Data center network equipment analysis and operation system based on multi-modal large model

Abstract

The application discloses a data center network equipment analysis and operation and maintenance system based on a multi-modal large model, which comprises a data acquisition layer, a data processing and analysis layer, an AI intelligent engine layer and an application service layer. The system obtains performance time sequence numerical values and system log texts of data center network equipment, extracts a local feature subset by using a bidirectional sliding time window, converts continuous numerical values into natural language semantic description texts in combination with an average gradient vector and a conditional mapping function, aligns and combines the time sequence feature semantic results with the system log texts, constructs a joint prompt word and sends it to an external large language model, receives fault root cause analysis conclusions and repair action instruction identifiers, constructs a deep root cause positioning path in combination with a network topology link table, extracts a predefined repair script and delivers it to a target equipment. The application eliminates the modal differences of multi-source heterogeneous data, and realizes closed-loop control from root cause positioning to state repair.

Description

Technical Field

[0001] This invention relates to the field of data center operation and maintenance technology, specifically to a data center network equipment analysis and operation and maintenance system based on a multimodal large model. Background Technology

[0002] With the evolution of information technology, data centers have become the infrastructure for carrying various computing and storage tasks. Data centers deploy a large number of network devices such as switches and routers, and their stable operation directly affects the continuity of overall business operations. To ensure the reliability of the network architecture, operations and maintenance personnel typically need to use network device analysis and maintenance systems to monitor the operational status of the underlying hardware and troubleshoot problems.

[0003] Existing network device analysis and maintenance systems primarily rely on data acquisition protocols to obtain operational data from the underlying hardware. The types of data acquired typically include discrete system log text generated during device operation, and continuous performance time-series values ​​collected through polling at fixed time intervals. After acquiring these two types of data, conventional maintenance systems often trigger alarms by setting static value thresholds or matching log keywords. Subsequently, maintenance personnel cross-reference and analyze the data using their individual log dashboards and numerical charts to determine the specific cause of the fault and perform corresponding network recovery operations.

[0004] However, existing technologies suffer from structural differences and temporal misalignments when comprehensively processing multi-source heterogeneous operation and maintenance data. Continuous performance time-series values ​​and discrete system log texts are completely independent in terms of data format. Existing systems struggle to effectively correlate and align numerical fluctuations within local time periods with specific log text records on a time scale. This modal difference prevents the system from directly converting underlying continuous numerical trends into textual semantic features that can be logically combined. This makes it difficult for the introduced intelligent analysis engine to simultaneously read and infer the dynamic changes of continuous values ​​and discrete text, thereby reducing the system's compatibility in processing multi-source operation and maintenance data and limiting the effectiveness of overall fault diagnosis. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides a data center network equipment analysis and operation and maintenance system based on a multimodal large model. This system solves the problem that existing operation and maintenance systems have difficulty effectively aligning discrete log text with continuous performance time-series values ​​on a time scale, resulting in modal differences in multi-source heterogeneous operation and maintenance data. Consequently, the analysis engine cannot synchronously read and accurately infer the dynamic operating status of the underlying devices, making it difficult to achieve a closed-loop process from fault root cause location to automated network status repair.

[0006] To achieve the above objectives, the present invention provides the following technical solution: The first aspect of the present invention provides a data center network equipment analysis and operation and maintenance system based on a multimodal large model, including: a data acquisition layer, a data processing and analysis layer, an AI intelligent engine layer, and an application service layer; The data acquisition layer obtains the performance time-series values ​​and system log text of the data center network equipment, and transmits the performance time-series values ​​and system log text to the data processing and analysis layer. Data processing and analysis layer stores time-series performance values ​​and system log text; The AI ​​intelligent engine layer retrieves time-related performance time-series values ​​and system log text from the data processing and analysis layer, performs feature extraction and semantic processing on the performance time-series values, and aligns and combines the semantically processed features with the system log text in the time dimension to generate cross-modal feature vectors. The AI ​​intelligent engine layer sends cross-modal feature vectors to an external large-scale language model, and receives the root cause analysis conclusions and repair action instruction identifiers returned by the external large-scale language model. It then transmits the root cause analysis conclusions and repair action instruction identifiers to the application service layer. The application service layer receives the root cause analysis results of the fault and the repair action instruction identifier, retrieves the predefined repair script that matches the repair action instruction identifier from the data processing and analysis layer, and sends the predefined repair script to the target data center network device to trigger network configuration changes or status repair operations.

[0007] Furthermore, the data processing and analysis layer is equipped with a trend prediction module. The trend prediction module uses an autoregressive moving average time series algorithm to fit historical performance time series values ​​and predict the estimated performance parameters of network devices at future time points as performance change trend data. The data processing and analysis layer compares the performance change trend data with the preset device operating baseline, determines that the network device has a performance degradation state based on the comparison results, and generates an abnormal warning sign based on the performance degradation state.

[0008] Furthermore, the AI ​​intelligent engine layer is equipped with a cross-modal alignment module. The cross-modal alignment module extracts the generation timestamp of the system log text and the acquisition timestamp of the performance time series values, and uses the generation timestamp of the system log text as the time reference point. The cross-modal alignment module combines the preset bidirectional sliding time window radius parameter with the time reference point to determine the time interval, combines the various performance time series values ​​that are within the time interval and have the same acquisition timestamp into a feature vector, and extracts a local feature subset that matches the time of the system log text from the feature vector set. The cross-modal alignment module combines the local feature subset with the time-matched system log text to generate feature data that has been time-synchronized and combined.

[0009] Furthermore, the cross-modal alignment module sorts the feature vectors contained in the local feature subset according to the order of the acquisition timestamps, and extracts the starting feature vector and the ending feature vector. The cross-modal alignment module combines the starting feature vector and the ending feature vector to calculate the average gradient vector of the time-series values ​​of each performance item in the local feature subset. The cross-modal alignment module compares the values ​​of each dimension element in the average gradient vector with the abnormal fluctuation threshold, and executes a conditional mapping function based on the comparison result to convert the numerical average gradient vector into natural language semantic description text. The cross-modal alignment module concatenates the natural language semantic description text generated in all dimensions to generate a time-series feature semantic result that matches the time interval of the system log text.

[0010] Furthermore, the AI ​​intelligent engine layer is internally configured with a large model inference module. This module reads a prompt word structure template containing role definition instructions, analysis task instructions, and context data placeholders. The analysis task instructions contain a structured constraint declaration that forces the output of JavaScript object solfège format. The module fills the context data placeholders with system log text and semantic results of time-series features, and generates a joint prompt word text by combining the role definition instructions and analysis task instructions. The module encapsulates the joint prompt word text into a request message and sends it to an external large language model. It receives a response message in JavaScript object solfège format and extracts independent fault root cause text fields and repair action instruction identifiers from the response message based on key-value pair matching rules.

[0011] Furthermore, the application service layer is configured with a backend service module. The backend service module uses preset regular expressions to extract network protocol anomalies and physical port failure status from the fault root cause text field to generate a retrieval feature string. The backend service module uses the retrieval feature string to extract the original system log text in the data processing and analysis layer, and performs address association matching between the network address extracted from the original system log text and the fault root cause text field to generate a device-level association mapping table. The backend service module reads the network topology link table containing physical connection relationships, performs pathfinding comparison between the device-level association mapping table and the network topology link table, and constructs a deep root cause localization path indicating the physical propagation link. The backend service module extracts the fault source host network address from the device-level association mapping table, fills it into the parameter placeholders of the predefined repair script to generate the target execution script, and extracts the identity authentication credentials of the fault source host to send the target execution script through the secure shell protocol.

[0012] A second aspect of the present invention provides a method for data center network device analysis and operation and maintenance based on a multimodal large model, applied to the data center network device analysis and operation and maintenance system based on a multimodal large model provided in the first aspect, comprising: Obtain performance timing values ​​and system log text from data center network devices; Feature extraction and semantic processing are performed on performance time-series values, and the semantically processed features are aligned and combined with system log text in the time dimension to generate cross-modal feature vectors; Call an external large-scale language model to process cross-modal feature vectors, and receive the root cause analysis conclusions and repair action instruction identifiers returned by the external large-scale language model; Based on the root cause analysis results and repair action instruction identifiers, the target execution script is extracted from the predefined repair script library and sent to the target data center network device to trigger the status repair operation. It integrates fault lifecycle data and analysis results from external large-scale language models to generate natural language operation and maintenance analysis reports.

[0013] This invention provides a data center network equipment analysis and operation and maintenance system based on a multimodal large model. It has the following beneficial effects: 1. This invention extracts a subset of local features with temporal correlation by constructing a bidirectional sliding time window, calculates the average gradient vector of time-series values, and uses a conditional mapping function to convert the numerical gradient into natural language semantic description text. This achieves effective alignment of heterogeneous data on the time scale, eliminates the structural differences between continuous performance values ​​and discrete log text, and enables large external language models to directly read and infer the dynamic changes in network device performance, thereby improving the system's compatibility and diagnostic effectiveness in processing multi-source operation and maintenance data.

[0014] 2. This invention configures a structured constraint declaration in the prompt word template to force the output of JavaScript object abbreviation format, and performs deserialization parsing on the response message returned by the large language model based on key-value pair matching rules, thereby extracting independent fault root cause text fields and repair action instruction identifiers. This realizes the structured transformation of natural language diagnostic results into low-level control instructions, solves the problem that the unstructured text output by the large language model is difficult for the computer to directly parse and call, and ensures that the analysis conclusions can be used as explicit input parameters to trigger the repair script.

[0015] 3. This invention generates a device-level association mapping table by matching the network address extracted from the original system log text with the root cause text field of the fault, and combines it with a network topology link table containing physical connection relationships to construct a deep root cause localization path that indicates the physical propagation link. Then, the network address of the fault source host is filled into the parameter placeholder of the predefined repair script and sent to the target data center network device, realizing a direct mapping from diagnostic conclusions to specific physical node intervention, and completing the complete operation steps from root cause localization to hardware status recovery. Attached Figure Description

[0016] Figure 1 This is a system architecture diagram of the present invention. Detailed Implementation

[0017] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0018] Please see the appendix Figure 1 This invention provides a data center network equipment analysis and operation and maintenance system based on a multimodal large model, comprising: The system consists of a data acquisition layer, a data processing and analysis layer, an AI intelligent engine layer, and an application service layer.

[0019] The data center network device analysis and operation system based on a multimodal large model is deployed on x86 architecture servers. The data acquisition layer establishes network communication connections with the data center network devices, including switches, routers, and firewalls. The data acquisition layer internally includes a protocol adaptation module and a polling scheduling module. The protocol adaptation module is used to establish network communication connections. The polling scheduling module is used to trigger the acquisition of operational status data from the data center network devices.

[0020] The data center network equipment analysis and operation and maintenance system based on a multimodal large model adopts a browser-server communication architecture for software deployment. The application service layer includes a front-end interface module and a back-end service module.

[0021] The front-end interface module is built on the Tailwind CSS framework. It outputs a responsive user interface view and receives device control commands from administrators.

[0022] The backend service module is built on the Python Flask framework. It provides a RESTful application interface. The backend service module receives communication requests from the frontend interface module and processes system business logic in conjunction with device control commands.

[0023] The data processing and analysis layer includes a data storage module. This module employs an architecture combining a MySQL database and an InfluxDB database.

[0024] The MySQL database within the data storage module is used to persistently store device profile information, user access permissions, and fault control scripts. The InfluxDB database within the same module is used to store timestamped time-series device performance values ​​captured by the data acquisition layer.

[0025] The AI ​​intelligent engine layer establishes an underlying data transmission link with the data processing and analysis layer and the application service layer. The AI ​​intelligent engine layer internally includes a cross-modal alignment module and a large model inference module. The cross-modal alignment module is used to synchronize and combine performance time-series numerical values ​​and text log data along the time dimension. The large model inference module calls external large-scale language models to process cross-modal operation and maintenance data.

[0026] The modular linkage and integration flow mechanism included in the data center network equipment analysis and operation and maintenance system based on a multimodal large model includes: The polling and scheduling module triggers data collection commands according to a preset cycle. The protocol adaptation module receives the data collection commands and establishes a communication connection with the data center network equipment. The protocol adaptation module obtains the performance timing values ​​of the data center network equipment and the system log text.

[0027] The data acquisition layer transmits performance time-series values ​​and system log text to the data processing and analysis layer. The data storage module stores the performance time-series values ​​in the InfluxDB database and the system log text in the MySQL database.

[0028] The cross-modal alignment module retrieves time-correlated performance time-series values ​​and system log text from the data storage module. It then performs feature extraction and semantic processing on the performance time-series values. Finally, it aligns and combines the semantically processed features with the system log text along the time dimension to generate a cross-modal feature vector.

[0029] The large-scale model inference module receives cross-modal feature vectors. It then sends these feature vectors to an external large-scale language model via an application programming interface (API). Finally, it receives the root cause analysis results and repair action instruction identifiers returned by the external large-scale language model.

[0030] The backend service module receives the root cause analysis results and the repair action instruction identifier. It then retrieves a predefined repair script matching the repair action instruction identifier from the MySQL database included in the data storage module. Finally, the backend service module sends the predefined repair script to the target data center network device via the protocol adaptation module to perform network configuration changes or status repair operations.

[0031] The backend service module interacts with the external data center information management platform system through a built-in application programming interface (API). The backend service module sends device status change records, alarm analysis data, and automated repair results to the data center information management platform system via the API. The backend service module also receives asset update data and monitoring baseline configuration parameters from the data center information management platform system via the API.

[0032] The front-end interface module obtains operational data from various modules through the back-end service module. It displays performance time-series data fluctuation curves, parsed system log text results, diagnostic conclusions from the large model inference module, and repair action records from the back-end service module. Administrators input control commands through the front-end interface module. The front-end interface module then sends these commands to the back-end service module, which in turn distributes them to the corresponding functional modules for processing.

[0033] The data acquisition mechanisms included in the data center network equipment analysis and operation and maintenance system based on a multimodal large model include: The data acquisition layer is internally configured with a polling scheduling module and a protocol adaptation module. The polling scheduling module is configured to trigger data acquisition tasks at intervals of one minute, three minutes, and five minutes.

[0034] The polling scheduling module sends network device acquisition commands to the protocol adaptation module according to the triggering cycle. The protocol adaptation module receives the network device acquisition commands. The protocol adaptation module reads the network address and authentication credentials of the data center network device from the MySQL database configured inside the data processing and analysis layer. The protocol adaptation module uses the network address and authentication credentials to establish a communication connection with the data center network device.

[0035] The protocol adaptation module obtains performance timing data of data center network devices through the third version of Simple Network Management Protocol (SMLP). These performance timing data include CPU utilization, memory utilization, operating temperature, port traffic, and error count.

[0036] The protocol adaptation module sends command-line query commands to the data center network devices via the Secure Shell protocol. The module then uses these commands to retrieve system log text generated by the data center network devices.

[0037] The data acquisition layer transmits performance time-series values ​​and system log text to the data processing and analysis layer.

[0038] The data processing and analysis layer receives performance time-series values ​​and system log text. The data storage module within this layer writes the performance time-series values ​​to an InfluxDB database and the system log text to a MySQL database.

[0039] The data center network equipment analysis and operation and maintenance system based on a multimodal large model includes the following basic anomaly early warning and trend prediction mechanisms: The data processing and analysis layer reads historical performance time-series values ​​from the InfluxDB database configured in the data storage module. The data processing and analysis layer also includes a trend prediction module.

[0040] The trend prediction module integrates an autoregressive moving average time series algorithm. The data processing and analysis layer inputs historical performance time series values ​​into the trend prediction module.

[0041] The trend prediction module uses an autoregressive moving average time series algorithm to fit historical performance time series values. Based on these historical performance time series values, the module predicts estimated performance parameters of network devices at future time points. The module then outputs these estimated performance parameters as trend data on the performance changes of the network devices.

[0042] The data processing and analysis layer extracts performance change trend data. It reads the system's preset equipment operating baseline from the MySQL database configured in the data storage module. The layer then compares the performance change trend data with the equipment operating baseline.

[0043] If the performance trend data exceeds the device's operating baseline, the data processing and analysis layer determines that the network device is in a state of performance degradation. Based on this performance degradation, the data processing and analysis layer generates an anomaly warning indicator.

[0044] The abnormal warning indicators include CPU overload warning status, memory exhaustion warning status, and operating temperature over-limit warning status.

[0045] The data processing and analysis layer transmits anomaly warning indicators to the application service layer. The application service layer receives the anomaly warning indicators and updates the device status view presented by the front-end interface module.

[0046] The cross-modal synchronization mechanisms included in the data center network equipment analysis and operation system based on a multimodal large model include: The AI ​​intelligent engine layer is internally configured with a cross-modal alignment module. This module acquires system log text and performance time-series values, and extracts the generation timestamp of the system log text and the collection timestamp of the performance time-series values, respectively.

[0047] The cross-modal alignment module reads the preset bidirectional sliding time window radius parameter from the MySQL database configured in the data storage module, and uses the generation timestamp of the system log text as the time reference point. The bidirectional sliding time window radius parameter is a preset time length value.

[0048] The cross-modal alignment module combines the bidirectional sliding time window radius parameter with the time reference point to determine the time interval, and then filters the performance timing values ​​within the time interval.

[0049] The cross-modal alignment module combines performance time-series values ​​that are within the same time interval and have the same acquisition timestamp into a feature vector, and then extracts a local feature subset from the feature vector set that matches the time of the system log text. The extraction rule for the local feature subset satisfies the following formula: Indicates the relationship with the first A subset of local features associated with each system log text.

[0050] The first value in the performance timing values 1 eigenvector.

[0051] Indicates the first A system log text.

[0052] Indicates the extracted first The generation timestamp of each system log text.

[0053] Indicates the extracted first The timestamp of the collection of each feature vector.

[0054] This represents the radius parameter of the preset bidirectional sliding time window.

[0055] The cross-modal alignment module combines local feature subsets with time-matched system log text to generate time-synchronized feature data. This time-synchronized feature data is then output to the large model inference module.

[0056] The data center network equipment analysis and operation system based on a multimodal large model includes the following time-series feature gradient calculation and dynamic semantic mapping mechanisms: The cross-modal alignment module configured within the AI ​​intelligent engine layer acquires local feature subsets. The cross-modal alignment module sorts the feature vectors contained in the local feature subsets according to the order of their acquisition timestamps, extracts the first feature vector after sorting as the starting feature vector, and extracts the last feature vector after sorting as the ending feature vector.

[0057] The cross-modal alignment module combines the initial and final feature vectors to calculate the average gradient vector of the time-series performance values ​​within a local feature subset. The calculation of the average gradient vector satisfies the following formula: Indicates the relationship with the first The average gradient vector corresponding to each local feature subset.

[0058] This represents the terminal feature vector within a local feature subset.

[0059] This represents the initial feature vector within the local feature subset.

[0060] This represents the timestamp of the extracted terminal feature vector.

[0061] This represents the timestamp of the initial feature vector extracted.

[0062] The cross-modal alignment module reads the preset abnormal fluctuation thresholds from the MySQL database configured in the data storage module. These abnormal fluctuation thresholds include discrete judgment limits corresponding to various performance time-series values.

[0063] The cross-modal alignment module compares the values ​​of each element in the average gradient vector with the corresponding abnormal fluctuation threshold.

[0064] The cross-modal alignment module executes a conditional mapping function based on the alignment results. This function transforms continuous numerical average gradient vectors into discrete natural language semantic description text. The conditional mapping function operates according to the following formula: This indicates that the th element in the average gradient vector... Natural language semantic description text of each dimension element.

[0065] The first term in the average gradient vector represents the first term. The element values ​​of each dimension.

[0066] Indicates the system preset and the first The abnormal fluctuation thresholds corresponding to each dimension.

[0067] The cross-modal alignment module concatenates the natural language semantic description text generated from all dimensions into strings, generating a temporal feature semantic result that matches the time interval of the system log text.

[0068] The cross-modal alignment module outputs the semanticized results of temporal features to the large model inference module.

[0069] The data center network equipment analysis and operation and maintenance system based on multimodal large models includes the following joint prompt word construction and large model scheduling mechanisms: The large model inference module configured inside the AI ​​intelligent engine layer receives system log text and semantic results of time-series features, and reads preset prompt word structure templates from the MySQL database configured in the data processing and analysis layer.

[0070] The prompt word structure template contains role definition instructions, analysis task instructions, and context data placeholders. The analysis task instructions contain a structured constraint declaration that forces the output of JavaScript object musical notation.

[0071] The large model inference module fills the context data placeholders with system log text and semantic results of time-series features, and generates joint prompt text by combining role definition instructions and analysis task instructions.

[0072] The large model inference module encapsulates the combined prompt text into a request message with an authentication key and sends the request message to an external large language model via a network communication link.

[0073] An external large-scale language model processes the combined prompt word text and generates a JavaScript object in simplified musical notation response message containing the root cause analysis conclusions and suggested repair actions.

[0074] The large model inference module receives the response message and performs deserialization parsing based on key-value pair matching rules. The large model inference module extracts the independent root cause text field and repair action instruction identifier from the response message using the key-value pair matching rules.

[0075] The large model inference module transmits the fault root cause text field and the repair action instruction identifier to the backend service module.

[0076] The data center network equipment analysis and operation and maintenance system based on a multimodal large model includes intelligent log analysis and deep root cause localization mechanisms, such as: The backend service module configured inside the application service layer receives the fault root cause text field and repair action instruction identifier transmitted by the large model inference module.

[0077] The backend service module uses preset regular expressions to extract network protocol exception events and physical port failure status from the fault root cause text field, and combines the network protocol exception events and physical port failure status to generate a search feature string.

[0078] The backend service module uses the search feature string to perform text matching and retrieval in the MySQL database configured in the data processing and analysis layer, and extracts the raw system log text that matches the search feature string from the MySQL database.

[0079] The backend service module extracts the network address from the original system log text and performs address association matching with the root cause text field of the fault to generate a device-level association mapping table. The device-level association mapping table contains the network address of the fault source host and the network addresses of the affected downstream nodes.

[0080] The backend service module reads the network topology link table from the MySQL database. The network topology link table contains the physical connection relationships between data center network devices.

[0081] The backend service module compares the device-level association mapping table with the network topology link table to construct a deep root cause localization path. The deep root cause localization path indicates the physical propagation link of the fault between network devices in the data center.

[0082] The backend service module packages and merges the deep root cause location path, the original system log text, and the fault root cause text field, and then transmits the packaged and merged data to the front-end interface module contained in the application service layer.

[0083] The front-end interface module receives the packaged and merged data, and updates the network topology link view rendered by the front-end interface module in combination with the deep root cause localization path.

[0084] The data center network equipment analysis and maintenance system based on a multimodal large model includes a predefined repair script library and an intelligent triggering mechanism, among other things: The MySQL database configured within the data processing and analysis layer stores a library of predefined repair scripts. This library contains command-line script templates written in advance for different types of network faults.

[0085] The backend service module configured inside the application service layer receives the repair action instruction identifier transmitted by the large model inference module.

[0086] The backend service module uses the repair action instruction identifier to traverse and search the predefined repair script library and extract the predefined repair script that matches the repair action instruction identifier.

[0087] The backend service module obtains the device-level association mapping table and extracts the network address of the faulty source host from the table. The backend service module then fills the network address of the faulty source host into the parameter placeholders of the predefined repair script, generating the target execution script.

[0088] The backend service module uses the network address of the faulty source host to query device file information in the MySQL database and extracts the identity authentication credentials of the faulty source host.

[0089] The backend service module transmits the target execution script and authentication credentials to the protocol adaptation module configured within the data acquisition layer. The protocol adaptation module uses the authentication credentials to establish a communication connection with the faulty source host via the Secure Shell protocol and then sends the target execution script to the faulty source host.

[0090] The faulty host executes the configuration change instructions contained in the target execution script and generates the script execution results to be fed back to the protocol adaptation module.

[0091] The protocol adaptation module transmits the script execution results to the backend service module. The backend service module then stores the script execution results in a MySQL database.

[0092] The backend service module synchronizes the script execution results to the frontend interface module included in the application service layer. The frontend interface module then updates the repair status label in the user interaction view based on the script execution results.

[0093] The specific mechanisms by which a data center network equipment analysis and operation and maintenance system based on a multimodal large model handles ARP storms on core switches include: The protocol adaptation module configured inside the data acquisition layer obtains the performance timing values ​​of the core switch and the system log text.

[0094] The trend prediction module configured within the data processing and analysis layer performs fitting calculations on performance time-series values. The trend prediction module determines that the CPU utilization rate of the core switch exceeds a preset device operating baseline and generates a CPU overload warning based on the determination result.

[0095] The cross-modal alignment module configured within the AI ​​intelligent engine layer acquires system log text and performance timing values ​​during the period when the central processing unit overload warning is triggered. The system log text records information about frequent ARP entry flipping events.

[0096] The cross-modal alignment module transforms the surge in CPU usage features into semanticized temporal features.

[0097] The large model inference module constructs a joint prompt word text from the system log text and the semanticized results of time-series features, and sends the joint prompt word text to an external large language model through a network communication link.

[0098] The external large language model returns a response message. The response message contains the root cause analysis conclusions of the ARP storm encountered by the core switch and the physical port shutdown action command identifier.

[0099] The backend service module configured within the application service layer parses the response packets and extracts the root cause text field of the ARP storm encountered by the core switch, as well as the physical port shutdown action command identifier. The backend service module performs address association matching between the root cause text field and the system log text, generates a device-level association mapping table, and extracts the network address of the source host that caused the ARP storm and its corresponding physical port number from the device-level association mapping table.

[0100] The backend service module retrieves predefined repair scripts that match the physical port shutdown action instruction identifier from the predefined repair script library in the MySQL database.

[0101] The backend service module fills the network address and physical port number of the faulty source host into the parameter placeholders of the predefined repair script, and generates the target execution script.

[0102] The backend service module uses the network address of the faulty source host to query and retrieve the authentication credentials of the faulty source host from the MySQL database. The backend service module then transmits the target execution script and authentication credentials to the protocol adaptation module.

[0103] The protocol adaptation module uses identity authentication credentials to establish a communication connection with the faulty source host and sends the target execution script to the faulty source host.

[0104] The faulty host executes a configuration change command to close the physical port that is experiencing an ARP storm, and reports the port closure execution result back to the protocol adaptation module.

[0105] The protocol adaptation module transmits the port closure execution result to the backend service module. The backend service module then synchronizes the port closure execution result to the frontend interface module. The frontend interface module updates the port running status in the network topology link view based on the port closure execution result.

[0106] The polling scheduling module triggers performance timing data collection commands for subsequent cycles. The protocol adaptation module obtains the latest performance timing data of the core switch. Based on the latest performance timing data, the trend prediction module confirms that the CPU utilization of the core switch has fallen back to within the equipment operating baseline, completing the fault handling closed loop.

[0107] The data center network equipment analysis and operation and maintenance system based on a multimodal large model includes real-time performance drill-down and centralized management view mechanisms, such as: The front-end interface module configured within the application service layer sends a topology data request to the back-end service module. The back-end service module receives the topology data request and reads the network topology link table and device profile information from the MySQL database.

[0108] The backend service module transmits the network topology link table and device profile information to the frontend interface module. The frontend interface module then renders a centralized management view based on this information. This centralized management view contains a physical connection topology diagram of the data center network devices.

[0109] The front-end interface module receives device node selection commands input by administrators in the centralized management view and generates performance drill-down requests based on these commands. The performance drill-down request includes the target device's network address and the query time range.

[0110] The front-end interface module sends performance drill-down requests to the back-end service module. The back-end service module receives the performance drill-down requests and performs searches in the InfluxDB database based on the target device's network address and the query time range.

[0111] The backend service module extracts the performance time series values ​​of the target device within the query time interval from the InfluxDB database and transmits the performance time series values ​​to the frontend interface module.

[0112] The front-end interface module receives performance time-series values. It then uses a data visualization component to render these values ​​as line charts and displays them in a performance drill-down panel within the centralized management view.

[0113] The backend service module uses the target device's network address to perform a targeted search in the MySQL database and extracts the corresponding anomaly warning identifier and root cause analysis conclusions. The backend service module then transmits the anomaly warning identifier and root cause analysis conclusions to the frontend interface module.

[0114] The front-end interface module overlays and displays the abnormal warning indicators and the root cause analysis results of the faults on the corresponding physical connection topology node positions in the centralized management view.

[0115] The front-end interface module receives the script execution results synchronized from the back-end service module. The front-end interface module extracts the status codes contained in the script execution results and updates the running status labels of the data center network devices in the centralized management view based on these status codes.

[0116] The data center network equipment analysis and operation system based on a multimodal large model includes a natural language closed-loop analysis report generation mechanism, which includes: The backend service modules configured within the application service layer extract fault lifecycle data from the MySQL database configured within the data processing and analysis layer. The fault lifecycle data includes anomaly warning indicators, raw system log text, fault root cause text fields, deep root cause location paths, and script execution results.

[0117] The backend service module populates the fault lifecycle data into the preset report generation prompt template and generates the closed-loop analysis task text.

[0118] The backend service module transmits the closed-loop analysis task text to the large model inference module configured within the AI ​​intelligent engine layer. The large model inference module encapsulates the closed-loop analysis task text into a request message and sends it to an external large language model via a network communication link.

[0119] An external large-scale language model processes the closed-loop analysis task text and returns a natural language operation and maintenance analysis report. The large model inference module receives the natural language operation and maintenance analysis report.

[0120] The large model inference module transmits the natural language operation and maintenance analysis report to the backend service module. The backend service module then stores the natural language operation and maintenance analysis report in a MySQL database.

[0121] The backend service module synchronizes the natural language operation and maintenance analysis report to the front-end interface module configured within the application service layer. The front-end interface module receives the natural language operation and maintenance analysis report. It then uses a text rendering component to present the report's content in a centralized management view.

[0122] The data center network device analysis and operation method based on a multimodal large model is applied to a data center network device analysis and operation system based on a multimodal large model. The data center network device analysis and operation method based on a multimodal large model includes: Obtain performance timing values ​​and system log text from data center network devices; Feature extraction and semantic processing are performed on performance time-series values, and the semantically processed features are aligned and combined with system log text in the time dimension to generate cross-modal feature vectors; Call an external large-scale language model to process cross-modal feature vectors, and receive the root cause analysis conclusions and repair action instruction identifiers returned by the external large-scale language model; Based on the root cause analysis results and repair action instruction identifiers, a target execution script is generated, and a target execution script execution status repair operation is sent to the target data center network device. It integrates fault lifecycle data and analysis results from external large-scale language models to generate natural language operation and maintenance analysis reports.

[0123] Those skilled in the art can directly implement the basic hardware structure of data center network equipment and the specific data packet forwarding principles of the underlying network communication protocols by combining existing standards and specifications. The aforementioned implementation methods of the basic hardware structure and underlying network communication protocols are well-known technologies in this field and will not be elaborated upon here.

[0124] The specific steps, feature extraction logic, and script triggering mechanism of the data center network equipment analysis and operation method based on a multimodal large model are completely mapped to the internal module operation mechanism of the data center network equipment analysis and operation system based on a multimodal large model described in detail above. All detailed technical details and formula steps disclosed in the system embodiments are equally applicable to this method embodiment, and will not be repeated here for the sake of brevity.

[0125] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A data center network equipment analysis and operation and maintenance system based on a multimodal large model, characterized in that, include: Data acquisition layer, data processing and analysis layer, AI intelligent engine layer, and application service layer; The data acquisition layer obtains the performance time-series values ​​and system log text of the data center network equipment, and transmits the performance time-series values ​​and system log text to the data processing and analysis layer. The data processing and analysis layer stores time-series performance values ​​and system log text; The AI ​​intelligent engine layer retrieves time-related performance time-series values ​​and system log text from the data processing and analysis layer, performs feature extraction and semantic processing on the performance time-series values, and aligns and combines the semantically processed features with the system log text in the time dimension to generate cross-modal feature vectors. The AI ​​intelligent engine layer sends cross-modal feature vectors to an external large-scale language model, and receives the root cause analysis conclusions and repair action instruction identifiers returned by the external large-scale language model. It then transmits the root cause analysis conclusions and repair action instruction identifiers to the application service layer. The application service layer receives the root cause analysis results of the fault and the repair action instruction identifier, retrieves the predefined repair script that matches the repair action instruction identifier from the data processing and analysis layer, and sends the predefined repair script to the target data center network device to trigger network configuration changes or status repair operations.

2. The data center network equipment analysis and operation and maintenance system based on a multimodal large model according to claim 1, characterized in that, The data acquisition layer is equipped with a protocol adaptation module and a polling scheduling module; the data processing and analysis layer is equipped with a data storage module that includes a MySQL database and an InfluxDB database. The polling and scheduling module triggers collection commands according to a preset period; The protocol adaptation module receives the acquisition command and obtains CPU utilization, memory utilization, operating temperature, port traffic and error count as performance timing values ​​through the third version of Simple Network Management Protocol. The protocol adaptation module sends command-line query instructions to data center network devices via the Secure Enclosure protocol to retrieve system log text; The data storage module stores performance time-series values ​​in the InfluxDB database and system log text in the MySQL database.

3. The data center network equipment analysis and operation and maintenance system based on a multimodal large model according to claim 1, characterized in that, The data processing and analysis layer is internally configured with a trend prediction module; The trend prediction module uses an autoregressive moving average time series algorithm to fit historical performance time series values ​​and predict the estimated performance parameters of network devices at future time points as performance change trend data. The data processing and analysis layer compares the performance change trend data with the preset equipment operation baseline. Based on the comparison results, it determines that the network equipment is in a state of performance degradation and generates an abnormal warning sign based on the performance degradation state.

4. The data center network equipment analysis and operation and maintenance system based on a multimodal large model according to claim 1, characterized in that, The AI ​​intelligent engine layer is internally configured with a cross-modal alignment module; The cross-modal alignment module extracts the generation timestamp of the system log text and the acquisition timestamp of the performance time series values, and uses the generation timestamp of the system log text as the time reference point. The cross-modal alignment module combines the preset bidirectional sliding time window radius parameter with the time reference point to determine the time interval, combines the performance time series values ​​that are within the time interval and have the same collection timestamp into a feature vector, and extracts a local feature subset that matches the time of the system log text from the feature vector set; The cross-modal alignment module combines local feature subsets with time-matched system log text to generate time-synchronized feature data.

5. The data center network equipment analysis and operation and maintenance system based on a multimodal large model according to claim 4, characterized in that, The cross-modal alignment module sorts the feature vectors contained in the local feature subset according to the order of acquisition timestamps, and extracts the starting feature vector and the ending feature vector; The cross-modal alignment module combines the initial feature vector and the terminal feature vector to calculate the average gradient vector of the time series values ​​of various performance parameters within the local feature subset; The cross-modal alignment module compares the values ​​of each dimension element in the average gradient vector with the abnormal fluctuation threshold, and executes the conditional mapping function based on the comparison results to convert the numerical average gradient vector into natural language semantic description text. The cross-modal alignment module concatenates the natural language semantic description text generated from all dimensions into strings, generating a temporal feature semantic result that matches the time interval of the system log text.

6. The data center network equipment analysis and operation and maintenance system based on a multimodal large model according to claim 5, characterized in that, The AI ​​intelligent engine layer is internally configured with a large model inference module; The large model inference module reads a prompt word structure template containing role definition instructions, analysis task instructions, and context data placeholders; the analysis task instructions contain a structured constraint declaration that forces the output of JavaScript object solfège format; The large model inference module fills the context data placeholders with system log text and semantic results of time-series features, and generates joint prompt text by combining role definition instructions and analysis task instructions; The large model inference module encapsulates the joint prompt text into a request message and sends it to an external large language model. It receives a JavaScript object abbreviation format response message and extracts independent fault root cause text fields and repair action instruction identifiers from the response message based on key-value pair matching rules.

7. The data center network equipment analysis and operation and maintenance system based on a multimodal large model according to claim 6, characterized in that, The application service layer is configured with a backend service module; The backend service module uses preset regular expressions to extract network protocol abnormal events and physical port fault status from the fault root cause text field to generate search feature strings; The backend service module uses retrieval feature strings to extract the original system log text in the data processing and analysis layer, and performs address association matching between the network address extracted from the original system log text and the fault root cause text field to generate a device-level association mapping table. The backend service module reads the network topology link table containing physical connection relationships, compares the device-level association mapping table with the network topology link table for pathfinding, and constructs a deep root cause localization path that indicates the physical propagation link.

8. The data center network equipment analysis and operation and maintenance system based on a multimodal large model according to claim 7, characterized in that, The application service layer includes a front-end interface module. The backend service module extracts the network address of the fault source host from the device-level association mapping table and fills it into the parameter placeholders of the predefined repair script to generate the target execution script; The backend service module extracts the authentication credentials of the faulty source host and transmits the target execution script and authentication credentials to the protocol adaptation module configured inside the data acquisition layer. The protocol adaptation module uses identity authentication credentials to send the target execution script to the faulty source host through the Secure Shell protocol, triggering the faulty source host to execute configuration change instructions, and receives the script execution results from the faulty source host and synchronizes them to the front-end interface module.

9. The data center network equipment analysis and operation and maintenance system based on a multimodal large model according to claim 8, characterized in that, The backend service module extracts fault lifecycle data including anomaly warning indicators, raw system log text, fault root cause text field, deep root cause location path, and script execution results; The backend service module populates the fault lifecycle data into the report generation prompt word template to generate closed-loop analysis task text, and transmits it to the large model inference module to request the external large language model to return a natural language operation and maintenance analysis report; The backend service module synchronizes the natural language operation and maintenance analysis report to the frontend interface module; The front-end interface module renders performance time-series values ​​as data line charts and overlays natural language operation and maintenance analysis reports on a centralized management view that includes a physical connection topology diagram of data center network devices.

10. A method for analyzing and maintaining data center network equipment based on a multimodal large model, applied to the data center network equipment analysis and maintenance system based on a multimodal large model according to any one of claims 1-9, characterized in that, Data center network equipment analysis and maintenance methods based on multimodal large models include: Obtain performance timing values ​​and system log text from data center network devices; Feature extraction and semantic processing are performed on performance time-series values, and the semantically processed features are aligned and combined with system log text in the time dimension to generate cross-modal feature vectors; Call an external large-scale language model to process cross-modal feature vectors, and receive the root cause analysis conclusions and repair action instruction identifiers returned by the external large-scale language model; Based on the root cause analysis results and repair action instruction identifiers, the target execution script is extracted from the predefined repair script library and sent to the target data center network device to trigger the status repair operation. It integrates fault lifecycle data and analysis results from external large-scale language models to generate natural language operation and maintenance analysis reports.

Images