a pre-trained reasoning model), standard operating procedure documents, equipment manuals, historical work orders, and change records related to the current alarm can be called in real time during the reasoning process, enabling the large-scale operation and maintenance knowledge model to have domain knowledge constraints and semantic completion capabilities. This achieves a deep integration of external knowledge access and semantic credibility, significantly improving the reliability of root cause inference and handling suggestions, and effectively overcoming the factual illusion problem of general large-scale models.

[0100] (3) An executable and traceable work order generation mechanism is formed. Through a multi-agent collaborative decision generation framework, the reasoning results of natural language can be automatically converted into structured and standardized operation and maintenance work orders, which include key fields such as root cause explanation, scope of impact, operation steps, rollback plan and service level agreement. The output results can be directly connected to the enterprise ITSM platform to realize the automatic dispatch closed loop from alarm to handling. At the same time, by retaining the intermediate thinking links and evidence references in the reasoning, the work order content is highly interpretable and traceable.

[0101] (4) Possesses security compliance and policy constraint capabilities. By introducing a multi-layered security verification mechanism, including command whitelist review, change window detection, dynamic topology impact simulation, and security threshold limits, it can effectively prevent the execution of erroneous commands and cross-domain cascading errors. This mechanism ensures the security and compliance of automated work orders during the actual execution phase, giving AI-driven operation and maintenance decisions controllable boundaries, making it perfectly suitable for production-level deployment scenarios.

[0102] (5) Supports self-learning and continuous optimization of autonomous evolution. Through the built-in feedback learning engine, reinforcement learning and prompting optimization techniques can be used to continuously and dynamically adjust the large model instruction template, knowledge retrieval weight, and agent strategy parameters based on the actual execution results of work orders and manual correction feedback. This mechanism can continuously reduce the misjudgment rate, achieve adaptive evolution, and gradually realize an intelligent closed loop from manual assistance to fully automatic autonomy.

[0103] (6) Significantly improves operation and maintenance efficiency and knowledge reuse level. In practical application scenarios, this application can shorten the time for complex alarm analysis and work order generation from several minutes to several seconds, greatly reduce duplicate alarms, such as reducing duplicate alarms by about 40%-60%, and significantly reduce the manual intervention rate, such as reducing the manual intervention rate by about 70%. At the same time, effective troubleshooting cases can be automatically and structurally stored in the database to form enterprise-level knowledge assets that can be reused sustainably, realizing experience accumulation and rapid retrieval, and significantly improving the overall response efficiency of the operation and maintenance system.

[0104] The alarm information processing system provided by the present invention is described below. The alarm information processing system described below can be referred to in correspondence with the alarm information processing method described above.

[0105] Figure 3 This is a schematic diagram of the alarm information processing system provided by the present invention; as shown below. Figure 3 As shown, the system includes a data access unit 310, a context modeling unit 320, a knowledge enhancement unit 330, a semantic reasoning unit 340, a decision generation unit 350, a verification unit 360, and a feedback learning unit 370. Each subunit is interconnected and interacts via a high-speed internal event message bus system, working together to form a complete automated workflow architecture from alarm reception and analysis / reasoning to automatic closed-loop work order issuance.

[0106] The data access unit is used to acquire standardized multi-source alarm data of the target operation and maintenance environment; The context modeling unit is used to perform feature semantic aggregation on the multi-source alarm data to obtain target event clusters, and to construct an event context graph corresponding to the target event clusters based on the configuration association information of the target event clusters and the target operation and maintenance environment. The knowledge enhancement unit is used to retrieve target knowledge fragments associated with the event context graph in the operation and maintenance knowledge base to obtain a knowledge enhancement input set; A semantic reasoning unit is used to input the event context graph and the knowledge-enhanced input set into a pre-trained reasoning model to obtain the structured reasoning result corresponding to the target event cluster. The decision generation unit is used to generate structured work order data corresponding to the target event cluster based on the structured reasoning results. A verification unit is used to extract disposal instructions from the structural chemical order data. If the disposal instruction matches any operation command in the command whitelist, and the trigger time corresponding to the disposal instruction is within the operation authorization time window, then according to the configuration association information, a topological impact simulation is performed on the disposal instruction to obtain predicted impact range data. If the predicted impact range data is less than or equal to the operation impact safety threshold, then the execution status of the structural chemical order data is configured to automatic approval status. If the predicted impact range data is greater than the operation impact safety threshold, then the execution status of the structural chemical order data is configured to manual approval status. A feedback learning unit is used to acquire target feedback data generated after performing maintenance operations on the structured work order data. The target feedback data includes work order execution results, human feedback information, and service level achievement rate. Based on the target feedback data, inference performance parameters corresponding to the structured work order data are acquired. The inference performance parameters include inference accuracy parameters, confidence bias parameters, and handling effectiveness parameters. Based on the inference performance parameters, the target parameters and / or the maintenance knowledge base are updated. The target parameters include the parameters of the instruction template of the pre-trained inference model, the retrieval matching weights of the maintenance knowledge base, and the strategy parameters of each agent performing the structured work order data generation operation.

[0107] The decision generation unit includes multiple agents, specifically policy agents, SLA agents, and task agents. These agents achieve hierarchical and parallel decision generation through a collaborative protocol.

[0108] The system provided in this embodiment effectively links the underlying massive data aggregation and sorting, the upper-layer graph topology construction, and the accurate retrieval support mechanism of the external domain multimodal knowledge base by constructing a distributed component framework architecture for event bus communication. On this architecture, firstly, standardized multi-source alarm data is acquired and combined with configuration information to construct an event context graph, breaking down heterogeneous data barriers and effectively eliminating alarm storms, achieving deep event perception of global topology and temporal correlation. Secondly, by retrieving the operation and maintenance knowledge base to construct a knowledge-enhanced input set, authoritative domain experience support is provided to the model in real time, effectively overcoming the factual illusion problem of large models in vertical scenarios. Subsequently, the context graph and enhanced knowledge are jointly input into the pre-trained inference model, abandoning traditional static matching rules and achieving highly transparent and traceable cross-system dynamic causal inference, accurately locking the root cause of underlying faults and evidence links. Finally, structured work order data is automatically generated based on the structured inference results, seamlessly transforming natural language conclusions into standardized and executable operation and maintenance dispatch tasks. This method completely establishes an intelligent closed loop across the entire chain, from massive alarm noise reduction and parsing to automatic work order dispatch, significantly improving fault response speed, decision accuracy, and knowledge reuse efficiency in complex operation and maintenance environments.

[0109] The system provided by this invention is used to execute the above-described method embodiments. For specific processes and details, please refer to the above embodiments, which will not be repeated here.

[0110] Figure 4 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 4As shown, the electronic device may include: a processor 410, a communications interface 420, a memory 430, and a communications bus 440, wherein the processor 410, the communications interface 420, and the memory 430 communicate with each other through the communications bus 440. The processor 410 can call logical instructions in the memory 430 to execute an alarm information processing method, which includes: acquiring standardized multi-source alarm data of the target operation and maintenance environment; performing feature semantic aggregation on the multi-source alarm data to obtain a target event cluster; constructing an event context graph corresponding to the target event cluster based on the configuration association information of the target event cluster and the target operation and maintenance environment; retrieving target knowledge fragments associated with the event context graph in the operation and maintenance knowledge base to obtain a knowledge enhancement input set; inputting the event context graph and the knowledge enhancement input set into a pre-trained inference model to obtain a structured inference result corresponding to the target event cluster; the structured inference result includes root cause explanation information, evidence link information, and processing recommendation information; and generating structured work order data corresponding to the target event cluster based on the structured inference result.

[0111] Furthermore, the logical instructions in the aforementioned memory 430 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0112] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the alarm information processing method provided by the above methods. The method includes: acquiring standardized multi-source alarm data of a target operation and maintenance environment; performing feature semantic aggregation on the multi-source alarm data to obtain a target event cluster; constructing an event context graph corresponding to the target event cluster based on the configuration association information of the target event cluster and the target operation and maintenance environment; retrieving target knowledge fragments associated with the event context graph in an operation and maintenance knowledge base to obtain a knowledge enhancement input set; inputting the event context graph and the knowledge enhancement input set into a pre-trained inference model to obtain a structured inference result corresponding to the target event cluster; the structured inference result includes root cause explanation information, evidence link information, and processing recommendation information; and generating structured work order data corresponding to the target event cluster based on the structured inference result.

[0113] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon. When executed by a processor, the computer program implements the alarm information processing method provided by the above methods. The method includes: acquiring standardized multi-source alarm data of a target operation and maintenance environment; performing feature semantic aggregation on the multi-source alarm data to obtain a target event cluster; constructing an event context graph corresponding to the target event cluster based on the configuration association information of the target event cluster and the target operation and maintenance environment; retrieving target knowledge fragments associated with the event context graph in an operation and maintenance knowledge base to obtain a knowledge enhancement input set; inputting the event context graph and the knowledge enhancement input set into a pre-trained inference model to obtain a structured inference result corresponding to the target event cluster; the structured inference result includes root cause explanation information, evidence link information, and processing recommendation information; and generating structured work order data corresponding to the target event cluster based on the structured inference result.

[0114] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0115] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0116] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for processing alarm information, characterized in that, include: Acquire standardized multi-source alarm data for the target operation and maintenance environment; The multi-source alarm data is subjected to feature semantic aggregation to obtain target event clusters. Based on the configuration association information of the target event clusters and the target operation and maintenance environment, an event context graph corresponding to the target event clusters is constructed. In the operation and maintenance knowledge base, target knowledge fragments associated with the event context graph are retrieved to obtain a knowledge enhancement input set; The event context graph and the knowledge-enhanced input set are input into the pre-trained inference model to obtain the structured inference results corresponding to the target event cluster; The structured reasoning results include root cause explanation information, evidence link information, and processing recommendation information; Based on the structured reasoning results, structured process data corresponding to the target event cluster is generated.

2. The alarm information processing method according to claim 1, characterized in that, The step involves retrieving target knowledge fragments associated with the event context graph from the operation and maintenance knowledge base to obtain a knowledge enhancement input set, including: Based on the event context graph, obtain graph semantic features; Based on the graph semantic features, as well as the device model features, firmware version features, and alarm tag features corresponding to the target event cluster, at least one target knowledge fragment is retrieved from the operation and maintenance knowledge base; By combining all the target knowledge fragments, the knowledge-enhanced input set is constructed.

3. The alarm information processing method according to claim 2, characterized in that, The step of retrieving at least one target knowledge fragment from the operation and maintenance knowledge base based on the graph semantic features, as well as the device model features, firmware version features, and alarm tag features corresponding to the target event cluster, includes: Calculate the semantic relevance between each candidate document in the operation and maintenance knowledge base and the graph semantic features, and determine at least one target document in the operation and maintenance knowledge base based on the semantic relevance. Extract knowledge fragments from each of the target documents and construct a candidate knowledge fragment set; Based on the device model characteristics, the firmware version characteristics, and the alarm tag characteristics, calculate the matching weight between each candidate knowledge fragment in the candidate knowledge fragment set and the event context graph; The candidate knowledge fragments are sorted according to the matching weights. Based on the sorting results, at least one of the target knowledge fragments is selected from the set of candidate knowledge fragments.

4. The alarm information processing method according to any one of claims 1-3, characterized in that, The step of inputting the event context graph and the knowledge-enhanced input set into the pre-trained inference model to obtain the structured inference result corresponding to the target event cluster includes: Determine the target instruction template based on the event type corresponding to the target event cluster; The event context graph and the knowledge-enhanced input set are filled into the target instruction template to obtain the target prompt information; The target prompt information is input into the pre-trained inference model to obtain the structured inference result.

5. The alarm information processing method according to claim 4, characterized in that, The step of inputting the target prompt information into the pre-trained inference model to obtain the structured inference result includes: The target prompt information is input into the pre-trained inference model to obtain multiple candidate inference schemes; the multiple candidate inference schemes are obtained by the pre-trained inference model classifying the event type of the target event cluster according to the target prompt information, and constructing multiple causal links according to the event type and the target prompt information; Based on the configuration association information and each target case data, multiple candidate reasoning schemes are logically consistent and filtered to obtain a target reasoning scheme; the target case data is historical case data that matches the event type. The structured reasoning result is generated based on the target reasoning scheme and the intermediate semantic link records generated during the construction of the causal link by the pre-trained reasoning model.

6. The alarm information processing method according to any one of claims 1-3, characterized in that, The step of generating structured work order data corresponding to the target event cluster based on the structured reasoning result includes: Using a policy-based intelligent agent, the disposal recommendation information in the structured reasoning results is scripted and its executableness is verified to obtain standard disposal step information; Using a service response agent, the target event cluster is evaluated based on its event severity and business importance characteristics to obtain the target response level and completion time limit information. Using a task scheduling agent, the responsible team information and approval process information corresponding to the target event cluster are obtained by mapping based on the organizational structure information of the target operation and maintenance environment; Based on the event type of the target event cluster, load the target work order template from the work order template library; Based on the structured reasoning results, the standard handling steps, the target response level, the completion time limit, the responsible team information, and the approval process information, the target work order template is updated to obtain the structured work order data.

7. The alarm information processing method according to any one of claims 1-3, characterized in that, The step of performing feature semantic aggregation on the multi-source alarm data to obtain target event clusters includes: Obtain the semantic similarity between the alarm text features of each alarm data in the multi-source alarm data, the index similarity between the index sequence features of each alarm data, and the shortest path distance between the device nodes corresponding to each alarm data; The semantic similarity, the index similarity, and the shortest path distance are weighted and fused to obtain the aggregate confidence score among the alarm data. Based on the aggregated confidence level, the multi-source alarm data is aggregated to obtain the target event cluster.

8. The alarm information processing method according to any one of claims 1-3, characterized in that, After generating the structured order data corresponding to the target event cluster, the method further includes: Extract disposal instructions from the structured chemical single data; If the disposal instruction matches any operation command in the command whitelist, and the trigger time corresponding to the disposal instruction is within the operation authorization time window, then according to the configuration association information, a topological impact simulation is performed on the disposal instruction to obtain the predicted impact range data. If the predicted impact range data is less than or equal to the operation impact safety threshold, then the execution status of the structured chemical order data is configured to automatic approval status; If the predicted impact range data is greater than the operation impact safety threshold, then the execution status of the structured chemical order data will be configured to manual approval status.

9. The alarm information processing method according to any one of claims 1-3, characterized in that, After generating the structured order data corresponding to the target event cluster, the method further includes: Obtain target feedback data generated after performing maintenance operations on the structured work order data; the target feedback data includes work order execution results, manual feedback information, and service level achievement rate. Based on the target feedback data, the inference performance parameters corresponding to the structured chemical order data are obtained; the inference performance parameters include inference accuracy parameters, confidence bias parameters, and treatment effectiveness parameters. Based on the inference performance parameters, the target parameters and / or the operation and maintenance knowledge base are updated; the target parameters include the parameters of the instruction template of the pre-trained inference model, the retrieval matching weights of the operation and maintenance knowledge base, and the policy parameters of each agent performing the structured chemical order data generation operation.

10. An alarm information processing system, characterized in that, include: The data access unit is used to acquire standardized multi-source alarm data of the target operation and maintenance environment; The context modeling unit is used to perform feature semantic aggregation on the multi-source alarm data to obtain target event clusters, and to construct an event context graph corresponding to the target event clusters based on the configuration association information of the target event clusters and the target operation and maintenance environment. The knowledge enhancement unit is used to retrieve target knowledge fragments associated with the event context graph in the operation and maintenance knowledge base to obtain a knowledge enhancement input set; A semantic reasoning unit is used to input the event context graph and the knowledge-enhanced input set into a pre-trained reasoning model to obtain the structured reasoning result corresponding to the target event cluster. The structured reasoning results include root cause explanation information, evidence link information, and processing recommendation information; The decision generation unit is used to generate structured document data corresponding to the target event cluster based on the structured reasoning results.

Images