Alarm storm root cause positioning method and system, storage medium, computer device

Abstract

The application relates to the technical field of intelligent operation and maintenance, can be applied to the technical field of financial technology, and discloses an alarm storm root cause positioning method and system, a storage medium and a computer device. The method comprises the following steps: calling a business system dependency relationship topology graph, pulling performance time sequence data, collecting alarm logs of alarm events, extracting a text type alarm semantic vector, a time sequence type performance characteristic vector and the business system dependency relationship topology graph, and generating a multi-modal correlation matrix; inputting the multi-modal correlation matrix into a near-end strategy optimization agent as a business system global multi-modal state view; filtering redundant nodes with low correlation degrees with the alarm storm by the near-end strategy optimization agent; outputting an alarm storm root cause node recommendation sequence with priority labels; and mapping text, time sequence and graph structure type alarm information to a semantic space, constructing a multi-modal correlation matrix for alarm storm analysis, eliminating information islands, and improving the efficiency and accuracy of operation and maintenance personnel in positioning alarm root causes.

Description

Technical Field

[0001] This application relates to the field of intelligent operation and maintenance technology, and in particular to a method and system for locating the root cause of alarm storms, storage media, and computer equipment. Background Technology

[0002] As the central hub of business operations, the core insurance system carries key processes such as policy underwriting, claims settlement, and reinsurance settlement. Its stability directly affects customer service experience and corporate solvency.

[0003] However, in current insurance operations and maintenance, system alarms are showing a "storming" trend, with business alarms such as underwriting rule conflicts and quotation failures mixed with technical alarms such as database deadlocks and storage IOPS exceeding limits. At the same time, the daily alarm volume exceeds 10,000, most of which are invalid and redundant alarms.

[0004] A massive influx of invalid alerts can drown out genuine core fault signals, making it difficult for operations and maintenance personnel to quickly locate critical issues such as database deadlocks and excessive storage IOPS. This directly increases the risk of core business interruptions, leading to issues like order processing delays and claims processing delays. Furthermore, the alert storm can distract operations and maintenance personnel, and when minor issues are not addressed promptly, they can easily escalate into system-level failures, impacting 24 / 7 business operations and even causing RTO and RPO targets to fail, resulting in compliance issues such as maintenance errors and reserve provision deviations. In addition, system failures can also lead to direct economic losses such as lost orders and incorrect business transactions, and widespread service anomalies can impact client-side experiences, affecting user experience. Summary of the Invention

[0005] In view of this, this application provides a method and system for locating the root cause of alarm storms, a storage medium, and a computer device. By uniformly mapping text, time-series, and graph-structured alarm information to a semantic space, a multimodal correlation matrix is ​​constructed for alarm storm analysis, which can eliminate information silos and improve the efficiency and accuracy of operation and maintenance personnel in locating the root cause of alarms.

[0006] According to one aspect of this application, a method for locating the root cause of an alarm storm is provided, the method comprising: When a business system generates multiple alarm events within a preset time window, forming an alarm storm, a pre-built and continuously dynamically updated business system dependency topology graph is retrieved. The performance time-series data of the business system within the preset time window is pulled, and alarm logs associated with each alarm event are collected synchronously. The business system dependency topology graph consists of nodes and edges. Nodes represent business entities, which include the business services of the business system and the hardware devices that carry the business services. Edges represent the calling relationships between business entities and the flow of business data generated by the business entities. The alarm logs are semantically encoded to obtain text-based alarm semantic vectors. Time-series performance feature vectors are extracted based on performance time-series data within a preset time window. The latest graph structure node embedding vectors of each node are obtained based on the business system dependency topology graph. A multimodal correlation matrix is ​​constructed based on text-based alarm semantic vectors, time-series performance feature vectors, and graph-structured node embedding vectors. The multimodal association matrix is ​​used as input to the global multimodal state view of the business system to train the converged proximal policy optimization agent. Based on the global multimodal state view of the business system, the proximal policy optimization agent filters redundant nodes in each node of the business system dependency topology graph and outputs a recommended sequence of alarm storm root cause nodes with priority labels. This allows business system operation and maintenance personnel to complete the root cause location of alarm storms through the recommended sequence of alarm storm root cause nodes.

[0007] According to another aspect of this application, an alarm storm root cause localization system is provided, the system comprising: The multi-source heterogeneous data acquisition module is used to retrieve a pre-built and continuously dynamically updated business system dependency topology graph when the business system generates multiple alarm events within a preset time window, forming an alarm storm. It also retrieves the performance time-series data of the business system within the preset time window and synchronously collects the alarm logs associated with each alarm event. The business system dependency topology graph consists of nodes and edges. Nodes represent business entities, including the business services of the business system and the hardware devices that carry the business services. Edges represent the calling relationships between business entities and the flow of business data generated by the business entities. The multimodal feature vector extraction module is used to semantically encode alarm logs to obtain text-based alarm semantic vectors, extract time-series performance feature vectors based on performance time-series data within a preset time window, and obtain the latest graph structure node embedding vectors for each node based on the business system dependency topology graph. The cross-modal semantic alignment and fusion module is used to construct a multimodal correlation matrix based on text-based alarm semantic vectors, time-series performance feature vectors, and graph-structured node embedding vectors. The intelligent root cause reasoning output module is used to train a converged proximal policy optimization agent by taking the multimodal association matrix as input to the global multimodal state view of the business system. Based on the global multimodal state view of the business system, the proximal policy optimization agent filters redundant nodes in each node of the business system dependency topology graph and outputs a recommended sequence of alarm storm root cause nodes with priority labels, so that business system operation and maintenance personnel can identify the root cause nodes of the alarm storm.

[0008] According to another aspect of this application, a storage medium is provided that stores a computer program thereon, which, when executed by a processor, implements the above-described alarm storm root cause localization method.

[0009] According to another aspect of this application, a computer device is provided, including a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor, wherein the processor executes the program to implement the above-described alarm storm root cause localization method.

[0010] By employing the above technical solutions, this application provides an alarm storm root cause localization method and system, storage medium, and computer equipment. By uniformly mapping text, time-series, and graph-structured alarm information to a semantic space and constructing a multimodal correlation matrix for alarm storm analysis, it can eliminate information silos and improve the efficiency and accuracy of operation and maintenance personnel in locating alarm root causes.

[0011] The above description is only an overview of the technical solution of this application. In order to better understand the technical means of this application and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this application more obvious and understandable, the following are specific embodiments of this application. Attached Figure Description

[0012] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings: Figure 1 This illustration shows an application environment diagram provided by an embodiment of this application; Figure 2 A flowchart illustrating a method for locating the root cause of an alarm storm, as provided in an embodiment of this application, is shown. Figure 3 This illustration shows a flowchart of a proximal policy optimization agent for causal reasoning according to an embodiment of this application; Figure 4 This paper shows a schematic diagram of the structure of an alarm storm root cause localization system provided in an embodiment of this application; Figure 5 This illustration shows a schematic diagram of a computer device structure provided in an embodiment of this application; Figure 6 This illustration shows another computer device structure provided in an embodiment of this application. Detailed Implementation

[0013] The present application will be described in detail below with reference to the accompanying drawings and embodiments. It should be noted that, unless otherwise specified, the embodiments and features described in the embodiments of the present application can be combined with each other.

[0014] The method provided in this application embodiment can be applied to, for example, Figure 1In the application environment, for intelligent root cause localization scenarios facing alarm storms in business systems, the entire implementation is deployed and run based on a three-tier infrastructure of end-to-network-to-server, providing operations and maintenance personnel with automated root cause troubleshooting support capabilities. Figure 1 In detail: The client can be deployed on the operation side of the operation and maintenance personnel. It is the final result interaction network element of the entire process. The operation and maintenance personnel can complete the access operation through the client. They can view the recommended sequence of alarm storm root cause nodes with priority labels in the final output of the backend and directly complete the alarm root cause location work. They can also issue operation and maintenance instructions such as topology rule updates and performance baseline configuration through the client.

[0015] The network is the intermediate transmission bearer element in the entire link, responsible for bidirectional communication between the client and the server. The entire process of data interaction, including alarm logs, performance time-series data, root cause recommendation results, and various operation and maintenance instructions, is completed through the network link.

[0016] The server is the core execution entity in this embodiment. The business system dependency topology graph, alarm data collection module, multimodal feature extraction module, multimodal association matrix construction module, and the near-end policy optimization agent for training convergence are all built-in and deployed within the server. The server directly connects to all backend business entities, including various upper-layer business services and the underlying hardware devices supporting these services. It completes the entire computational process in a closed loop: alarm event collection, performance data retrieval within a specified time window, generation of three types of multimodal feature vectors, removal of non-core irrelevant nodes, and output of root cause recommendation sequences. Finally, the generated root cause recommendation sequences are pushed to the client via the network for direct display and use by operations and maintenance personnel. The core computational process is entirely completed within the server, ensuring efficient processing of massive amounts of operational monitoring data while preventing the leakage of sensitive business operation data.

[0017] This embodiment provides a method for locating the root cause of alarm storms, such as... Figure 2 As shown, the method includes: Step 101: When the business system generates multiple alarm events within a preset time window, forming an alarm storm, the pre-built and continuously dynamically updated business system dependency topology graph is retrieved, the performance time-series data of the business system within the preset time window is pulled, and the alarm logs associated with each alarm event are collected synchronously. The business system dependency topology graph consists of nodes and edges. Nodes represent business entities, and business entities include the business services of the business system and the hardware devices that carry the business services. Edges represent the calling relationships between business entities and the flow of business data generated by the business entities.

[0018] Currently, traditional operation and maintenance tools only support single-modal analysis, such as log retrieval or indicator monitoring, and cannot correlate business semantics with technical faults. As a result, root alarms rely on human experience for localization, and the average repair time is more than 4 hours. In the insurance business, especially during business fluctuations such as "opening sales" or "disaster claims peak", the false alarm rate is high and often causes a squeeze on operation and maintenance resources. It can even lead to compliance risks such as delays in regulatory reporting, affecting the normal operation of insurance business systems.

[0019] In the above embodiments of this application, it can be applied to insurance business scenarios. When the core insurance business system generates multiple alarm events within a preset time window, forming an alarm storm, a pre-built and continuously dynamically updated insurance business system dependency topology diagram is retrieved. Performance time-series data of the entire insurance business entity within the preset time window is pulled, and alarm logs associated with each alarm event are collected synchronously to complete the collection and standardization of three types of core data. Specifically: For business alarm text collection, we can collect all unstructured alarm logs from insurance-specific business systems such as underwriting, reinsurance, claims, and online sales systems. Typical content includes "auto insurance personal injury case investigators failed to submit reports within the time limit" and "backlog of health insurance policy underwriting requests during the sales season". Through regular expressions and insurance-specific named entity recognition (NER) models, we can accurately extract key elements such as policy number, insurance type, premium amount, alarm trigger timestamp, and related business services, and complete the structured conversion of unstructured alarm text.

[0020] For the collection of technical monitoring metrics, it can connect to operation and maintenance monitoring tools such as Prometheus and Zabbix to collect full performance time-series data corresponding to insurance business entities, covering core metrics such as database QPS, slow query time, application server CPU (Central Processing Unit) / memory utilization, network bandwidth, and storage IOPS (Input / Output Operations Per Second). All time-series data are uniformly anchored to the corresponding business entities and tagged according to the dimension of "insurance business scenario - system component". Typical tags are such as "number of core DB connections of online sales platform during the opening red period" and "bandwidth utilization rate of car insurance claims image upload service".

[0021] For system topology relationship collection, a pre-built and continuously dynamically updated insurance business system dependency topology graph can be retrieved. This topology graph is based on the continuous iteration of configuration data from the insurance industry's CMDB (Configuration Management Database) and is persistently stored in a Neo4j graph database. Nodes represent the full-chain business entities of insurance, covering business services such as underwriting rule engines and claims image services, as well as hardware devices such as physical servers, storage arrays, and database clusters that support these services. Edges represent the call relationships between business entities and the flow of insurance business data. A typical link is "policy underwriting service — underwriting rule engine — core transaction DB (Database) cluster — distributed storage array".

[0022] The preset time window can be any value between 5 and 10 minutes, which can fully cover the propagation cycle of cascading alarms without introducing too much historical noise.

[0023] In particular, business data in the insurance scenario, such as core business data that specifically refers to the entire process of insurance business flow, typically includes: policy underwriting data, premium transaction flow data, claims case acceptance data, reinsurance settlement data, customer insurance information data, and claims assessment image flow data for various types of insurance such as auto insurance, health insurance, and life insurance. The flow of this type of data will be directly reflected in the edge attributes of the topology graph. For example, "the online sales policy issuance service transmits new policy application data to the underwriting engine", which is a typical business data flow edge.

[0024] In insurance scenarios, alarm storms can occur during periods of high insurance business load (such as peak sales seasons, end-of-month settlements, and concentrated renewal periods for auto insurance). Within a preset time window, a failure of a core business entity can trigger dozens or even hundreds of cascading alarms in a short period of time. For example, when the core underwriting database goes down, it can simultaneously trigger a large number of derivative alarms such as policy issuance service timeouts, underwriting interface failures, and claims submission anomalies. The massive number of alarms can instantly overwhelm the true root cause signal, making it impossible for operations and maintenance personnel to quickly locate the fault and directly affecting the continuity of core insurance business.

[0025] Regarding alarm events, they are continuous anomaly notification units generated by the operation and maintenance monitoring system after detecting anomalies in insurance business entities. They are aggregated from multiple similar anomaly points and are used to clearly mark the business entity where the anomaly occurred, the type of anomaly, the scope of impact, and other information. For example, "underwriting database connection limit exceeded" and "claims service CPU utilization exceeded the standard" are typical insurance operation and maintenance alarm events.

[0026] Specifically, Queries Per Second (QPS) refers to the total number of query requests a server can handle per second. It is a core indicator of a system's read operation resilience; a higher value means the system can respond to more query requests per unit of time. Slow query latency refers to the total execution time of SQL (Structured Query Language) statements in the database that exceed a preset threshold. It is a key indicator reflecting database query efficiency; excessive latency usually indicates inefficient query logic. Application server CPU utilization refers to the percentage of time the CPU is occupied by program tasks within a certain period, directly reflecting the CPU's workload. Prolonged high utilization can lead to a significant decrease in system processing speed. Application server memory utilization refers to the percentage of memory currently occupied by programs relative to the server's total physical memory. Sustained high utilization can cause system lag, program crashes, and even performance bottlenecks such as frequent virtual memory swapping. Network bandwidth refers to the maximum amount of data a network link can transmit per unit of time, similar to the total capacity of a highway lane. Higher bandwidth means more data can be transmitted per unit of time, indicating stronger network throughput.

[0027] Step 102: Semantically encode the alarm log to obtain a text-based alarm semantic vector, extract time-series performance feature vectors based on performance time-series data within a preset time window, and obtain the latest graph structure node embedding vector for each node based on the business system dependency topology graph.

[0028] Next, by acquiring three types of heterogeneous information—alarm text semantics, temporal performance fluctuations, and topological relationships—we can avoid the loss of single-modal feature information and provide a complete feature foundation for subsequent cross-modal fusion.

[0029] Optionally, in step 102, the alarm logs are semantically encoded to obtain text-based alarm semantic vectors; time-series performance feature vectors are extracted based on performance time-series data within a preset time window; and the latest graph structure node embedding vectors for each node are obtained based on the business system dependency topology graph, including: Step 1021: Based on the business-specific large language model, identify the business entities and alarm types in the alarm logs, and after semantically encoding the business entities and alarm types, output text-based alarm semantic vectors. The business-specific large language model is fine-tuned through the business-specific corpus, which includes the business order terms of business services, historical business work orders generated when the business system performs business services, and the operation and maintenance manual of the business system. The fine-tuned business-specific large language model can identify business entities and alarm types. Step 1022: For any type of performance time-series data pulled from the same business entity within a preset time window, after extracting each local feature separately through different attention heads of the multi-head attention mechanism, the local features are spliced ​​and fused to obtain a time-series performance feature vector that represents the performance status of the performance time-series data of the business entity within the preset time window. The performance time-series data includes query rate per second, slow query time, CPU utilization, memory utilization and network bandwidth rate collected in chronological order. Step 1023: In the business system dependency topology graph, message passing is performed node by node through graph neural network. After aggregating the full neighbor information of the node and fusing its own original features, the latest graph structure class node embedding vector of each node is generated.

[0030] In the above embodiments of this application, the large language model can be fine-tuned based on insurance domain-specific corpus (i.e., business-specific corpus). The insurance domain-specific corpus used for fine-tuning can include policy terms, operation and maintenance manuals, and historical work orders. The fine-tuned large language model can output structured text-based alarm semantic vectors through prompt word engineering. The text-based alarm semantic vectors can accurately extract business entities and anomaly (alarm) types from log texts, and capture insurance business domain-specific semantics such as underwriting rule conflicts and reinsurance settlement differences. The open-source large language model used for fine-tuning can be ChatGLM-6B.

[0031] Alarm type, as a core semantic element, participates in the generation of text-based alarm semantic vectors. This allows the vectors to accurately distinguish different fault attributes such as "business logic anomalies," "hardware resource anomalies," and "network transmission anomalies," preventing ordinary semantic models from misjudging insurance-specific "underwriting rule conflicts" as general service errors. In particular, alarm type can also serve as a priori labels to assist in the construction of a three-dimensional multimodal association matrix. For example, "slow query alarms" are naturally strongly correlated with temporal features such as database QPS and slow query latency, significantly improving the accuracy of cross-modal vector correlation calculations. By identifying alarm types in advance, business entities completely unrelated to that type can be directly filtered out, reducing the traversal computation of subsequent near-end strategy optimization agents and accelerating the convergence speed of root cause localization. Through alarm type encoding, insurance-specific alarm types such as "underwriting rule conflicts" and "reinsurance settlement differences" can be accurately identified, matched with the corresponding business handling knowledge base, and the final output root cause recommendation sequence directly includes insurance-specific operation and maintenance handling suggestions.

[0032] Regarding the training process of the business-specific large language model, for example, ChatGLM-6B was chosen as the open-source base model to adapt to the understanding requirements of Chinese insurance corpora and reduce the computational barrier for fine-tuning in vertical domains. Three types of specific corpora—policy terms, insurance operation and maintenance manuals, and historical operation and maintenance work orders—were anonymized and cleaned to remove sensitive customer information. They were then labeled in the format of "alarm log - business entity - alarm type" to construct a fine-tuning dataset conforming to the ChatML standard. LoRA low-rank fine-tuning technology was used to freeze most of the base model's basic parameters, training only a small number of adaptation layer parameters. While preserving the general semantic capabilities of the large model, this allowed the model to learn insurance-specific entity and alarm type recognition rules, avoiding catastrophic forgetting. Finally, through the design of dedicated instruction templates using prompt word engineering, the model was guided to output structured semantic vectors, completing the alignment and calibration of insurance-specific semantics, ultimately resulting in a business-specific large language model that can be directly used for semantic encoding of alarm logs.

[0033] Next, the time series transformer model can be used to process performance time series data. The long-series time series prediction model used by the time series transformer model is Informer. It captures long-cycle dependent features through a multi-head attention mechanism, such as the trend feature of a 200% month-on-month increase in trading volume in the 7 days before the opening rally, and finally outputs a time series performance feature vector.

[0034] A graph neural network is used to aggregate the full neighbor information of nodes in the topology graph. The full name of graph neural network is Graph Neural Network. The graph neural network model used can be GraphSAGE, which can fully aggregate the link association information such as the database cluster A that the underwriting rule engine depends on and the storage array X that the database cluster A depends on. Finally, the graph structure class node embedding vector corresponding to each node is output.

[0035] Step 103: Construct a multimodal correlation matrix based on text-based alarm semantic vectors, time-series performance feature vectors, and graph-structured node embedding vectors.

[0036] Next, the semantic vectors of text-based alarms (text), the performance feature vectors of time-series data (time-series), and the node embedding vectors of graph structures (graph structures) are uniformly mapped to the semantic space to construct a multimodal association matrix, which can eliminate information silos.

[0037] Optionally, any alarm log contains at least one business entity and is encoded with a text-based alarm semantic vector containing the business entity. When performance time-series data is pulled, it is anchored to the business entity that is the source of the pull. The performance time-series data includes multiple categories. Performance time-series data of the same type pulled based on the same business entity are encoded into a time-series performance feature vector encoding containing the business entity. The text-based alarm semantic vector, the time-series performance feature vector, and the graph structure node embedding vector each have different identification systems for the business entity. The step 103, constructing a multimodal association matrix based on the text-based alarm semantic vector, the time-series performance feature vector, and the graph structure node embedding vector, includes: Step 1031: Embed the text-based alarm semantic vector, time-series performance feature vector, and graph structure node vector under the same business entity into the vector, and bind and map their respective business entity identifiers to a unified business entity anchor point. Step 1032: Based on any bound business entity anchor point, align the three types of vectors under the business entity anchor point to the same semantic space through a cross-attention mechanism, calculate the correlation degree between the aligned vectors, and construct a multimodal correlation matrix based on the multiple correlation degrees calculated under each business entity anchor point.

[0038] In the above embodiments of this application, insurance business entity linking technology can be introduced to bind and map the business entity identifier of the policy number parsed from the alarm log by the text-type alarm semantic vector, the business entity identifier of the number of connections of the database cluster A to which the performance time-series data belongs by the time-series performance feature vector, and the business entity identifier of the database cluster A node to which the graph structure node embedding vector belongs by the graph topology graph to a unified business entity anchor point. Among them, the text-type alarm semantic vector, the time-series performance feature vector and the graph structure node embedding vector each encode a business entity, and the identification system for the business entity is different.

[0039] Based on any bound business entity anchor point, the three types of vectors under the aforementioned business entity anchor point are aligned to the same semantic space through a cross-attention mechanism, thereby completing the cross-modal semantic alignment of insurance business semantics and technical faults. The correlation degree between the aligned vectors is calculated, and a multimodal correlation matrix is ​​constructed based on the multiple correlation degrees calculated under each business entity anchor point.

[0040] Optionally, in step 1032, the correlation degree between the aligned vectors is calculated, and a multimodal correlation matrix is ​​constructed based on the multiple correlation degrees calculated for each business entity anchor point, including: Step 10321: Calculate the cosine similarity between each pair of aligned vectors as the correlation degree, using the text alignment vectors aligned with the text alignment vectors of the text alarm semantic vectors, the text alignment vectors aligned with the time-series performance feature vectors, and the graph alignment vectors aligned with the graph alignment vectors of the graph structure node embedding vectors. Construct a three-dimensional multimodal correlation matrix with all mutually exclusive business entities as rows, text alignment vectors, time-series alignment vectors, and graph alignment vectors as columns, and correlation degree as the value of the matrix cell. Step 10322: The three-dimensional cross-modal correlation matrix is ​​compressed and normalized into a standardized format using a multilayer perceptron to obtain the multimodal correlation matrix.

[0041] In the above embodiments of this application, for example, regarding a fault scenario during the insurance "opening red" promotion period, during the insurance platform's "opening red" promotion period, a sudden alarm storm occurs in the core policy underwriting service, triggering 3 alarm events simultaneously within a preset 5-minute time window: Alarm Event 1: Policy underwriting service interface timed out, corresponding business entity is online sales policy issuance service.

[0042] Alarm Event 2: Slow queries account for over 80% of the core transaction database, corresponding to the core underwriting DB cluster.

[0043] Alarm Event 3: Distributed storage array IO utilization is 100%, corresponding to the core storage array business entity.

[0044] The three types of vectors from the three business entities have been semantically aligned using cross-attention, resulting in their respective text-based, temporal-based, and graph-based alignment vectors. These vectors are used to construct a three-dimensional multimodal association matrix, and the cosine similarity of each pair of aligned vectors is calculated for each business entity. For the business entities of online sales order generation services: cosine similarity between text and time sequence is 0.82, cosine similarity between text and graph structure is 0.71, and cosine similarity between time sequence and graph structure is 0.65.

[0045] For the core insured DB cluster business entities: cosine similarity between text and time series is 0.94, cosine similarity between text and graph structure is 0.87, and cosine similarity between time series and graph structure is 0.91.

[0046] For the business entities of the core storage array: cosine similarity between text and time series is 0.96, cosine similarity between text and graph structure is 0.89, and cosine similarity between time series and graph structure is 0.93.

[0047] Using three business entities as rows and the pairwise association dimensions of three types of alignment vectors as columns, an original three-dimensional multimodal association matrix is ​​generated. The cells are directly filled with the corresponding similarity values, and then compressed and normalized using a multilayer perceptron, as follows: The input layer feeds all nine raw correlation scores (3 rows x 3 columns) into a multilayer perceptron. The hidden layer performs feature fusion using a fully connected network, filtering out low-correlation noise from peripheral entities like online sales order processing services. The output layer outputs a normalized 3x3 two-dimensional multimodal correlation matrix, with all cell values ​​normalized to the 0-1 range. Ultimately, the correlation between the core underwriting DB cluster and the core storage array is further enhanced, providing a precise correlation basis for subsequent root cause screening.

[0048] Step 104: The multimodal association matrix is ​​used as input to the training convergent proximal policy optimization agent as the global multimodal state view of the business system. Based on the global multimodal state view of the business system, the proximal policy optimization agent filters redundant nodes in each node of the business system dependency topology graph and outputs a recommended sequence of alarm storm root cause nodes with priority labels, so that the business system operation and maintenance personnel can complete the root cause location of alarm storms through the recommended sequence of alarm storm root cause nodes.

[0049] Next, the multimodal correlation matrix integrates multi-dimensional operational data to form a global state view, avoiding information blind spots from single data dimensions. Combined with a convergent PPO (Proximal Policy Optimization Agent) agent, it automatically filters low-correlation redundant nodes, compressing fault location from hours of traditional manual troubleshooting to minutes. Through a dual filtering mechanism of correlation degree and deviation value, invalid interference nodes are eliminated, and a priority-based root cause sequence is output. Compared to traditional rule-based root cause analysis, this reduces the probability of false positives and false negatives. Relying on the continuously dynamically updated topology graph and the reinforcement learning iteration capabilities of the agent, it can adapt to complex business scenarios involving cloud-native environments and multiple service dependencies, accumulating operational experience into reusable analytical logic and lowering the barrier to manual operations. Directly outputting a priority-based root cause recommendation sequence replaces the traditional manual cross-system verification of multi-source data, reducing cross-departmental communication costs and ensuring rapid recovery from business system failures.

[0050] Specifically, the near-end policy optimization agent is a dedicated decision-making agent trained based on the PPO algorithm. It takes a global system state view carried by a multimodal correlation matrix as input and relies on pre-learned operational patterns of the entire insurance business chain, historical failure root cause distribution characteristics, and correlation logic between multimodal indicators. During the traversal of all business entity nodes, it automatically performs a dual filtering operation: first, it filters out normally operating nodes below a preset deviation threshold based on the deviation value between performance time-series data and the dynamic baseline; then, it filters out low-relevance redundant nodes below a preset correlation threshold based on the correlation degree recorded in the multimodal correlation matrix. After obtaining a set of highly correlated candidate business entities, the agent uses its own converged policy network from the training phase to perform a comprehensive ranking by superimposing the correlation degree and deviation degree values ​​of each entity in the set to calculate the abnormal weights. Finally, it outputs a recommended sequence of alarm storm root cause nodes with confidence priority labels. The entire process can adaptively adapt to business fluctuations during special periods such as the insurance business's opening sales season and disaster claims season without requiring manual pre-setting of hard rules, significantly reducing the manual trial-and-error cost and misjudgment probability of traditional root cause investigation. Optionally, such as Figure 3 As shown, in step 104, the multimodal association matrix is ​​used as input to the training convergent proximal policy optimization agent as the global multimodal state view of the business system. Based on the global multimodal state view of the business system, the proximal policy optimization agent filters redundant nodes in each node of the business system dependency topology graph and outputs a priority-labeled recommendation sequence of alarm storm root cause nodes, including: Step 1041: For any type of performance time-series data pulled out by any business entity, extract the average value of the measured values ​​of the performance time-series data at each moment in a preset time window, and obtain the latest baseline expected value corresponding to the performance time-series data. Calculate the deviation value between the average value and the baseline expected value. Here, each business entity corresponds to multiple types of performance time-series data, each with its own calculated deviation value. The baseline expected value is dynamically adjusted and generated based on historical performance time-series data. Step 1042: The training converged proximal policy optimization agent traverses all business entities, and while traversing, it combines the full deviation value of all business entities to automatically adapt the dynamic deviation threshold for alarm storms, and filters out redundant nodes with deviation values ​​lower than the dynamic deviation threshold. Step 1043: Based on the correlation degree carried by the multimodal correlation matrix, automatically adapt the correlation degree judgment threshold for alarm storm, and filter out irrelevant nodes below the correlation degree judgment threshold to obtain a set of highly correlated candidate business entities, wherein the set of highly correlated candidate business entities includes multiple highly correlated candidate business entities. Step 1044: For any highly correlated candidate business entity in the set of highly correlated candidate business entities, generate the abnormal weight of the highly correlated candidate business entity based on the degree of correlation of each highly correlated candidate business entity and the deviation value of each type of performance time series data. Step 1045: After normalizing the anomaly weights of each highly correlated candidate business entity, the confidence level of each highly correlated candidate business entity is obtained. Based on the confidence level and the highly correlated candidate business entities, a recommended sequence of alarm storm root cause nodes with confidence priority labels is generated.

[0051] In the above embodiments of this application, the converged proximal policy optimization agent is used as the causal inference engine, and the multimodal association matrix is ​​used as the input to the converged proximal policy optimization agent as the global multimodal state view of the business system. Based on the global multimodal state view of the business system, the proximal policy optimization agent filters redundant nodes in each node of the business system dependency topology graph and outputs a recommended sequence of alarm storm root cause nodes with priority labels, simultaneously completing the construction of the fault tree and solving the problem of difficulty in identifying the root cause under alarm storm. The specific execution process is as follows: First, for any type of performance time-series data pulled from any business entity, the average value of the measured values ​​of the aforementioned performance time-series data at each moment within a preset time window is extracted, and the latest baseline expected value corresponding to the aforementioned performance time-series data is obtained. The deviation value between the aforementioned average value and the baseline expected value is calculated. Among them, each business entity corresponds to multiple types of performance time-series data, and the deviation value is calculated for each type. The aforementioned baseline expected value is dynamically adjusted and generated based on historical performance time-series data. The deviation result is synchronously incorporated into the state space definition as the core input dimension for subsequent intelligent agent inference, and can output standardized deviation descriptions such as "current CPU utilization is 25% higher than the baseline".

[0052] Subsequently, the near-end policy optimization agent, which has been trained and converged, traverses all business entities. During the traversal, it combines the full deviation value of all business entities to automatically adapt a dynamic deviation threshold for alarm storms and filters out redundant nodes with deviation values ​​lower than the dynamic deviation threshold. The state space of this step synchronously integrates business context features, such as insurance business-specific time period attributes like "currently during the opening red period," to ensure that the threshold adaptation fits the actual business load characteristics.

[0053] Then, relying on the correlation degree carried by the multimodal correlation matrix, the correlation degree judgment threshold for alarm storms is automatically adapted, and irrelevant nodes below the correlation degree judgment threshold are filtered out to obtain a set of highly correlated candidate business entities. Among them, the set of highly correlated candidate business entities includes multiple highly correlated candidate business entities. At the same time, the two-dimensional construction of the causal graph is completed. On the one hand, based on the insurance business knowledge graph, such as "policy modification - underwriting rule verification - DB update - storage write", the system dependency relationship of 20+ core business links (underwriting / claims / reinsurance) can be predefined and represented by a directed acyclic graph (DAG). On the other hand, the potential causal relationship is mined from the real-time alarm data through the PC algorithm (Peter-Clark algorithm), such as the co-occurrence frequency of "reinsurance settlement anomaly" and "DB deadlock", and supplemented to the causal graph to complete the automatic expansion of the candidate root cause set.

[0054] Next, for any highly correlated candidate business entity in the set of highly correlated candidate business entities, anomaly weights are generated based on the correlation degree of each highly correlated candidate business entity and the deviation values ​​of various performance time series data. At the same time, the definition of the reinforcement learning action space is completed in this step, and the candidate root cause set, such as {DB deadlock, underwriting rule conflict, storage IOPS limit exceeded}, is included in the action space to provide a candidate pool for subsequent root cause ranking.

[0055] Finally, after normalizing the anomaly weights of each highly correlated candidate business entity, the confidence level of each highly correlated candidate business entity is obtained. Based on the confidence level and the highly correlated candidate business entities, a recommended sequence of alarm storm root cause nodes with confidence priority labels is generated. This step simultaneously completes fault tree construction and interpretability enhancement, based on the following reward function: R = α·positioning accuracy + β·(1-MTTR / baseline MTTR) + γ·business impact; Where α=0.5, β=0.3, γ=0.2, MTTR is the current fault repair time, and the baseline MTTR is the historical average fault repair time.

[0056] The PPO agent completes policy optimization and calibration, outputs root cause ranking results, such as "DB deadlock (confidence 92%) — storage IOPS overrun (78%) — underwriting rule conflict (35%)", automatically generates a complete fault tree, such as "policy modification failure ← DB deadlock ← storage IOPS overrun". At the same time, based on Bayesian networks, combined with the co-occurrence probability of "root cause-symptom" in historical work orders, such as the probability that "DB deadlock" causes "policy modification failure" = 85%, the confidence value is calibrated, and the operation and maintenance personnel can click on the fault tree node to view the associated multimodal evidence, such as the slow query log fragment corresponding to "DB deadlock", storage IOPS curve, and DB cluster location in the topology diagram, to achieve full-link interpretable traceability.

[0057] Furthermore, regarding the process of automatically adapting the dynamic deviation threshold, for example, the agent first normalizes and sorts all deviation values ​​of all business entities under the current alarm storm scenario, and combines them with the preset historical false alarm rate baseline to select the upper quartile interval of the deviation distribution as the initial threshold candidate set; simultaneously, it introduces the business context features fused in the state space, such as the opening promotion period and the business peak traffic level, and dynamically weights and corrects the initial threshold, for example, the threshold is increased by 15% during the promotion period to avoid misjudging normal high-load scenarios as abnormal; finally, it outputs a dynamic deviation threshold that adapts to the current alarm scenario, automatically filtering out low-abnormality redundant nodes with deviation values ​​below the threshold, replacing the shortcomings of traditional fixed thresholds that cannot adapt to dynamic business loads.

[0058] The determination of the historical false alarm rate baseline involves, for example, selecting a full historical alarm dataset from the past 7-30 days, covering all scenarios including weekdays, major business promotions (such as the "opening red" sales season), and off-peak periods, ensuring that the sampled data and the current operation and maintenance scenario are from the same source and have the same caliber. The false alarm rate is calculated using the formula: False Alarm Rate = Number of Normal Events Mistakenly Identified as Faults / Total Number of Normal Events. The percentage of true false alarms within the statistical period is used. Based on industry-standard practices, the baseline threshold for the core insurance system is initially set at <5%, while for non-core systems it can be relaxed to within 15%. Through regular audits and reviews, combined with new business scenarios such as system iterations and new business launches, the baseline is continuously calibrated to prevent baseline drift from causing subsequent alarm judgment distortion.

[0059] The process of automatically adapting the correlation degree judgment threshold can be achieved by the PPO agent in real time, relying on the topological features of the multimodal correlation matrix. The agent first extracts the correlation degree values ​​of all edges in the multimodal correlation matrix, calculates the distribution density of all related edges under the current alarm storm, and calculates the global mean and standard deviation of the correlation degree. Combined with the number of remaining entities after filtering out redundant nodes, the threshold is automatically adjusted to ensure that the size of the remaining set of highly correlated entities is controlled within a reasonable range that can be efficiently handled by operation and maintenance personnel. Finally, the correlation degree judgment threshold adapted to the current alarm scale is output, and irrelevant nodes with a correlation degree lower than the threshold are filtered out to obtain a set of highly correlated candidate business entities.

[0060] The process of policy optimization and calibration using the reward function involves using the reward function as the core feedback signal for the PPO agent to complete policy calibration. After the agent outputs the root cause ranking sequence in each round, it automatically substitutes the three dimensions of localization accuracy, MTTR relative reduction ratio, and business impact into the formula to calculate the immediate reward value. Based on this reward value, the agent calculates the advantage function through generalized advantage estimation and updates the policy network parameters in conjunction with the PPO pruning mechanism to limit the policy update amplitude and avoid training oscillations. After multiple iterations, the agent gradually optimizes the policy and eventually tends to output a root cause recommendation sequence with high accuracy, high business impact priority, and significant reduction in fault repair time, thus completing the policy convergence calibration.

[0061] Specifically, the localization accuracy refers to the percentage of Top-K root cause nodes output by the PPO agent that overlap with historically labeled real root causes. For example, if two out of the three candidate root causes output are real fault root causes, the localization accuracy is 66.7%, which is the core indicator for measuring the accuracy of root cause ranking results.

[0062] Business impact is a quantitative value calculated based on the core indicators of insurance business. It takes into account the impact of failures on policy processing volume, payment transaction failure rate, and core service unavailability, and maps it to a normalized value between 0 and 1. The higher the value, the greater the impact of the failure on the core insurance business.

[0063] Optionally, in step 1045, based on confidence level and highly relevant candidate business entities, a recommended sequence of alarm storm root cause nodes with confidence level priority labels is generated, including: Step 10451: Eliminate highly relevant candidate business entities with confidence levels below the preset confidence threshold to obtain highly relevant business entities; Step 10452: Select highly correlated business entities as alarm storm root cause nodes, and sort them according to confidence level to obtain a recommended sequence of alarm storm root cause nodes with confidence priority labeling.

[0064] In the above embodiments of this application, taking an alarm storm during the "opening red" promotion period of the insurance core system as an example, after preliminary screening, the set of highly correlated candidate business entities contains a total of 6 business entities, with corresponding normalized confidence levels as follows: DB deadlock 92%, storage IOPS exceeding limit 78%, underwriting rule conflict 35%, cache hit rate less than 22%, gateway connection timeout 18%, and log collection service abnormality 12%. Highly correlated candidate business entities with confidence levels below the preset confidence threshold are removed, resulting in highly correlated business entities. In this case, the confidence threshold is set to 30%, automatically filtering out 3 business entities with confidence levels below 30% (cache hit rate less than 30%, gateway connection timeout, and log collection service abnormality), leaving 3 highly correlated business entities.

[0065] Highly correlated business entities are identified as root cause nodes of alarm storms. After sorting them based on confidence level, a recommended sequence of root cause nodes of alarm storms with confidence level priority labels is obtained: DB deadlock (92%) → Storage IOPS exceeding limit (78%) → Underwriting rule conflict (35%). These are directly output to operations and maintenance personnel for priority investigation.

[0066] Regarding the criteria for setting the reliability threshold, and considering the business characteristics of insurance operations and maintenance, the preset reliability thresholds for different scenarios can be set in a tiered manner: Core business links (underwriting / claims / reinsurance): The threshold can be set to ≥70%, retaining only high-confidence root causes to avoid low-confidence misjudgments affecting the stability of core transactions.

[0067] For ordinary business processes: the threshold can be set to ≥30% to appropriately expand the range of candidate root causes and reduce the probability of missed detection.

[0068] Automatic self-healing trigger scenario: The threshold must be raised to ≥90%, and only root causes with extremely high confidence are allowed to trigger automatic repair, so as to avoid business risks caused by erroneous operations.

[0069] Manually assisted troubleshooting scenario: The threshold can be relaxed to ≥20%, providing maintenance personnel with more potential troubleshooting directions for reference.

[0070] Meanwhile, the confidence threshold can be continuously iterated and optimized based on the root cause localization accuracy data of the past 30 days to ensure that it adapts to the business load characteristics of different time periods.

[0071] Optionally, if the business system has multiple users, in step 1041, before obtaining the latest baseline expected value corresponding to the performance time series data, the method further includes: Step 105: Construct a general performance time-series analysis model based on long short-term memory networks and attention mechanisms; Step 106: For any user of the business system, obtain the user's business volume, external factors, business system configuration, and various performance time-series data when using the business system within a historical preset time period. Use these data to train the general performance time-series analysis model until training is complete, resulting in a performance time-series analysis model specific to the user. The performance time-series analysis model is used to predict the mapping relationship between the user's business volume and performance time-series data. The mapping relationship is represented by the expected normal values ​​of the performance time-series data. Business volume includes the number and amount of business orders, external factors include weather index and policy changes, and business system configuration includes the number of servers. Step 107: Use the federated averaging algorithm to weighted average the performance time series analysis models specific to each user and generate a global dynamic baseline model. Step 108: Collect the business volume, external factors and business system configuration within the current preset time window, and input them into the global dynamic baseline model so that the global dynamic baseline model outputs the expected normal values ​​of various performance time series data. Step 109: For any type of performance time series data, the expected normal value of the performance time series data is smoothed and calibrated by combining the historical fluctuation range of the performance time series data to obtain the baseline expected value of the performance time series data, wherein the historical fluctuation range is determined based on historical performance time series data within a preset historical period.

[0072] In the above embodiments of this application, dynamic baseline adaptation of alarm thresholds can be achieved through the following process: relying on federated learning to drive full-scale business fluctuation adaptation, the false alarm defects of traditional static baselines under seasonal fluctuations in insurance business are resolved, and dynamic calibration of the baseline is completed, as follows: A general performance time series analysis model is constructed based on long short-term memory networks and attention mechanisms. Relying on the long sequence dependency capture capability of LSTM and the key feature weighting capability of attention mechanisms, it can accurately adapt to the nonlinear fluctuation characteristics of insurance business time series data.

[0073] For any user of the business system, acquire the user's business volume, external factors, business system configuration, and various performance time-series data during historical preset time periods. This data is used to train a general performance time-series analysis model until training is complete, resulting in a performance time-series analysis model specific to the user. The training data covers the full historical data of each branch for 3 years, including insurance-specific business calendar features such as holidays, product discontinuation periods, and disaster claims seasons. The model can accurately learn the mapping relationship between "business volume and resource consumption," for example, outputting the corresponding pattern that "for every 10% increase in new car insurance policies, the expected increase in DB QPS is 15%." The performance time-series analysis model is used to predict the mapping relationship between the user's business volume and performance time-series data. The mapping relationship is represented by the expected normal values ​​of the performance time-series data. Business volume includes the number of business orders and premium amount, external factors include weather indices and changes in regulatory policies, and business system configuration includes the number of servers deployed.

[0074] The process employs a federated averaging algorithm to weighted average the performance time-series analysis models specific to each user, generating a global dynamic baseline model. This process relies on a federated learning framework consisting of "head office cloud server + local nodes in each branch office." The head office acts as the aggregation node to generate the global model, while each branch office acts as a local training node, uploading only encrypted model parameters. No original sensitive business data is shared throughout the process, meeting the data privacy compliance requirements of the financial industry. When aggregating the models, the business scale proportion of each branch office is used as the weighting weight. The final global dynamic baseline model can support the output of results by subdividing scenarios according to the dimensions of "insurance type (auto insurance, life insurance, health insurance)" and "channel (online sales, agents, bancassurance)".

[0075] Collect business volume, external factors, and business system configuration within the current preset time window, input them into the global dynamic baseline model, so that the global dynamic baseline model can output the expected normal values ​​of various performance time series data. For example, it can output scenario-based baseline results such as "In the first week of the opening sales, the normal range of CPU utilization of the online sales platform is 60%-75%". At the same time, a 7-day sliding window is configured to complete the real-time iterative update of the baseline.

[0076] For any type of performance time series data, the expected normal value of the performance time series data is smoothed and calibrated by combining the historical fluctuation range of the performance time series data to obtain the baseline expected value of the performance time series data. The historical fluctuation range is determined based on the historical performance time series data within a preset historical period.

[0077] Further improvements to the isolated forest algorithm can be made to conduct unsupervised detection of deviations between real-time metrics and the baseline, accurately distinguishing between two scenarios: "normal business peaks, such as daily premiums exceeding 100 million" and "abnormal fluctuations, such as CPU suddenly increasing to 90% but business volume not increasing synchronously." When maintenance personnel mark false alarm events, incremental training of the local model of the corresponding branch is automatically triggered, using only the branch's new data from the past 3 days, and then updating the global dynamic baseline model synchronously through federated learning to achieve continuous iterative optimization of the baseline.

[0078] Specifically, when training the model, a historical period is preset, such as three consecutive years.

[0079] By applying the technical solution of this embodiment, multi-source information from both business and technology sources can be integrated, and the root cause of alarm storms can be dynamically adapted to business fluctuations. This enables an upgrade of the operation and maintenance paradigm from "passive response" to "proactive prevention," ensuring the continuity of insurance business while reducing operation and maintenance costs. Through multimodal LLM fusion analysis, insurance business alarms and technical faults are semantically correlated across domains, breaking through the information silos of single-modal tools. Through federated learning dynamic baselines, privacy-preserving distributed training adapts to the seasonal fluctuations of insurance business, significantly reducing the false alarm rate compared to static baselines. Business knowledge is embedded in the causal reasoning engine, and reinforcement learning outputs fault trees with confidence, improving the accuracy of root cause localization. It can be applied to property insurance business scenarios. In the actual operation and maintenance scenarios of core insurance systems such as underwriting and claims, it can effectively filter invalid and redundant alarms during peak business periods such as "opening sales" or "typhoon disaster claims," ​​improving the average repair time and ensuring that key processes such as policy underwriting and claims calculation are not interrupted, thus guaranteeing customer service experience. By implementing automated noise reduction and intelligent boundary delineation, the reliance on manual investigation by senior operations and maintenance experts is reduced, effectively avoiding resource strain during alarm storms and lowering annual operations and maintenance costs. It can accurately identify potential risks that may affect regulatory reporting, reinsurance settlement, and other highly compliant scenarios, transforming "passive firefighting" into "proactive prevention," ensuring the stability and high availability of core systems under extreme business pressure, and providing a solid intelligent foundation for Ping An Property & Casualty Insurance's business continuity.

[0080] Furthermore, as Figure 1 In terms of specific implementation, this application provides an alarm storm root cause localization system, such as... Figure 4 As shown, the system includes: The multi-source heterogeneous data acquisition module 201 is used to retrieve a pre-built and continuously dynamically updated business system dependency topology graph when the business system generates multiple alarm events within a preset time window, forming an alarm storm. It also retrieves the performance time-series data of the business system within the preset time window and synchronously collects the alarm logs associated with each alarm event. The business system dependency topology graph consists of nodes and edges. Nodes represent business entities, including the business services of the business system and the hardware devices that carry the business services. Edges represent the calling relationships between business entities and the flow of business data generated by the business entities. The multimodal feature vector extraction module 202 is used to semantically encode alarm logs to obtain text-based alarm semantic vectors, extract time-series performance feature vectors based on performance time-series data within a preset time window, and obtain the latest graph structure node embedding vectors for each node based on the business system dependency topology graph. The cross-modal semantic alignment and fusion module 203 is used to construct a multimodal correlation matrix based on text-based alarm semantic vectors, time-series performance feature vectors, and graph-structured node embedding vectors. The intelligent root cause reasoning output module 204 is used to train a converged proximal policy optimization agent by taking the multimodal association matrix as input to the global multimodal state view of the business system. The proximal policy optimization agent filters redundant nodes in each node of the business system dependency topology based on the global multimodal state view of the business system, and outputs a recommended sequence of alarm storm root cause nodes with priority labels, so that the business system operation and maintenance personnel can complete the root cause location of alarm storms through the recommended sequence of alarm storm root cause nodes.

[0081] It should be noted that other corresponding descriptions of the functional units involved in the alarm storm root cause localization system provided in this application embodiment can be found in the following references. Figure 2 and Figure 3 The corresponding descriptions in the method will not be repeated here.

[0082] Based on the above, Figure 2 and Figure 3 Accordingly, this application also provides a storage medium storing a computer program, which, when executed by a processor, implements the above-described method. Figure 2 and Figure 3 The method for locating the root cause of alarm storms is shown.

[0083] Based on this understanding, the technical solution of this application can be embodied in the form of a software product. The software product can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, or portable hard drive), and includes several instructions to cause a computer device (such as a personal computer, server, or network device) to execute the methods described in the various implementation scenarios of this application.

[0084] Based on the above, Figure 2 and Figure 3 The method shown, and Figure 4 To achieve the above objectives, the virtual system embodiment shown in this application also provides a computer device, specifically a personal computer, server, network device, etc. This computer device includes a storage medium and a processor; the storage medium stores a computer program; the processor executes the computer program to achieve the above-described objectives. Figure 2 and Figure 3 The method for locating the root cause of alarm storms is shown.

[0085] In some embodiments, a computer device is provided, such as Figure 5 As shown, the computer device can be a server. The computer device includes a processor, memory, network interface, and database connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile and / or volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The network interface of the computer device is used to communicate with external clients via a network connection. When the computer program is executed by the processor, it implements the functions or steps of the method on the server side.

[0086] In some embodiments, a computer device is provided, such as Figure 6 As shown, the computer device can be a client. The computer device includes a processor, memory, network interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The network interface of the computer device is used to communicate with an external server via a network connection. When the computer program is executed by the processor, it implements the functions or steps of the method on the client side.

[0087] Through the above description of the implementation methods, those skilled in the art can clearly understand that this application can be implemented by means of software plus necessary general-purpose hardware platforms, or by hardware to retrieve the business system dependency topology graph, pull performance time-series data, collect alarm logs of alarm events, extract text-based alarm semantic vectors, time-series performance feature vectors and business system dependency topology graphs, and generate a multimodal correlation matrix; the multimodal correlation matrix is ​​used as input to the training convergent proximal policy optimization agent as a global multimodal state view of the business system, and the proximal policy optimization agent filters redundant nodes with low correlation to alarm storms, and outputs a recommended sequence of alarm storm root cause nodes with priority labels. By uniformly mapping text, time-series and graph structure alarm information to the semantic space, a multimodal correlation matrix is ​​constructed for alarm storm analysis, which can eliminate information silos and improve the efficiency and accuracy of operation and maintenance personnel in locating alarm root causes.

[0088] Those skilled in the art will understand that the accompanying drawings are merely schematic diagrams of a preferred embodiment, and the modules or processes shown in the drawings are not necessarily essential for implementing this application. Those skilled in the art will understand that the modules in the system of the embodiment scenario can be distributed throughout the system of the embodiment scenario as described, or they can be modified to reside in one or more systems different from this embodiment scenario. The modules of the above-described embodiment scenario can be combined into one module, or further divided into multiple sub-modules.

[0089] It should be noted that any AI models, software tools, or components not belonging to this company appearing in the embodiments of this application are merely illustrative examples and do not represent actual use. All user personal information involved in the embodiments of this application has been authorized (with the knowledge and consent) by the relevant parties or has been fully authorized by all parties, and the executing entity may obtain it through various legal and compliant means. The collection, storage, use, processing, transmission, provision, and disclosure of the information, data, and signals involved all comply with relevant laws and regulations and do not violate public order and good morals.

[0090] The serial numbers in this application are for descriptive purposes only and do not represent the superiority or inferiority of any particular implementation scenario. The above disclosures are merely a few specific implementation scenarios of this application; however, this application is not limited thereto, and any modifications that can be made by those skilled in the art should fall within the protection scope of this application.

Claims

1. A method for locating the root cause of alarm storms, characterized in that, The method includes: When a business system generates multiple alarm events within a preset time window, forming an alarm storm, a pre-built and continuously dynamically updated business system dependency topology graph is retrieved. The performance time-series data of the business system within the preset time window is pulled, and alarm logs associated with each alarm event are collected synchronously. The business system dependency topology graph consists of nodes and edges. Nodes represent business entities, which include the business services of the business system and the hardware devices that carry the business services. Edges represent the calling relationships between business entities and the flow of business data generated by the business entities. The alarm logs are semantically encoded to obtain text-based alarm semantic vectors. Time-series performance feature vectors are extracted based on performance time-series data within a preset time window. The latest graph structure node embedding vectors of each node are obtained based on the business system dependency topology graph. A multimodal correlation matrix is ​​constructed based on text-based alarm semantic vectors, time-series performance feature vectors, and graph-structured node embedding vectors. The multimodal association matrix is ​​used as input to the global multimodal state view of the business system to train the converged proximal policy optimization agent. Based on the global multimodal state view of the business system, the proximal policy optimization agent filters redundant nodes in each node of the business system dependency topology graph and outputs a recommended sequence of alarm storm root cause nodes with priority labels. This allows business system operation and maintenance personnel to complete the root cause location of alarm storms through the recommended sequence of alarm storm root cause nodes.

2. The method according to claim 1, characterized in that, Each alarm log contains at least one business entity and is encoded with a text-based alarm semantic vector containing the business entity. Performance time-series data is anchored to the business entity from which it is retrieved. This performance time-series data includes multiple categories. Performance time-series data of the same type retrieved based on the same business entity are encoded into a time-series performance feature vector containing the business entity. The text-based alarm semantic vector, the time-series performance feature vector, and the graph structure node embedding vector each have different identifier systems for the business entity. The construction of a multimodal association matrix based on the text-based alarm semantic vector, the time-series performance feature vector, and the graph structure node embedding vector includes: Embed the text-based alarm semantic vector, time-series performance feature vector, and graph structure node vector under the same business entity into the vector, and bind and map their respective business entity identifiers to a unified business entity anchor point. Based on any bound business entity anchor point, the three types of vectors under the business entity anchor point are aligned to the same semantic space through a cross-attention mechanism, and the correlation degree between the aligned vectors is calculated. Based on the multiple correlation degrees calculated under each business entity anchor point, a multimodal correlation matrix is ​​constructed.

3. The method according to claim 2, characterized in that, The calculated correlation degree between aligned vectors is used to construct a multimodal correlation matrix based on multiple correlation degrees calculated for each business entity anchor point, including: In the text-class alignment vectors aligned by text-class alarm semantic vector encoding, the text-class alignment vectors aligned by time-series performance feature vectors, and the graph-class alignment vectors aligned by graph-structure node embedding vectors, the cosine similarity between each pair of alignment vectors is calculated as the correlation degree. Taking all mutually exclusive business entities as rows, text-class alignment vectors, time-series alignment vectors, and graph-structure alignment vectors as columns, and the correlation degree as the value of the matrix cell, a three-dimensional multimodal correlation matrix is ​​constructed. The three-dimensional cross-modal correlation matrix is ​​compressed and normalized into a standardized format by using a multilayer perceptron to obtain the multimodal correlation matrix.

4. The method according to claim 1, characterized in that, The process involves semantically encoding alarm logs to obtain text-based alarm semantic vectors, extracting time-series performance feature vectors based on performance time-series data within a preset time window, and obtaining the latest graph structure node embedding vectors for each node based on the business system dependency topology graph, including: Based on a business-specific large language model, the system identifies business entities and alarm types in alarm logs. After semantically encoding the business entities and alarm types, it outputs text-based alarm semantic vectors. The business-specific large language model is fine-tuned through a business-specific corpus, which includes business order terms of business services, historical business work orders generated when the business system performs business services, and the operation and maintenance manual of the business system. The fine-tuned business-specific large language model can identify business entities and alarm types. For any type of performance time-series data pulled from the same business entity within a preset time window, different attention heads of the multi-head attention mechanism are used to extract local features separately, and then the local features are spliced ​​and fused to obtain a time-series performance feature vector that represents the performance status of the performance time-series data of the business entity within the preset time window. The performance time-series data includes query rate per second, slow query time, CPU utilization, memory utilization and network bandwidth rate collected in chronological order. In the business system dependency topology graph, message passing is performed node by node through graph neural network. After aggregating the full neighbor information of each node and fusing its own original features, the latest graph structure class node embedding vector of each node is generated.

5. The method according to claim 3, characterized in that, The near-end policy optimization agent, trained and converged by using the multimodal association matrix as input to the global multimodal state view of the business system, filters redundant nodes in the dependency topology graph of the business system based on the global multimodal state view, and outputs a priority-labeled recommendation sequence of alarm storm root cause nodes, including: For any type of performance time-series data pulled out by any business entity, the average value of the measured values ​​of the performance time-series data at each moment in a preset time window is extracted, and the latest baseline expected value corresponding to the performance time-series data is obtained. The deviation value between the average value and the baseline expected value is calculated. Each business entity corresponds to multiple types of performance time-series data and the deviation value is calculated for each type. The baseline expected value is dynamically adjusted and generated based on historical performance time-series data. The near-end policy optimization agent, which is trained to converge, traverses all business entities. While traversing, it combines the full deviation value of all business entities to automatically adapt the dynamic deviation threshold for alarm storms and filter out redundant nodes with deviation values ​​lower than the dynamic deviation threshold. Based on the correlation degree carried by the multimodal correlation matrix, the correlation degree judgment threshold for alarm storm is automatically adapted, and irrelevant nodes below the correlation degree judgment threshold are filtered out to obtain a set of highly correlated candidate business entities, which includes multiple highly correlated candidate business entities. For any highly correlated candidate business entity in the set of highly correlated candidate business entities, an anomaly weight is generated for the highly correlated candidate business entity based on the correlation degree of each highly correlated candidate business entity and the deviation value of various performance time series data. After normalizing the anomaly weights of each highly correlated candidate business entity, the confidence level of each highly correlated candidate business entity is obtained. Based on the confidence level and the highly correlated candidate business entities, a recommended sequence of alarm storm root cause nodes with confidence level priority labels is generated.

6. The method according to claim 5, characterized in that, The generation of a recommended sequence of alarm storm root cause nodes with confidence priority labels based on confidence level and highly correlated candidate business entities includes: Highly relevant candidate business entities with confidence levels below a preset confidence threshold are removed to obtain highly relevant business entities; By identifying highly correlated business entities as the root cause nodes of the alarm storm and sorting them based on confidence level, a recommended sequence of root cause nodes of the alarm storm with confidence level priority labels is obtained.

7. The method according to claim 5, characterized in that, The business system has multiple users, and obtaining the latest baseline expected value corresponding to the performance time series data includes: A general performance time-series analysis model is constructed based on long short-term memory networks and attention mechanisms; For any user of the business system, acquire the user's business volume, external factors, business system configuration, and various performance time-series data during the historical preset time period when using the business system. Use this data to train the general performance time-series analysis model until training is complete, resulting in a performance time-series analysis model specific to the user. The performance time-series analysis model is used to predict the mapping relationship between the user's business volume and performance time-series data. The mapping relationship is represented by the expected normal values ​​of the performance time-series data. Business volume includes the number and amount of business orders, external factors include weather index and policy changes, and business system configuration includes the number of servers. A global dynamic baseline model is generated by weighting the performance time series analysis models of each user using a federated averaging algorithm. Collect business volume, external factors and business system configuration within the current preset time window, and input them into the global dynamic baseline model so that the global dynamic baseline model can output the expected normal values ​​of various performance time series data. For any type of performance time-series data, the expected normal value of the performance time-series data is smoothed and calibrated by combining the historical fluctuation range of the performance time-series data to obtain the baseline expected value of the performance time-series data. The historical fluctuation range is determined based on historical performance time-series data within a preset historical period.

8. A root cause localization system for alarm storms, characterized in that, The system includes: The multi-source heterogeneous data acquisition module is used to retrieve a pre-built and continuously dynamically updated business system dependency topology graph when the business system generates multiple alarm events within a preset time window, forming an alarm storm. It also retrieves the performance time-series data of the business system within the preset time window and synchronously collects the alarm logs associated with each alarm event. The business system dependency topology graph consists of nodes and edges. Nodes represent business entities, including the business services of the business system and the hardware devices that carry the business services. Edges represent the calling relationships between business entities and the flow of business data generated by the business entities. The multimodal feature vector extraction module is used to semantically encode alarm logs to obtain text-based alarm semantic vectors, extract time-series performance feature vectors based on performance time-series data within a preset time window, and obtain the latest graph structure node embedding vectors for each node based on the business system dependency topology graph. The cross-modal semantic alignment and fusion module is used to construct a multimodal correlation matrix based on text-based alarm semantic vectors, time-series performance feature vectors, and graph-structured node embedding vectors. The intelligent root cause reasoning output module is used to train a converged proximal policy optimization agent by taking the multimodal association matrix as input to the global multimodal state view of the business system. Based on the global multimodal state view of the business system, the proximal policy optimization agent filters redundant nodes in each node of the business system dependency topology graph and outputs a recommended sequence of alarm storm root cause nodes with priority labels, so that business system operation and maintenance personnel can complete the root cause location of alarm storms through the recommended sequence of alarm storm root cause nodes.

9. A storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the alarm storm root cause localization method according to any one of claims 1 to 7.

10. A computer device, comprising a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor, characterized in that, When the processor executes the computer program, it implements the alarm storm root cause localization method according to any one of claims 1 to 7.

Images