An AI large model-based operation and maintenance alarm automatic analysis method and system

Abstract

The embodiment of the application provides an operation and maintenance alarm automatic analysis method and system based on an AI large model, and relates to the technical field of operation and maintenance alarm automatic analysis. After obtaining user query information, the method generates analysis requirement features containing a target intention category and analysis entities according to the user query information. Then, the target analysis function is matched according to the analysis requirement features, and the function calling instruction is generated by binding the analysis entities to the target analysis function. Then, the alarm data and the knowledge base matching data are extracted from the information service platform according to the function calling instruction, so that the data is statistically analyzed according to the target analysis function, to generate a statistical analysis result. The method can automatically trigger the extraction of the alarm data and the knowledge base matching data based on the AI large model, realize the in-depth analysis of multidimensional data, provide the statistical analysis result and the ring ratio change information of the knowledge base hit rate, can shorten the data analysis time, and improve the efficiency and accuracy of operation and maintenance alarm analysis.

Description

Technical Field

[0001] This application relates to the field of automated analysis technology for operation and maintenance alarms, and in particular to an automated analysis method and system for operation and maintenance alarms based on an AI large model. Background Technology

[0002] In bank operations and maintenance, it's necessary to analyze various alarm data at a holistic level to help managers identify potential problems in current operational processes and predict alarm trends. Alarm analysis can be performed by statistically analyzing the number of system alarms, the number of alarms belonging to a particular department or system, etc., to determine the status of alarm data. However, this statistical analysis method is inefficient and susceptible to manual errors.

[0003] To improve the efficiency of alarm data analysis, a reasonable preset time window can be constructed, and massive amounts of alarm data to be processed can be periodically filtered. Then, by performing correlation analysis and clustering on the alarm data to be processed, the relationships between the alarm data to be processed can be explored, and potential abnormal business operations can be located.

[0004] However, the above-mentioned automatic alarm analysis methods have a single analysis dimension and cannot analyze the overall operation of various systems. They also lack analysis of the systems belonging to various departments in the data center, making it difficult to analyze the vulnerabilities in the current operation and maintenance management process from a management perspective. Furthermore, they cannot conduct effective month-on-month and trend analysis, which affects the efficiency and quality of operation and maintenance management, reduces response speed, and diminishes the ability to predict system risks. Summary of the Invention

[0005] In view of this, embodiments of this application provide an automated analysis method and system for operation and maintenance alarms based on AI large models, in order to solve the problems of low efficiency and accuracy in operation and maintenance alarm analysis.

[0006] According to a first aspect of this application, an automated analysis method for operation and maintenance alarms based on an AI large model is provided, the method comprising: Obtain user query information, which is natural language text input by the user to submit alarm analysis requests; Analysis requirement features are generated based on the user query information. The analysis requirement features include target intent categories obtained by performing intent category mapping on the user query information using an AI large model, and analysis entities extracted from the user query information. The analysis entities include at least one of time entities, department entities, system entities, and indicator entities. Match the target analysis function according to the analysis requirement characteristics, and bind the analysis entity to the target analysis function to generate function call instructions; In response to the function call instruction, data to be analyzed is extracted from the information service platform. The data to be analyzed includes alarm data and knowledge base matching data within a preset analysis period. The preset analysis period is set according to the time entity. The knowledge base matching data is a comparison result generated by comparing the metadata extracted from the alarm data with the knowledge tags in the knowledge base according to a preset priority and the enabled matching rules. The data to be analyzed is statistically analyzed according to the target analysis function to generate statistical analysis results.

[0007] In some embodiments, generating analysis requirement features based on the user query information includes: Call upon a large AI model, which includes a classification model and / or a rule engine; The AI ​​big data model maps user query information to predefined intent categories to determine the target intent category; the predefined intent categories are designed based on statistical analysis functions; the predefined intent categories include at least one of department alarm categories, system alarm categories, and knowledge base hit rate categories; A named entity recognition algorithm is used to extract key parameters from the user query information in order to determine the analysis entity based on the key parameters. The analysis requirement features are generated based on the analysis entity and the target intent category.

[0008] In some embodiments, generating analysis requirement features based on the user query information further includes: Iterate through the entity types of the analyzed entity, where the entity types include necessary entities and unnecessary entities; Obtain the confidence score of the analyzed entity whose entity type is the necessary entity. The confidence score is calculated by the AI ​​big model based on the parsing results of the analyzed entity. If the confidence score is lower than a preset confidence threshold, query feedback information is generated and output; the query feedback information is used to request the user to clarify or re-enter the user query information.

[0009] In some embodiments, generating analysis requirement features based on the user query information further includes: Read the time entity from the analysis entity; If the analysis entity does not contain the time entity, obtain the analysis period, which is the time period selected by the user based on the settings interface; The time entity is generated based on the analysis period.

[0010] In some embodiments, matching a target analysis function based on the analysis requirement characteristics and binding the analysis entity to the target analysis function to generate a function call instruction includes: Obtain a function registry, which includes multiple internal functions; each internal function includes an execution action field and an execution object field. The analysis requirement features are mapped to the internal functions in the function registry to obtain the target analysis function; the target analysis function is an internal function in which the execution action field is associated with the target analysis intent and the execution object field is of the same type as the analysis entity. The analysis entity is used to replace the execution object field in the target analysis function to generate the function call instruction.

[0011] In some embodiments, the method further includes: Acquire business data, which includes at least one of technical documents, alarm work orders, and business work orders; Knowledge entries are generated based on the business data, and the knowledge entries include at least one of general knowledge, alarm knowledge, and business work order knowledge. Create matching rules for the knowledge entries; The knowledge entries and matching rules are added to the knowledge base, and the knowledge base is stored in the information service platform.

[0012] In some embodiments, in response to the function call instruction, data to be analyzed is extracted from the information service platform, including: The alarm data is extracted from the information service platform and the matching rule is activated according to the function call instruction; Metadata is extracted from the alarm data, including alarm identifier, alarm attributes, and alarm content keywords; Based on a preset priority, the metadata is compared with the enabled matching rules in sequence to determine the matching rule base; Multi-level knowledge tags are generated according to the matching rule base; the multi-level knowledge tags are used to construct matching paths based on the hierarchical rule structure of the rule system; Knowledge categories are obtained by comparing the multi-level knowledge tags; Based on the knowledge category matching knowledge tag category rules, the matching knowledge that meets the conditions is determined, and the knowledge base matching data is generated according to the number of matching knowledge.

[0013] In some embodiments, statistical analysis is performed on the data to be analyzed according to the target analysis function to generate statistical analysis results, including: The data to be analyzed is converted into structured format data, which includes at least one of indicator value fields and timestamp fields; The target analysis function is used to perform statistical analysis on the structured data to generate the statistical analysis results; The result output method is obtained from the user query information and / or the multi-turn dialogue context of the user query information; According to the output method described above, the statistical analysis results are converted into natural language response information using the AI ​​large model; the natural language response information includes at least one of text output information and visual output information. Output the natural language response information.

[0014] In some embodiments, according to the result output method, the statistical analysis results are converted into natural language response information using the AI ​​large model, including: Historical related data is extracted from the data to be analyzed, and the historical related data is data of the same type as the data to be analyzed. By comparing the data to be analyzed with the historical related data, a comparison result is generated, which includes month-on-month change information; Using a visualization output tool, generate comparison graphs based on the comparison results; The comparison graph, the comparison result, the data to be analyzed, and the historical correlation data are input into the AI ​​big model to generate the natural language response information using the AI ​​big model.

[0015] According to a second aspect of this application, an automated analysis system for operation and maintenance alarms based on an AI large model is provided, the system comprising: The data input module is used to obtain user query information, which is natural language text input by the user to submit alarm analysis requests; The feature generation module is used to generate analysis requirement features based on the user query information. The analysis requirement features include a target intent category obtained by performing intent category mapping on the user query information using an AI large model, and analysis entities extracted from the user query information. The analysis entities include at least one of time entities, department entities, system entities, and indicator entities. The function call module is used to match the target analysis function according to the analysis requirement characteristics, and to bind the analysis entity to the target analysis function to generate function call instructions; The data extraction module is used to extract data to be analyzed from the information service platform in response to the function call instruction. The data to be analyzed includes alarm data and knowledge base matching data within a preset analysis period. The preset analysis period is set according to the time entity. The knowledge base matching data is a comparison result generated by comparing the metadata extracted from the alarm data with the enabled matching rules according to a preset priority and knowledge tags in the knowledge base. The data statistical analysis module is used to perform statistical analysis on the data to be analyzed according to the target analysis function, so as to generate statistical analysis results.

[0016] According to a third aspect of this application, a computer device is provided, including a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor, wherein the processor executes the program to implement the above-described automated analysis method for operation and maintenance alarms based on an AI large model.

[0017] According to a fourth aspect of this application, a storage medium is provided that stores a computer program thereon, which, when executed by a processor, implements the above-described automated analysis method for operation and maintenance alarms based on an AI large model.

[0018] By employing the above technical solutions, this application provides a method and system for automated analysis of operation and maintenance alarms based on an AI-powered large-scale model. After obtaining user query information, the method generates analysis requirement features containing target intent categories and analysis entities. Then, it matches target analysis functions based on the analysis requirement features and generates function call instructions by binding analysis entities to the target analysis functions. Next, it extracts alarm data and knowledge base matching data from an information service platform according to the function call instructions, and performs statistical analysis on the data according to the target analysis function to generate statistical analysis results. This method can automatically trigger the extraction of alarm data and knowledge base matching data based on an AI-powered large-scale model, enabling in-depth analysis of multi-dimensional data, providing statistical analysis results of knowledge base hit rates and month-on-month change information, shortening data analysis time, and improving the efficiency and accuracy of operation and maintenance alarm analysis.

[0019] The above description is only an overview of the technical solution of this application. In order to better understand the technical means of this application and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this application more obvious and understandable, the following are specific embodiments of this application. Attached Figure Description

[0020] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings: Figure 1A schematic diagram of the automated analysis method for operation and maintenance alarms based on an AI large model provided in this application embodiment; Figure 2 This is a schematic diagram of the module division structure of the operation and maintenance management system provided in the embodiments of this application; Figure 3 This is a schematic diagram of the automated analysis process for operation and maintenance alarms provided in the embodiments of this application; Figure 4 This is a schematic diagram of the natural language response information output process provided in the embodiments of this application; Figure 5 This is a schematic diagram of the structure of an automated analysis system for operation and maintenance alarms based on an AI large model, provided in an embodiment of this application. Detailed Implementation

[0021] The present application will be described in detail below with reference to the accompanying drawings and embodiments. It should be noted that, unless otherwise specified, the embodiments and features described in the embodiments of the present application can be combined with each other.

[0022] The AI-based large-scale model-based automated operation and maintenance alarm analysis method described in this application embodiment can be applied to alarm analysis scenarios in bank operation and maintenance work. Alarm analysis refers to analyzing various alarm data at a holistic level to help managers identify potential problems in the current operation and maintenance processes, and predict alarm development trends based on the analysis results, thereby specifying business execution plans.

[0023] When performing alarm analysis, information such as the number of alarms in the system, the knowledge base matching rate, and the number of alarms in the system of the relevant department can be collected, and operation and maintenance guidance can be provided based on the statistical results. Due to the huge amount of alarm data, manual analysis of alarm data is inefficient and prone to errors. Therefore, automated operation and maintenance alarm analysis can be performed to achieve efficient and accurate analysis of alarms within a certain period.

[0024] To automate the analysis of operational alarms, some implementations can plan various operational data display methods for different scenarios based on the operational context. The data returned from the backend is then analyzed and the results are displayed using corresponding output methods. During the analysis process, customized displays can also be achieved by retrieving different components and function configurations.

[0025] However, this automated analysis method only applies to certain cloud platform systems and is used to visualize the results of various alarm analyses for these systems. It cannot visualize all data from the operational and maintenance process. Furthermore, the displayed content is limited and cannot comprehensively showcase the overall operational and maintenance status of the data center by combining information such as system alarm volume, alarm percentage, year-on-year alarm comparison, and knowledge base matching rate.

[0026] In some embodiments, a reasonable preset time window can be constructed to periodically and effectively filter massive amounts of pending alarm data. Correlation analysis and clustering of the pending alarm data can be used to mine the relationships between the pending alarm data, quickly locate potentially abnormal services, and facilitate accurate fault location, troubleshooting and repair of cloud-network converged products.

[0027] However, this automated alarm analysis method is biased towards fault location and repair of alarms, and cannot analyze the overall operation of various systems. At the same time, it lacks analysis of the systems belonging to various departments of the data center, making it difficult to analyze the vulnerabilities in the current operation and maintenance management process from a management perspective.

[0028] As can be seen, the data processing of the automated alarm analysis method described in the above embodiments relies on manual operation to extract data from the Information Technology Service Management (ITSM) platform. Furthermore, operations and maintenance personnel need to manually collect alarm records, work order information, and knowledge base matching data from different data sources, resulting in low efficiency and accuracy of alarm data analysis.

[0029] Furthermore, since operation and maintenance management systems typically only provide data statistics for a single time period and lack comparison and trend analysis of historical data, this analytical method makes it difficult for operation and maintenance personnel to determine whether alarms exhibit periodic changes or whether the number of alarms shows a gradual increasing trend, resulting in a lack of month-on-month analysis and trend prediction results.

[0030] The efficiency of alarm work order processing in the operation and maintenance system is also affected by the support and usage of the knowledge base. However, the above-mentioned operation and maintenance alarm analysis method does not perform correlation analysis on the matching between alarm work orders and the knowledge base, and cannot accurately assess the actual contribution of the knowledge base to work order processing efficiency, resulting in insufficient correlation analysis capability between alarms and the knowledge base during the alarm analysis process.

[0031] Furthermore, in the aforementioned alarm analysis process, alarm data is mostly presented in tabular form, which is massive in volume and lacks intuitiveness, making it difficult to quickly extract key information. When dealing with complex alarm data, operations and maintenance personnel must spend a significant amount of time filtering and organizing the data to arrive at effective conclusions, indicating a lack of efficient visualization tools.

[0032] Therefore, current operational alarm management and analysis methods suffer from low data processing efficiency, a lack of automated and sophisticated analysis tools, inability to perform effective month-on-month and trend analysis, insufficient correlation between alarms and knowledge bases, and a lack of intuitive visualization tools. These shortcomings affect the efficiency and quality of operational management, and limit the response speed of the operational team and its ability to predict system risks.

[0033] To address the issues of low efficiency and accuracy in operational alarm analysis, some embodiments of this application provide an automated operational alarm analysis method based on an AI-powered large-scale model. This method can be applied to electronic devices with data processing capabilities. These electronic devices include, but are not limited to, computers, servers, mobile terminals, smart wearable devices, and industrial control units. For ease of description, this application uses an operational management system as the executing entity for the method. It should be understood that the method can also be applied to other types of executing entities, which are not illustrated in all embodiments of this application. Figure 1 As shown, the method includes: S101. Obtain user query information.

[0034] When performing automated analysis of operation and maintenance alarms, you can first obtain user query information input by the user through a specific interaction method. This user query information is natural language text input by the user to submit an alarm analysis request.

[0035] To enable user input, the operation and maintenance management system can set up an input interface to obtain user query information for user input parsing. For example, ... Figure 2 As shown, the operation and maintenance management system can include an architecture design comprising a front-end user interaction module, a back-end data processing module, and a visualization module. The front-end user interaction module, or simply the front-end module, provides a user interface for users to select analysis periods, query historical data, and perform other operations. The back-end data processing module, or simply the back-end module, is responsible for data extraction, cleaning, analysis, and storage, ensuring the efficient execution of automated processing workflows. The visualization module generates visual reports and automatically draws comparison charts matching alarms with the knowledge base.

[0036] The front-end interactive interface is presented through the input interface of the front-end module. Users can submit user queries in the form of natural language text through the front-end interactive interface, either via a chat window or voice input. For example, users can input natural language text such as "Query the average daily alarm volume of each department last week" or "Compare the knowledge base hit rate of System A and System B this month".

[0037] S102. Generate analysis requirement features based on user query information.

[0038] After obtaining user query information, the processing capabilities of large AI models for natural language text can be leveraged to extract features from the user query information, thereby generating analytical requirement features based on the user query information. These analytical requirement features include the target intent category obtained by mapping the user query information to intent categories using the large AI model, and analytical entities extracted from the user query information. Furthermore, analytical entities include at least one of the following: time entities, department entities, system entities, and indicator entities.

[0039] AI Big Model is a large language model that enables natural language interaction between users and operations and maintenance (O&M) management systems. Users can directly query O&M alarm data and analysis results through question-and-answer formats. Based on the AI ​​Big Model, the O&M management system can automatically parse user intent, invoke corresponding function calls, and return structured or natural language responses, improving the usability and interaction efficiency of the O&M management system and reducing the need for manual user operations.

[0040] Large-scale AI models can possess Natural Language Understanding (NLU) capabilities. This means that large-scale AI models can parse user-input natural language questions, identify query intent and key analytical entities, such as time periods, departments, systems, and indicator types.

[0041] The AI ​​big model can also be used for function calls and data retrieval. That is, the operation and maintenance management system can execute function calls based on the parsing results of user query information by the AI ​​big model, so as to automatically call the intelligent agents such as data extraction, statistical analysis or visualization functions inside the system, thereby obtaining relevant data generated by the intelligent agents' analysis.

[0042] Furthermore, the AI ​​large-scale model can also generate and output responses, transforming retrieved data into natural language descriptions or structured formats such as text and charts, and then returning it to the user. It can also maintain the dialogue context through interaction context management to support multi-turn question-and-answer sessions, ensuring the coherence and accuracy of the user's query information.

[0043] In some embodiments, when generating analytical requirement features based on user query information, a large AI model may be invoked first. This large AI model includes a classification model and / or a rule engine. A classification model is a machine learning model used to assign input data to predefined categories or labels. A rule engine is a rule-based data processing system used to process data and make decisions according to predefined rules.

[0044] After invoking the AI ​​big data model, user query information can be mapped to predefined intent categories to determine the target intent category. These predefined intent categories are designed based on statistical analysis functions. Furthermore, the predefined intent categories include at least one of the following: departmental alarm categories, system alarm categories, and knowledge base hit rate categories.

[0045] For example, an operations and maintenance management system can use Natural Language Processing (NLP) technology and large AI models for semantic analysis. This semantic analysis process can include intent recognition and entity extraction. Intent recognition maps user queries to predefined intent categories using classification models or rule engines. These predefined intents are based on the functional design of existing statistical analysis modules, including departmental alarm status, system alarm status, and knowledge base hit rates. Therefore, intent recognition can map user queries to predefined intent categories such as "query alarm statistics" or "compare hit rates."

[0046] Then, a named entity recognition algorithm is used to extract key parameters from the user query information. These parameters are used to determine the entities to be analyzed, and then analytical requirement features are generated based on the analyzed entities and the target intent category. For example, while performing intent recognition, the operations and maintenance management system can also extract entities. During entity recognition, the named entity recognition (NER) algorithm can be used to extract key parameters from the query, including: time entities, department entities, system entities, and indicator entities, etc.

[0047] Among them, time entities refer to the analytical entities determined based on time-related keywords in user query information. That is, the AI ​​big data model can extract time-related keywords such as "last week", "this month", and "October 2023" from user query information, and then standardize the extracted keywords into a time format that can be processed by the operation and maintenance management system, such as "YYYY-MM-DD".

[0048] Similarly, department entities refer to analytical entities determined based on department-related keywords in the user's query information. Keywords such as "Department A" or "Operations and Maintenance Department" can be used to match the department list within the operations and maintenance management system. System entities refer to analytical entities determined based on system-related keywords in the user's query information. Keywords such as "System B" or "Database System" can be used to match the system list within the operations and maintenance management system. Indicator entities refer to analytical entities determined based on data indicator-related keywords in the user's query information. Keywords such as "average daily alarms" or "month-on-month change" are used to map to specific indicators in the statistical analysis module.

[0049] In some embodiments, when generating analytical requirement features based on user query information, after extracting the analytical entities, the entity types of the analytical entities can be traversed, wherein the entity types include necessary entities and unnecessary entities. For example, a time entity can be a necessary entity; while a department entity, system entity, and indicator entity can be unnecessary entities.

[0050] After determining the entity type of the entity to be analyzed, the confidence score of the entity to be analyzed can be obtained, wherein the confidence score is calculated by the AI ​​big model based on the parsing results of the entity to be analyzed.

[0051] The obtained confidence score is then compared with a preset confidence threshold. If the confidence score is higher than the preset threshold, it indicates that the parsing result of the current analyzed entity is reliable, and therefore the analyzed entity can be output to form the analysis requirement features. If the confidence score is lower than the preset threshold, it indicates that the parsing result of the current analyzed entity is unreliable, and therefore query feedback information can be generated and output. This query feedback information is used to request the user to clarify or re-enter the user's query information.

[0052] For example, the operations and maintenance management system can perform confidence assessment during entity extraction. After the AI ​​model outputs the analysis results, the system can simultaneously obtain the corresponding confidence score. If the confidence score is lower than the preset confidence threshold of 0.8, the operations and maintenance management system will request clarification or re-entry from the user through a chat window or voice output.

[0053] In some embodiments, the operation and maintenance management system can also support users to pre-select the analysis period. That is, when generating analysis requirement features based on user query information, time entities can also be read from the analysis entity. If the analysis entity contains a time entity, the time entity can be used as a feature dimension of the analysis requirement features and applied to the subsequent alarm analysis process.

[0054] If the analysis entity does not contain a time entity, the analysis period input by the user can be obtained. This analysis period is the time segment selected by the user based on the settings interface. A time entity is then generated based on the analysis period, and this time entity is used as a feature dimension of the analysis requirement characteristics in subsequent alarm analysis processes.

[0055] For example, such as Figure 3 As shown, the operation and maintenance management system can include a data input module, which can be used to select the data time period to be analyzed. That is, the alarm analysis interface provides multiple time period selection methods, including selection by week, month, or user-defined time period. Users can choose a suitable analysis period according to their actual needs. To this end, the operation and maintenance management system can monitor user interactions. When a user selects a specific week, month, or custom time range through the period selection box provided in the interface, the operation and maintenance management system obtains the selected time period and passes this information to the subsequent data extraction module.

[0056] S103. Match the target analysis function according to the analysis requirements characteristics, and bind the analysis entity to the target analysis function to generate function call instructions.

[0057] After generating the analysis requirement features, the operations and maintenance management system can first perform function matching based on the target intent category and analysis entity in the analysis requirement features to determine the target analysis function. Then, the analysis entities in the analysis requirement features are bound to the target analysis function to generate function call instructions.

[0058] In some embodiments, when performing the matching of target analysis functions based on analysis requirement characteristics and binding analysis entities to target analysis functions to generate function call instructions, a function registry can be obtained first. The function registry includes multiple internal functions, and each internal function includes an execution action field and an execution object field.

[0059] Next, the analysis requirement characteristics are mapped to internal functions in the function registry to obtain the target analysis function. The target analysis function is an internal function whose execution action field is associated with the target analysis intent, and whose execution object field is of the same type as the analysis entity. Then, the analysis entity is used to replace the execution object field in the target analysis function to generate a function call instruction.

[0060] For example, when an operations and maintenance management system makes function calls, it can maintain a function registry in advance according to a function mapping mechanism, and then map the parsed target intent category and analysis entity to the corresponding internal function. The internal function can be implemented based on the extracted business data and statistical analysis results. For instance, an internal function can be represented as "get_department_alerts(time_period, department)" to retrieve alarm data for a specified department and period. Here, "get_department_alerts" is the action field, indicating that the function's specific action is to retrieve department alarm data. "time_period" and "department" are the execution object fields, representing the analysis period and department, respectively.

[0061] Similarly, the internal function "get_system_alerts(time_period, system)" can be used to retrieve alarm data for a specified system and period. The internal function "calculate_knowledge_hit_rate(time_period, department)" can be used to calculate the knowledge base hit rate for a specified department and period. The function registry can also include other similar internal functions to cover all statistical analysis content.

[0062] When performing internal function mapping, the operations and maintenance management system can match the appropriate execution action field based on the target intent category and the execution object field based on the analysis entity. For example, if the target intent category is "analyze department alarm data", it can be mapped to the execution action field of "get_department_alerts"; and the execution object fields of "time_period" and "department" are matched using the time entity "last week" and the department entity "each department", thereby determining the target analysis function as "get_department_alerts(time_period, department)".

[0063] After determining the target analysis function through mapping, the operations and maintenance management system can perform parameter binding. During parameter binding, the extracted analysis entities such as time periods and departments can be bound to function parameters to generate specific function call instructions. For example, for a user query with the text content "average daily alarm volume of each department last week", the operations and maintenance management system can generate a function call instruction with the content "get_department_alerts("last_week", "all")".

[0064] S104. In response to the function call instruction, extract the data to be analyzed from the information service platform.

[0065] After generating the function call instruction, the operation and maintenance management system can respond to the function call instruction and perform data retrieval, that is, in response to the function call instruction, extract the data to be analyzed from the information service platform. The data to be analyzed includes alarm data and knowledge base matching data within a preset analysis period.

[0066] The preset analysis period can be set based on the time entity. That is, after extracting the time entity from the user's query information, the analysis period can be set according to the extracted time entity content. For example, for the user query information with the content "average daily alarm volume of each department last week", the time entity can be extracted as last week, so the analysis period can be set as "last_week" based on the time entity.

[0067] The operations and maintenance management system can execute function calls through the backend module to extract data to be analyzed from the ITSM platform and perform statistical analysis, such as calculating the average daily alarm volume and month-on-month changes. The data retrieval process follows the workflow of the existing data extraction module to ensure data consistency and accuracy.

[0068] To address this, the operations and maintenance management system can incorporate a data extraction module. This module is responsible for exporting alarm data and knowledge base matching data for the selected period from the operations and maintenance management platform (ITSM). For example, the operations and maintenance management system can automatically extract relevant data by connecting to the ITSM platform via an interface. Alarm work order data for the current period can be extracted from the ITSM platform through database queries, including alarm time, alarm type, handling department, and related systems.

[0069] The knowledge base matching data is generated by comparing the metadata extracted from the alarm data with the knowledge tags in the knowledge base according to a preset priority and using enabled matching rules. For example, when acquiring alarm data, the operation and maintenance management system can also simultaneously acquire the knowledge base matching information related to the alarm work orders within that period, including the knowledge base entries matched to the work orders and the matching results.

[0070] In some embodiments, the operation and maintenance management system can also pre-build a knowledge base, that is, first acquire business data and generate knowledge entries based on the business data, wherein the business data includes at least one of technical documents, alarm work orders, and business work orders, and the knowledge entries corresponding to the business data include at least one of general knowledge, alarm knowledge, and business work order knowledge. Then, matching rules are created for the knowledge entries, and the knowledge entries and matching rules are added to the knowledge base, and the knowledge base is stored in the information service platform.

[0071] For example, in building a knowledge base, the knowledge system can be divided first. This involves categorizing business data based on factors such as users and their application scenarios, and then dividing the knowledge system corresponding to the business data into types such as "general knowledge," "alarm knowledge," and "business work order knowledge." General knowledge mainly consists of various technical documents covering new employee training, problem troubleshooting, branch empowerment, system introductions, and knowledge sharing. This type of knowledge can be targeted at maintenance personnel in the technology operations center and technical personnel in various branches.

[0072] Alarm knowledge can encompass alarm handling knowledge and emergency response knowledge. Alarm handling knowledge aims to improve the efficiency of incident ticket processing and covers relevant knowledge such as alarm troubleshooting steps, verification methods, business impact analysis, and handling plans. It can be provided to incident ticket processing personnel, including front-line and second-line support teams. Emergency response knowledge supports the emergency response process, providing emergency thinking prompts and experience accumulation, including emergency troubleshooting paths and handling plan records, and can be provided to duty managers and other emergency participants.

[0073] Business work order knowledge can include business consultation knowledge, data query knowledge, and business transaction knowledge. Business consultation knowledge can provide self-service solutions to business problems for frontline and branch staff through intelligent customer service, improving business processing efficiency; this is available to business personnel at all levels of headquarters and branches. Data query knowledge focuses on efficiently processing business event work orders and data extraction needs, providing relevant query methods and operation guidelines; this is available to business work order processing personnel and data extraction personnel. Business transaction knowledge aims to quickly respond to and resolve problems encountered by headquarters and branch staff during business processing, providing relevant troubleshooting and solution knowledge support; this is available to all business work order processing personnel.

[0074] After the knowledge system is divided, knowledge can be entered. For example, the operation and maintenance management platform can support various entry channels, including manual entry, to-do entry, and batch import, and should have a verification mechanism for the entered content. Manual entry refers to users selecting "Submit Alarm Knowledge" or "Submit Business Work Order Knowledge" through a unified entry module. To-do entry can automatically generate to-do entry work orders based on event work orders and business work orders. Batch import can be initiated by system administrators or knowledge operation personnel through a specific function interface.

[0075] Knowledge entry allows for the creation of multiple knowledge items. By setting matching rules for each knowledge item, a knowledge base can be formed. For example, during rule creation and configuration, the operation and maintenance management system can provide an intuitive visual rule configuration interface, supporting the definition of matching rules through dropdown selection, keyword input, and other methods. Rule conditions can be built based on alarm metadata, including alarm identifiers such as alarm ID, name, and title; alarm attributes such as level, source, host IP, and business system; and alarm content keywords. It supports various matching methods and logical combinations, such as AND operations and OR operations. After creating rules for specific knowledge items, users can verify the accuracy of the rules by inputting simulated alarm data through the rule testing function, ensuring the correctness of the rule configuration.

[0076] Knowledge bases can form a multi-level hierarchical rule system based on multi-level classification standards. For example, a knowledge base can be classified according to a five-level standard, and its rule system can adopt a five-level hierarchical structure, providing a clear logical path for the accurate matching of alarm knowledge.

[0077] The system is structured with five levels: Level 1 defines macro-level technology stack categories, such as databases, business monitoring, cloud technologies, and middleware, serving as a primary knowledge classification filter. Level 2 corresponds to specific monitoring tools or system names within the technology stack, such as MySQL, Kafka, and AWS RDS, further narrowing the matching scope. Level 3 refines the details to the specific content or metrics detected by the monitoring tools, such as CPU utilization, connection overflow, and slow query count. Level 4 includes customizable distinctions to accommodate differentiated handling solutions arising from variations in environment, version, and business module for the same monitoring content. Level 5 ultimately links to the specific knowledge item itself. Through this hierarchical rule structure, the operations and maintenance management system can construct highly specific matching paths, ensuring that each alert can accurately pinpoint a unique knowledge solution.

[0078] Based on the knowledge base described in the above embodiments, the operation and maintenance management system can obtain knowledge base matching data during the extraction of data to be analyzed. Specifically, in some embodiments, when executing a function call instruction to extract data to be analyzed from the information service platform, alarm data can be extracted from the information service platform and matching rules can be enabled according to the function call instruction, and then metadata can be extracted from the alarm data. The metadata includes alarm identifiers, alarm attributes, and alarm content keywords.

[0079] Then, based on a preset priority, the metadata is compared sequentially with the enabled matching rules to determine the matching rule base. Multi-level knowledge tags are then generated according to the matching rule base. These multi-level knowledge tags are used to construct matching paths based on the hierarchical rule structure of the rule system. Knowledge categories are then obtained by comparing the multi-level knowledge tags, and knowledge tag category rules are matched based on these categories to determine the matching knowledge that meets the conditions. Finally, knowledge base matching data is generated based on the number of matching knowledge items.

[0080] The operations and maintenance management system can perform rule enforcement and knowledge matching based on a built knowledge base. To this end, the system can automatically match alarm metadata with all enabled rules. During the automatic matching process, a priority ranking mechanism can be used to ensure the uniqueness of the output results.

[0081] When executing rules and matching knowledge, metadata is first extracted from alarm tickets and compared sequentially with all enabled matching rules according to priority, then five-level tags are generated. Next, knowledge tags are compared and matched against knowledge tag category rules. Finally, knowledge that meets the criteria is displayed. If no rule matches, an empty result or a default knowledge list is returned.

[0082] For example, the operations and maintenance management system can first extract the metadata of the alarm from the alarm event ticket, including the topic, description, affected system, host IP, etc. Then, the extracted metadata is compared with all enabled matching rules in order of priority.

[0083] Then, knowledge tags are generated according to the matching rule base. The rule system adopts a five-level hierarchical structure. Through this progressive rule structure, the system can construct highly specific matching paths, ensuring that each alarm can accurately locate a unique knowledge solution.

[0084] Next, knowledge tags are compared to obtain knowledge categories, and knowledge tag category rules are matched. A second matching is performed on the results of the five-level classification, covering dimensions such as the knowledge's group and matching scope. Then, knowledge that meets all the conditions is displayed, thus obtaining knowledge base matching data. If no rule matches, the displayed knowledge base matching data is empty.

[0085] The alarm information can be used to determine the alarm type. The alarms that can be generated include the following: Affected system, automated marketing platform; Event topic: MySQL replication latency exceeds threshold; Event description: Replication latency threshold is greater than 60; The alarm type is confirmed as database through the event topic, and the specific alarm content is confirmed through the alarm description.

[0086] After data extraction, the operation and maintenance management system can also perform basic cleaning and formatting on the data to be analyzed to ensure data quality and consistency.

[0087] S105. Perform statistical analysis on the data to be analyzed according to the objective analysis function to generate statistical analysis results.

[0088] After extracting the data to be analyzed, the operation and maintenance management system can perform statistical analysis on the data according to the target analysis function to generate statistical analysis results. To this end, the operation and maintenance management system can have a built-in data statistical analysis module. This module is responsible for performing statistical analysis on the extracted data and generating relevant alarm information and knowledge base hit rate analysis results. The analysis content can include alarm information for each department, alarm information for each system, and knowledge base hit rate for each department, etc.

[0089] For example, in the process of statistical analysis of alarms from various departments, the operation and maintenance management system can determine statistical analysis results such as the average daily alarm volume, the average daily percentage of alarm work orders, the average daily percentage of the previous month, the month-on-month change in the average daily volume, and the main alarm types. The average daily alarm volume can be obtained by statistically analyzing the number of alarms in each department each day within the current period, combined with the statistical time. The average daily percentage of alarm work orders is obtained by statistically analyzing the proportion of each department's daily alarm work orders to the total number of alarm work orders in the entire system. The average daily percentage of the previous month is obtained by calculating and comparing the department's average daily alarm volume percentage from the previous month, used to analyze month-on-month changes. The month-on-month change in the average daily volume can be obtained by comparing the statistical analysis results of the current period with those of the previous month to determine the rate of increase or decrease in the average daily alarm volume. The main alarm types are obtained by statistically analyzing the distribution of alarm types for each department, used to list the types of alarms with the highest alarm volume.

[0090] Statistics on alarms for each system can include: daily average alarm volume (the average daily alarm volume for each system within the specified period); alarm work order ratio (the percentage of alarm work orders for each system relative to the total number of alarm work orders for the entire system); previous month's daily average alarm volume (calculating the average daily alarm volume for each system in the previous month and comparing the month-on-month change); month-on-month change (calculating the rate of increase or decrease in the average daily alarm volume for the system compared to the previous month); and main alarm types (identifying the most common alarm types for each system and identifying the main risk points of system alarms).

[0091] The knowledge base hit rate statistics for each department can include: the number of alarm work orders (the number of alarm work orders processed by each department within the current period); the number of knowledge base matching work orders (the number of alarm work orders from each department that matched the knowledge base); the current period's knowledge base hit rate (the proportion of successfully matched alarm work orders to the total number of alarm work orders); the previous month's average daily knowledge base hit rate (the knowledge base hit rate of each department in the previous month, used as a benchmark); and the month-on-month change in hit rate (the increase or decrease in hit rate by comparing the current period's hit rate with the previous month's hit rate).

[0092] By applying the technical solutions of the above embodiments, the AI-based large model-based automated analysis method for operation and maintenance alarms described in the above embodiments can automatically extract alarm data and knowledge base matching information within a specific period from the ITSM system in an automated manner, and realize the automatic statistics and calculation of various indicators, which greatly shortens the data processing time, avoids errors from manual operation, and significantly improves the efficiency and accuracy of data processing.

[0093] Furthermore, it provides refined, multi-dimensional alarm data analysis, offering detailed and multi-dimensional analysis of alarm data across departments and systems, including indicators such as average daily alarm volume, work order ratio, month-on-month changes, and major alarm types. This not only helps operations teams quickly identify problematic departments or systems but also provides management with crucial data support to develop more targeted operations improvement plans, thereby enhancing overall operations efficiency.

[0094] The method can also conduct in-depth analysis of the matching between alarm work orders from various departments and the knowledge base, providing statistical results and month-on-month changes in the knowledge base hit rate. This analysis helps the operations team assess the efficiency of the knowledge base and identify areas for optimization in actual operations, thereby improving work order processing efficiency and response quality.

[0095] Furthermore, the method can effectively evaluate the operational performance of each department in different periods by comprehensively statistically analyzing the alarm volume and knowledge base hit rate of each department, clarify the differences between departments in alarm management and knowledge base usage, provide management with objective performance data reference, and help to formulate more reasonable operation and maintenance optimization strategies and resource allocation plans.

[0096] In some embodiments, as a refinement and extension of the specific implementation of the above embodiments, and to fully illustrate the specific implementation process of this embodiment, some embodiments of this application also provide an automated analysis method for operation and maintenance alarms based on an AI large model. The difference between this method and the above embodiments is that, when performing statistical analysis on the data to be analyzed according to the target analysis function, multimodal analysis results can be output, such as... Figure 4 As shown, the method includes: S201. Convert the data to be analyzed into structured format data; S202. Perform statistical analysis on the structured data using the objective analysis function to generate statistical analysis results; S203, Method for obtaining and outputting results; S204. According to the output method, use the AI ​​big model to convert the statistical analysis results into natural language response information; S205. Output natural language response information.

[0097] When the target analysis function performs statistical analysis on the data to be analyzed, the operation and maintenance management system can first convert the data to be analyzed into structured format data, wherein the structured format data includes at least one of indicator value field and timestamp field.

[0098] For example, when generating and outputting responses, the operation and maintenance management system can use data formatting to convert the retrieved data to be analyzed into a structured format such as JSON or a dictionary, resulting in structured data. Structured data can contain fields such as metric values ​​and timestamps.

[0099] Following the statistical analysis method described in the above embodiments, a target analysis function is used to perform statistical analysis on the structured data to generate statistical analysis results. Then, the result output method is obtained, wherein the result output method is identified from at least one piece of information in the user query information and the multi-turn dialogue context of the user query information.

[0100] For example, the operations and maintenance management system can utilize large AI models for context management and multi-turn question answering. The system can use dialogue management components based on state machines or reinforcement learning to track dialogue states, maintaining the context and recording the intent, entities, and historical responses of the current query. Furthermore, it supports multi-turn interactions, allowing users to build upon previous responses for subsequent queries, such as asking "How has the month-on-month change changed?" after querying "The number of alarms for department A last week." The system automatically inherits the context, eliminating the need to repeatedly specify parameters. In addition, the operations and maintenance management system can perform session timeout determination and reset. By setting a session timeout period, such as 30 minutes, the system automatically resets the context after the dialogue times out, ensuring data security and preventing interference between unrelated dialogues.

[0101] By extracting features from user query information and contextual information, the output method can be determined. For example, the output method can be multimodal, supporting multiple formats, including text output and visualization output. Text output can directly display natural language descriptions in the chat interface; visualization output can automatically call the data export and visualization module to generate more intuitive output content for complex queries such as comparing alarm volumes across multiple departments.

[0102] Then, according to the output method, the statistical analysis results are transformed into natural language response information using a large AI model, thereby outputting natural language response information. This natural language response information includes at least one of text output information and visual output information.

[0103] For example, based on Natural Language Generation (NLG) technology, the operations and maintenance management platform can use large AI models to transform structured data into natural language responses. For instance, it can generate a natural language response from the daily average alarm data as "Last week, Department A's daily average alarm volume was 15, an increase of 10% compared to the previous week."

[0104] In some embodiments, in order to generate natural language response information, the operation and maintenance management system can extract historical related data based on the data to be analyzed, wherein the historical related data is data of the same type as the data to be analyzed.

[0105] Then, by comparing the data to be analyzed with historical related data, comparative results are generated, including information on month-on-month changes. Next, a visualization tool is used to generate comparative graphs based on the results. Finally, the comparative graphs, comparative results, the data to be analyzed, and historical related data are input into the AI ​​model to generate natural language response information.

[0106] For example, when performing multimodal output, for text output, natural language descriptions can be displayed directly in the chat interface. For visualization output, when faced with user queries such as "comparing alarm volumes across multiple departments," the data export and visualization module can be automatically invoked to generate Excel charts or embedded charts, such as bar charts, and return chart links or previews.

[0107] To this end, the operation and maintenance management system can also have a built-in data export and visualization module. This module can output the statistical analysis results in the form of Excel reports and generate various data visualization charts in Excel, making it easier for the operation and maintenance team to view and analyze data changes intuitively.

[0108] When generating the Excel file, the openpyxl library can be used to write the analysis results into a tabular format, with data for each department and system stored in separate worksheets. Then, bar charts are created. Using openpyxl's charting capabilities, bar charts are automatically generated in Excel, displaying a comparison of the average daily alarm volume for each department and system during the current period and the previous month, as well as changes in the knowledge base hit rate. The bar charts are automatically generated on the right side of the corresponding tables, facilitating intuitive data comparison.

[0109] In addition, for error data handling, the operation and maintenance management system can return error information, such as a natural language response message with the content "No data found for the specified time", when the query cannot be parsed or the data is missing, and prompt the user to rephrase the query.

[0110] By applying the technical solutions of the above embodiments, the AI-based large-scale model-based automated analysis method for operation and maintenance alarms described in the above embodiments supports comparative analysis and trend prediction of historical data. It can store the alarm data and knowledge base matching results for each period and supports retrospective and comparative analysis of historical data. By comparing data from multiple periods, potential alarm trends or anomalies can be discovered, helping the operation and maintenance team to identify possible system risks or bottlenecks in advance, thereby enabling effective planning and prevention of future operation and maintenance work.

[0111] The method can also automatically generate visual reports and plot bar charts and other visual graphs within these reports to intuitively display changes in the average daily alarm volume and knowledge base hit rate for each department and system. Operations and maintenance personnel can use these visual charts to quickly understand data trends over different time periods, facilitating rapid and accurate decision-making and improving the decision-making efficiency of the operations and maintenance team.

[0112] In some embodiments, as a specific implementation of the AI-based large-scale model-based automated analysis method for operation and maintenance alarms described in the above embodiments, some embodiments of this application also provide an AI-based large-scale model-based automated analysis system for operation and maintenance alarms, such as... Figure 5 As shown, the system includes: The data input module is used to obtain user query information, which is natural language text input by the user to submit alarm analysis requests; The feature generation module is used to generate analysis requirement features based on the user query information. The analysis requirement features include a target intent category obtained by performing intent category mapping on the user query information using an AI large model, and analysis entities extracted from the user query information. The analysis entities include at least one of time entities, department entities, system entities, and indicator entities. The function call module is used to match the target analysis function according to the analysis requirement characteristics, and to bind the analysis entity to the target analysis function to generate function call instructions; The data extraction module is used to extract data to be analyzed from the information service platform in response to the function call instruction. The data to be analyzed includes alarm data and knowledge base matching data within a preset analysis period. The preset analysis period is set according to the time entity. The knowledge base matching data is a comparison result generated by comparing the metadata extracted from the alarm data with the enabled matching rules according to a preset priority and knowledge tags in the knowledge base. The data statistical analysis module is used to perform statistical analysis on the data to be analyzed according to the target analysis function, so as to generate statistical analysis results.

[0113] By applying the technical solutions of the above embodiments, the AI-based large-scale model-based automated operation and maintenance alarm analysis system described in the above embodiments can, after the data input module obtains user query information, the feature generation module generates analysis requirement features containing target intent categories and analysis entities based on the user query information. The function call module then matches the target analysis function according to the analysis requirement features and generates function call instructions by binding the analysis entities to the target analysis function. Then, the data extraction module extracts alarm data and knowledge base matching data from the information service platform according to the function call instructions, enabling the data statistical analysis module to perform statistical analysis on the data according to the target analysis function to generate statistical analysis results. The system can automatically trigger the extraction of alarm data and knowledge base matching data based on the AI ​​large-scale model, realize in-depth analysis of multi-dimensional data, provide statistical analysis results of knowledge base hit rate and month-on-month change information, shorten data analysis time, and improve the efficiency and accuracy of operation and maintenance alarm analysis.

[0114] It should be noted that other corresponding descriptions of the functional units involved in the AI-based large model-based automated analysis system for operation and maintenance alarms provided in this application embodiment can be found in the corresponding descriptions in the AI-based large model-based automated analysis method for operation and maintenance alarms provided in the above embodiments, and will not be repeated here.

[0115] This application also provides a computer device, specifically a personal computer, server, network device, etc. The computer device includes a bus, processor, memory, and communication interface, and may also include input / output interfaces and a display device. The processor of the computer device provides computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The database of the computer device stores location information. The network interface of the computer device is used for communication with external terminals via a network connection. When the computer program is executed by the processor, it implements the steps in the various method embodiments.

[0116] Those skilled in the art will understand that the structure of the computer device described above is only a partial structure related to the solution of this application, and does not constitute a limitation on the computer device to which the solution of this application is applied. A specific computer device may include more or fewer components, or combine certain components, or have different component arrangements.

[0117] In one embodiment, a computer-readable storage medium is also provided, which may be non-volatile or volatile, and a computer program is stored thereon, which, when executed by a processor, implements the steps in the above method embodiments.

[0118] In one embodiment, a computer program product is also provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0119] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0120] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above methods.

[0121] Any references to memory, database, or other media used in the embodiments provided in this application may include at least one of non-volatile and volatile memory. Non-volatile memory may include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc.

[0122] Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM can take many forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM).

[0123] The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, distributed databases based on blockchain. The processors involved in the embodiments provided in this application may be, but are not limited to, general-purpose processors, graphics processors, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc.

[0124] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0125] The embodiments described above are merely examples of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these modifications and improvements all fall within the protection scope of this application.

Claims

1. An automated analysis method for operation and maintenance alarms based on an AI-powered large-scale model, characterized in that, The method includes: Obtain user query information, which is natural language text input by the user to submit alarm analysis requests; Analysis requirement features are generated based on the user query information. The analysis requirement features include target intent categories obtained by performing intent category mapping on the user query information using an AI large model, and analysis entities extracted from the user query information. The analysis entities include at least one of time entities, department entities, system entities, and indicator entities. Match the target analysis function according to the analysis requirement characteristics, and bind the analysis entity to the target analysis function to generate function call instructions; In response to the function call instruction, data to be analyzed is extracted from the information service platform. The data to be analyzed includes alarm data and knowledge base matching data within a preset analysis period. The preset analysis period is set according to the time entity. The knowledge base matching data is a comparison result generated by comparing the metadata extracted from the alarm data with the knowledge tags in the knowledge base according to a preset priority and the enabled matching rules. The data to be analyzed is statistically analyzed according to the target analysis function to generate statistical analysis results.

2. The method according to claim 1, characterized in that, Based on the user query information, analyze the required features, including: Call upon a large AI model, which includes a classification model and / or a rule engine; The AI ​​big data model maps the user query information to predefined intent categories to determine the target intent category; the predefined intent categories are designed based on statistical analysis functions; the predefined intent categories include at least one of department alarm categories, system alarm categories, and knowledge base hit rate categories; A named entity recognition algorithm is used to extract key parameters from the user query information in order to determine the analysis entity based on the key parameters. The analysis requirement features are generated based on the analysis entity and the target intent category.

3. The method according to claim 2, characterized in that, The generation of analytical requirement features based on the user query information also includes: Iterate through the entity types of the analyzed entity, where the entity types include necessary entities and unnecessary entities; Obtain the confidence score of the analyzed entity whose entity type is the necessary entity. The confidence score is calculated by the AI ​​big model based on the parsing results of the analyzed entity. If the confidence score is lower than a preset confidence threshold, query feedback information is generated and output; the query feedback information is used to request the user to clarify or re-enter the user query information.

4. The method according to claim 2, characterized in that, The generation of analytical requirement features based on the user query information also includes: Read the time entity from the analysis entity; If the analysis entity does not contain the time entity, obtain the analysis period, which is the time period selected by the user based on the settings interface; The time entity is generated based on the analysis period.

5. The method according to claim 1, characterized in that, Matching a target analysis function based on the analysis requirement characteristics, and binding the analysis entity to the target analysis function to generate function call instructions, includes: Obtain a function registry, which includes multiple internal functions; each internal function includes an execution action field and an execution object field. The analysis requirement features are mapped to the internal functions in the function registry to obtain the target analysis function; the target analysis function is an internal function in which the execution action field is associated with the target analysis intent and the execution object field is of the same type as the analysis entity. The analysis entity is used to replace the execution object field in the target analysis function to generate the function call instruction.

6. The method according to claim 1, characterized in that, The method further includes: Acquire business data, which includes at least one of technical documents, alarm work orders, and business work orders; Knowledge entries are generated based on the business data, and the knowledge entries include at least one of general knowledge, alarm knowledge, and business work order knowledge. Create matching rules for the knowledge entries; The knowledge entries and matching rules are added to the knowledge base, and the knowledge base is stored in the information service platform.

7. The method according to claim 6, characterized in that, In response to the function call instruction, the data to be analyzed is extracted from the information service platform, including: The alarm data is extracted from the information service platform and the matching rule is activated according to the function call instruction; Metadata is extracted from the alarm data, including alarm identifier, alarm attributes, and alarm content keywords; Based on a preset priority, the metadata is compared with the enabled matching rules in sequence to determine the matching rule base; Multi-level knowledge tags are generated according to the matching rule base; the multi-level knowledge tags are used to construct matching paths based on the hierarchical rule structure of the rule system; Knowledge categories are obtained by comparing the multi-level knowledge tags; Based on the knowledge category matching knowledge tag category rules, the matching knowledge that meets the conditions is determined, and the knowledge base matching data is generated according to the number of matching knowledge.

8. The method according to claim 1, characterized in that, Statistical analysis is performed on the data to be analyzed according to the target analysis function to generate statistical analysis results, including: The data to be analyzed is converted into structured format data, which includes at least one of indicator value fields and timestamp fields; The target analysis function is used to perform statistical analysis on the structured data to generate the statistical analysis results; The result output method is obtained from the user query information and / or the multi-turn dialogue context of the user query information; According to the output method described above, the statistical analysis results are converted into natural language response information using the AI ​​large model; the natural language response information includes at least one of text output information and visual output information. Output the natural language response information.

9. The method according to claim 8, characterized in that, According to the output method described above, the statistical analysis results are converted into natural language response information using the AI ​​large model, including: Historical related data is extracted from the data to be analyzed, and the historical related data is data of the same type as the data to be analyzed. By comparing the data to be analyzed with the historical related data, a comparison result is generated, which includes month-on-month change information; Using a visualization output tool, generate comparison graphs based on the comparison results; The comparison graph, the comparison result, the data to be analyzed, and the historical correlation data are input into the AI ​​big model to generate the natural language response information using the AI ​​big model.

10. An automated analysis system for operation and maintenance alarms based on an AI large-scale model, characterized in that, The system includes: The data input module is used to obtain user query information, which is natural language text input by the user to submit alarm analysis requests; The feature generation module is used to generate analysis requirement features based on the user query information. The analysis requirement features include a target intent category obtained by performing intent category mapping on the user query information using an AI large model, and analysis entities extracted from the user query information. The analysis entities include at least one of time entities, department entities, system entities, and indicator entities. The function call module is used to match the target analysis function according to the analysis requirement characteristics, and to bind the analysis entity to the target analysis function to generate function call instructions; The data extraction module is used to extract data to be analyzed from the information service platform in response to the function call instruction. The data to be analyzed includes alarm data and knowledge base matching data within a preset analysis period. The preset analysis period is set according to the time entity. The knowledge base matching data is a comparison result generated by comparing the metadata extracted from the alarm data with the enabled matching rules according to a preset priority and knowledge tags in the knowledge base. The data statistical analysis module is used to perform statistical analysis on the data to be analyzed according to the target analysis function, so as to generate statistical analysis results.

Images