An intelligent diagnostic method and related apparatus

Abstract

The embodiment of the application provides a kind of intelligent diagnosis method and related equipment, belong to computer system operation and maintenance technical field.The method comprises: collecting multi-source data, multi-source data includes time series index, system event and topology information;Determine whether multi-source data is abnormal;If multi-source data is abnormal, then based on multi-source data, build core evidence, based on core evidence query vector knowledge base obtains thinking example, core evidence includes depth context;Core evidence and thinking example are structured into diagnostic reasoning query, reasoning result is obtained by large language model based on diagnostic reasoning query;Generate diagnostic report based on reasoning result.The embodiment of the application can realize the logic clear, with the traceable automated fault diagnosis, can diagnose unknown fault, improve the trust degree of automated diagnosis result of operation and maintenance personnel, improve user experience.

Description

Technical Field

[0001] This application relates to the field of computer system operation and maintenance technology, and in particular to an intelligent diagnostic method and related equipment. Background Technology

[0002] With the widespread adoption of microservice architectures and containerization technologies (such as Docker and Kubernetes), IT systems have become the mainstream of modern IT infrastructure. However, existing intelligent diagnostic methods in monitoring systems may require engineers to spend time manually checking for correlations, affecting the efficiency of troubleshooting. Model-based detection may suffer from poor model performance and high deployment and maintenance costs.

[0003] In summary, the technical problems existing in the relevant technologies need to be improved. Summary of the Invention

[0004] The main objective of this application is to propose an intelligent diagnostic method and related equipment to achieve logically clear and verifiable automated fault diagnosis.

[0005] To achieve the above objectives, one aspect of this application proposes an intelligent diagnostic method, the method comprising: Collect multi-source data, including time-series indicators, system events, and topology information; Determine whether there are any anomalies in the multi-source data; If the multi-source data is abnormal, core evidence is constructed based on the multi-source data, and a thought chain example is obtained by querying the vector knowledge base based on the core evidence. The core evidence includes deep context. The core evidence and the thought chain example are used to construct a diagnostic reasoning query, and the reasoning result is obtained by reasoning based on the diagnostic reasoning query using a large language model. A diagnostic report is generated based on the reasoning results.

[0006] In some embodiments, determining whether the multi-source data is abnormal includes: By analyzing the key indicators of the multi-source data using the analytical model, preliminary abnormal nodes are obtained. The downstream service nodes of the initial anomaly point are obtained based on the service dependency topology graph. The initial anomaly point and the downstream service nodes are combined to form a potential influence domain. The service nodes of the potential influence domain include the initial anomaly point and the downstream service nodes. Configure a business criticality weight for each service node in the potential impact domain, and calculate the business impact score based on the potential impact domain and the business criticality weight; Query and identify the core health metrics for each service node in the potential impact domain; If the core health indicators show a deteriorating trend, the degree of deterioration of the core health indicators showing a deteriorating trend is analyzed, and the business impact score is updated based on the degree of deterioration. If the business impact score is greater than the preset decision threshold, then it is determined that the multi-source data is abnormal.

[0007] In some embodiments, if the multi-source data is abnormal, constructing core evidence based on the multi-source data includes: If the multi-source data is abnormal, the multi-source data is parsed to extract key technical entities, and the key technical entities are associated with the multi-source data. Construct a temporal entity co-occurrence graph based on the aforementioned key technology entities; The graph centrality algorithm is used to calculate the evidence significance score corresponding to the key technology entity based on the temporal entity co-occurrence graph; Based on the evidence significance score of the key technical entity, the corresponding multi-source data are sorted, and the top-ranked number of multi-source data are selected as core evidence.

[0008] In some embodiments, obtaining the thought chain example based on the core evidence query vector knowledge base includes: The feature vectors of the core evidence are extracted. The feature vectors include three modal feature vectors, namely, temporal morphological feature vectors, topological structure feature vectors, and semantic context feature vectors. The similarity of each modality feature vector is calculated by querying the vector knowledge base, resulting in similarity in three dimensions; The similarity scores across the three dimensions are combined to obtain a comprehensive similarity score. Based on the comprehensive similarity, historical successful cases that match the core evidence are identified, and these historical successful cases are used as examples of the thought chain.

[0009] In some embodiments, constructing the core evidence and the thought chain example into a diagnostic reasoning query includes: Fill the query template with the core evidence to obtain the diagnostic reasoning query; The diagnostic reasoning query is enhanced by the aforementioned thought chain example to obtain the enhanced diagnostic reasoning query. Alternatively, the core evidence and the thought chain example can be filled into the query template to obtain a diagnostic reasoning query, wherein the query template includes output format constraints.

[0010] In some embodiments, the method further includes: Obtain user feedback on the diagnostic report; If the user feedback indicates that the diagnosis is correct, then feature vectors of the three different modalities of the diagnostic reasoning query—temporal morphology, topological structure, and semantic context—are extracted. The feature vectors of the three different modalities are stored in the vector knowledge base.

[0011] To achieve the above objectives, another aspect of this application provides an intelligent diagnostic device, the device comprising: The data acquisition module is used to collect multi-source data, including time-series indicators, system events, and topology information. An anomaly detection module is used to determine whether there are any anomalies in the multi-source data; The example query module is used to construct core evidence based on the multi-source data if an anomaly exists in the multi-source data, and to query the vector knowledge base based on the core evidence to obtain a thought chain example, wherein the core evidence includes deep context. The model reasoning module is used to construct a diagnostic reasoning query by combining the core evidence and the thought chain example, and to obtain the reasoning result by reasoning based on the diagnostic reasoning query through the large language model. The report generation module is used to generate a diagnostic report based on the reasoning results.

[0012] To achieve the above objectives, another aspect of this application provides an electronic device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the method described above.

[0013] To achieve the above objectives, another aspect of the embodiments of this application proposes a computer-readable storage medium storing a computer program that, when executed by a processor, implements the methods described above.

[0014] To achieve the above objectives, another aspect of the embodiments of this application proposes a computer program product, including a computer program that, when executed by a processor, implements the aforementioned method.

[0015] The embodiments of this application include at least the following beneficial effects: This application provides an intelligent diagnostic method, device, electronic device, storage medium, and program product. This solution collects multi-source data, including time-series indicators, system events, and topology information; determines whether there are anomalies in the multi-source data; if anomalies are found, core evidence is constructed based on the multi-source data, and a thought chain example is obtained by querying a vector knowledge base based on the core evidence. The core evidence includes deep context, which improves the accuracy and efficiency of diagnosis; the core evidence and the thought chain example are used to construct a diagnostic reasoning query, and the reasoning result is obtained by reasoning based on the diagnostic reasoning query through a large language model. No complex operation or model deployment is required, realizing automated fault diagnosis, possessing the ability to diagnose unknown faults, and improving the model detection effect; a diagnostic report is generated based on the reasoning result, realizing logically clear and verifiable fault diagnosis, increasing the trust of maintenance personnel in the automated diagnostic results, and improving the user experience. Attached Figure Description

[0016] Figure 1 This is a flowchart of the intelligent diagnostic method provided in the embodiments of this application; Figure 2 This is a flowchart of the feedback steps of the intelligent diagnostic method provided in the application embodiment; Figure 3 yes Figure 1 The flowchart of step S103 in the process; Figure 4 yes Figure 1 Another flowchart for step S103 in the process; Figure 5 yes Figure 1 The flowchart of step S102 in the document; Figure 6 This is a schematic diagram of the system architecture of the cloud-native system provided in the embodiments of this application; Figure 7 This is a general flowchart of intelligent diagnosis of a cloud-native system provided in the embodiments of this application; Figure 8 This is a flowchart illustrating a specific implementation of the intelligent diagnostic method provided in this application when applied to the diagnosis of memory overflow (OOM) faults caused by data skew in a Kubernetes-based big data Flink cluster in a cloud-native system. Figure 9 This is a schematic diagram of the structure of the intelligent diagnostic device provided in the embodiments of this application; Figure 10 This is a schematic diagram of the hardware structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0017] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of this application and are not intended to limit it. In the following description, when referring to the accompanying drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with those of this application; they are merely examples of apparatuses and methods consistent with some aspects of the embodiments of this application as detailed in the appended claims.

[0018] It is understood that the terms “first,” “second,” etc., used in this application may be used herein to describe various concepts, but unless otherwise stated, these concepts are not limited by these terms. These terms are only used to distinguish one concept from another. For example, without departing from the scope of the embodiments of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the words “if,” “when,” or “in response to a determination” as used herein may be interpreted as “when…” or “when…” or “in response to a determination.”

[0019] As used in this application, the terms "at least one", "multiple", "each", "any", etc., "at least one" includes one, two or more, "multiple" includes two or more, "each" refers to each of the corresponding multiples, and "any" refers to any one of the multiples.

[0020] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0021] Before providing a detailed description of the embodiments of this application, some of the nouns and terms involved in the embodiments of this application will be explained first. The nouns and terms involved in the embodiments of this application are subject to the following interpretations.

[0022] 1) AI Agent (Intelligent Agent): An AI Agent is an artificial intelligence entity with a closed loop of perception, thinking, planning, execution, and feedback. An AI Agent not only passively answers questions, but can also autonomously break down complex tasks, call tools, and complete goals in multiple steps.

[0023] 2) MTTR (Mean Time To Repair) is a core operational metric used to measure fault resolution efficiency.

[0024] 3) AIOps (Artificial Intelligence for IT Operations) applies AI / big model capabilities to the operations and maintenance field, unifies the access to various operations and maintenance data such as monitoring, logs, alarms, links, and assets, and uses algorithms to perform anomaly detection, alarm noise reduction, root cause analysis, fault prediction, and automatic handling.

[0025] 4) Prometheus, an open-source time-series database and monitoring system, is a monitoring component in the cloud-native domain.

[0026] 5) Retrieval-Augmented Generation (RAG): Retrieval-Augmented Generation is a mainstream technical solution used to address the illusion of large models and the lack of private knowledge.

[0027] 6) Kubernetes (K8s), an open-source container orchestration platform, is the de facto standard for cloud-native applications. It manages Docker containers at scale and is used for automating container deployment, scheduling, scaling, fault healing, and rolling updates.

[0028] 7) Flink, an open-source distributed real-time computing engine.

[0029] With the widespread adoption of microservice architectures and containerization technologies (such as Docker and Kubernetes), cloud-native systems have become the mainstream of modern IT infrastructure. Against this backdrop, Prometheus has become the core open-source monitoring solution in cloud-native environments. However, existing Prometheus-based monitoring systems have the following limitations: Alarms relying on static thresholds cannot adapt to dynamic changes in business load, easily leading to alarm storms or alarm fatigue.

[0030] Inefficient root cause analysis: In complex microservice architectures, engineers need to spend a lot of time manually checking for correlations, which seriously affects the troubleshooting time (MTTR).

[0031] Lack of predictive maintenance capabilities: Monitoring systems are mostly reactive and cannot provide early warnings of potential risks.

[0032] AIOps solutions face integration challenges: existing AIOps platforms are not tightly integrated with cloud-native technologies, resulting in poor model performance and high deployment and maintenance costs.

[0033] In view of this, this application provides an intelligent diagnostic method and related equipment. This solution collects multi-source data, including time-series indicators, system events, and topology information; determines whether the multi-source data is abnormal; if abnormalities are found, core evidence is constructed based on the multi-source data, and a thought chain example is obtained by querying a vector knowledge base based on the core evidence. The core evidence includes deep context, improving the accuracy and efficiency of diagnosis; the core evidence and the thought chain example are used to construct a diagnostic reasoning query, and a large language model is used to reason based on the diagnostic reasoning query to obtain the reasoning result. This eliminates the need for complex model deployment, achieving automated fault diagnosis and providing the ability to diagnose unknown faults, thus improving model detection performance; a diagnostic report is generated based on the reasoning result, achieving logically clear and verifiable fault diagnosis, increasing the trust of maintenance personnel in the automated diagnostic results, and improving user experience.

[0034] The intelligent diagnostic method provided in this application relates to the field of computer system operation and maintenance technology. The intelligent diagnostic method provided in this application can be applied to a terminal, a server, or software running on a terminal or server. In some embodiments, the terminal can be a smartphone, tablet, laptop, desktop computer, smart speaker, smartwatch, or vehicle terminal, but is not limited to these. The server can be configured as an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The server can also be a node server in a blockchain network. The software can be an application implementing the intelligent diagnostic method, but is not limited to the above forms.

[0035] This application can be used in a wide variety of general-purpose or special-purpose computer system environments or configurations. Examples include: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics devices, network PCs, minicomputers, mainframe computers, and distributed computing environments including any of the above systems or devices. This application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform specific tasks or implement specific abstract data types. This application can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0036] It should be noted that in all specific embodiments of this application, when processing data related to user identity or characteristics, such as user information, user behavior data, user historical data, and user location information, user permission or consent is obtained first. Furthermore, the collection, use, and processing of this data comply with relevant laws, regulations, and standards. In addition, when embodiments of this application require access to sensitive personal information of users, separate permission or consent from the user is obtained through pop-ups or redirection to confirmation pages. Only after obtaining the user's separate permission or consent is the necessary user-related data required for the proper functioning of these embodiments acquired.

[0037] Figure 1 This is an optional flowchart of the intelligent diagnostic method provided in the embodiments of this application. Figure 1 The method may include, but is not limited to, steps S101 to S105.

[0038] Step S101: Collect multi-source data.

[0039] Specifically, multi-source data includes time-series metrics, system events, and topology information.

[0040] In some embodiments, raw data is actively pulled or passively received from multiple data sources.

[0041] Furthermore, the raw data is standardized and transformed into a unified internal data structure.

[0042] Understandably, the processed multi-source data is stored in real time in a context data buffer with time-series characteristics, providing subsequent processes with a complete, multi-dimensional snapshot of the system's state within a specific time window.

[0043] In this embodiment, multi-source data is collected to prepare for subsequent fault diagnosis.

[0044] Step S102: Determine whether there are any anomalies in the multi-source data.

[0045] In some embodiments, key indicators of multi-source data are analyzed using an analytical model to obtain preliminary abnormal nodes; downstream service nodes of the preliminary abnormal nodes are obtained based on a service dependency topology graph, and the preliminary abnormal nodes and downstream service nodes constitute a potential impact domain; a business criticality weight is configured for each service node in the potential impact domain, and a business impact score is calculated based on the potential impact domain and the business criticality weight; if the business impact score is greater than a preset decision threshold, it is determined that there is an anomaly in the multi-source data. The service nodes in the potential impact domain include the preliminary abnormal nodes and downstream service nodes.

[0046] Among them, key indicators can be time-series indicators or user-defined indicators.

[0047] Optionally, the core health metrics of each service node in the potential impact domain can be queried and identified. If a core health metric shows a deterioration trend, the degree of deterioration of the core health metric showing the deterioration trend can be analyzed, and the business impact score can be updated based on the degree of deterioration. The core health metrics can be user-defined.

[0048] It should be noted that if anomalies are found in multi-source data, a high-priority diagnostic task will be instantiated.

[0049] In this embodiment, it is determined whether there are anomalies in the multi-source data, which provides support for subsequent diagnosis of the data with anomalies.

[0050] Step S103: If there are anomalies in the multi-source data, construct core evidence based on the multi-source data, and obtain the thought chain example by querying the vector knowledge base based on the core evidence.

[0051] Specifically, the core evidence includes deep context.

[0052] In some embodiments, if anomalies exist in the multi-source data, the multi-source data is parsed to extract key technical entities, and these key technical entities are associated with the multi-source data. A time-series entity co-occurrence graph is constructed based on the key technical entities. A graph centrality algorithm is used to calculate the evidence significance score corresponding to the key technical entities based on the time-series entity co-occurrence graph. The corresponding multi-source data are sorted based on the evidence significance score of the key technical entities, and the top-ranked multi-source data are selected as core evidence.

[0053] Furthermore, feature vectors of the core evidence are extracted, including three modal feature vectors. The similarity of each modal feature vector is calculated by querying a vector knowledge base, resulting in similarity across three dimensions. These three similarities are then fused to obtain a comprehensive similarity. Based on the comprehensive similarity, historical successful cases matching the core evidence are identified, serving as examples of the thought chain. The three modal feature vectors include temporal morphological feature vectors, topological structure feature vectors, and semantic context feature vectors.

[0054] In this embodiment, if anomalies are found in the multi-source data, core evidence is constructed based on the multi-source data, and a thought chain example is obtained by querying the vector knowledge base based on the core evidence, which improves the accuracy and efficiency of diagnosis.

[0055] Step S104: Construct the core evidence and thought chain examples into a diagnostic reasoning query, and obtain the reasoning result by reasoning based on the diagnostic reasoning query through the large language model.

[0056] In some embodiments, core evidence is populated into the query template to obtain a diagnostic reasoning query; the diagnostic reasoning query is enhanced by the thought chain example to obtain an enhanced diagnostic reasoning query.

[0057] Optionally, core evidence and thought chain examples can be populated into the query template to obtain a diagnostic reasoning query, which includes output format constraints.

[0058] Furthermore, the diagnostic reasoning query is input into the trained large language model, and the large language model performs reasoning based on the diagnostic reasoning query to obtain the reasoning result.

[0059] In this embodiment, the core evidence and thought chain examples are constructed as a diagnostic reasoning query. The reasoning result is obtained by reasoning based on the diagnostic reasoning query through a large language model. Without the need for complex model deployment, the model achieves automated fault diagnosis, has the ability to diagnose unknown faults, and improves the model detection effect.

[0060] Step S105: Generate a diagnostic report based on the reasoning results.

[0061] In some embodiments, a visual diagnostic report is generated based on the inference results using a large language model or visualization engine, and the diagnostic report is displayed on the diagnostic page of the user's device.

[0062] Understandably, visualized diagnostic reports allow for user feedback.

[0063] Furthermore, user feedback on the diagnostic report is obtained; if the user feedback indicates that the diagnosis is correct, feature vectors of three different modalities—temporal pattern, topological structure, and semantic context—are extracted from the diagnostic reasoning query; and the feature vectors of the three different modalities are stored in the vector knowledge base.

[0064] Understandably, this embodiment creates a digital operations and maintenance expert capable of self-learning and continuous evolution. Each successful diagnosis becomes a valuable, reusable experience for the system (i.e., stored in a vector knowledge base), causing the accuracy and efficiency of diagnosis to spiral upwards over time.

[0065] In this embodiment, a diagnostic report is generated based on the reasoning results, which realizes logically clear and verifiable fault diagnosis, improves the trust of maintenance personnel in the automated diagnostic results, and enhances the user experience.

[0066] Steps S101 to S105 as illustrated in this embodiment involve collecting multi-source data, including time-series indicators, system events, and topology information; determining whether the multi-source data contains anomalies; if anomalies are found, constructing core evidence based on the multi-source data; querying the vector knowledge base based on the core evidence to obtain a thought chain example; the core evidence includes deep context, improving the accuracy and efficiency of diagnosis; constructing a diagnostic reasoning query using the core evidence and the thought chain example; and obtaining the reasoning result through reasoning based on the diagnostic reasoning query using a large language model, eliminating the need for complex model deployment and achieving automated fault diagnosis, providing the ability to diagnose unknown faults and improving model detection performance; generating a diagnostic report based on the reasoning result, achieving logically clear and verifiable fault diagnosis, increasing the trust of maintenance personnel in the automated diagnostic results, and improving user experience.

[0067] Please see Figure 2 In some embodiments, the intelligent diagnostic method provided in this application further includes a feedback step, which may include, but is not limited to, steps S201 to S203: Step S201: Receive user feedback that the diagnosis was accurate and the complete context of the diagnosis.

[0068] In some embodiments, users can judge the accuracy of the current diagnostic report and provide feedback through a visual diagnostic report page.

[0069] Step S202: Extract the feature vectors of the three modalities of the successful cases.

[0070] Specifically, the three modal feature vectors include topological structure, feature semantic context features, and temporal morphological features.

[0071] Understandably, if the user feedback indicates that the diagnosis is correct, feature vectors from three different modalities—temporal morphology, topological structure, and semantic context—are extracted from the diagnostic reasoning query.

[0072] In step S202 of some embodiments, when a diagnostic case confirmed as "accurate" through user feedback needs to be solidified, the module extracts and encodes feature vectors of three different modalities: temporal morphology, topological structure, and semantic context, and stores them in a vector knowledge base.

[0073] Step S203: Store the three types of vectors in the vector knowledge base and associate them with the case.

[0074] In some embodiments, feature vectors of three different modalities are stored in a vector knowledge base.

[0075] Please see Figure 3 In some embodiments, step S103 may include, but is not limited to, steps S301 to S304: Step S301: Heterogeneous data materialization.

[0076] It should be noted that if anomalies are found in multi-source data, a high-priority diagnostic task will be instantiated.

[0077] In step S301 of some embodiments, a diagnostic task is received, and preliminary correlation data of multi-source data is retrieved from the context buffer in a targeted manner, and key technical entities of the preliminary correlation data are extracted. These technical entities include service names, IP addresses, TracelD, etc.

[0078] Step S302: Construct a temporal entity co-occurrence graph.

[0079] In step S302 of some embodiments, a temporal entity co-occurrence graph is constructed based on key technology entities.

[0080] In this context, the temporal entity co-occurrence graph uses entities as nodes and co-occurrence relationships as edges.

[0081] Step S303: Calculation of the salience of evidence nodes.

[0082] In step S303 of some embodiments, a graph centrality algorithm is used to calculate the evidence significance score corresponding to the key technology entity based on the temporal entity co-occurrence graph.

[0083] Optionally, a graph centrality algorithm combined with information entropy can be used to calculate the "evidence significance score" for each entity.

[0084] Step S304: Screening for highly significant evidence involves sorting the original data entries based on their scores.

[0085] In step S304 of some embodiments, the corresponding multi-source data are sorted based on the evidence significance score of the key technical entities, and the top number of multi-source data are selected as core evidence.

[0086] Among them, the first few quantities, that is, the first K, where K can be a positive integer, such as 1, 2, 3, 4, etc. Optionally, select Top-K core evidence to obtain "thought chain examples" (if available), and fill the core evidence and "thought chain examples" into the query template containing "output format constraints" to obtain the constructed structured query (i.e. diagnostic reasoning query).

[0087] Furthermore, the structured query constructed via API is sent to the large language model.

[0088] Please see Figure 4 In some embodiments, step S103 may also include, but is not limited to, steps S401 to S407: Step S401: Receive the core features of the new diagnostic task.

[0089] In step S401 of some embodiments, the core features (i.e. core evidence) of the diagnostic task are received.

[0090] Step S402: Extract the feature vectors of the three modalities of the new task.

[0091] Specifically, the three modal feature vectors include temporal morphological features, topological features, and semantic context features.

[0092] In step S402 of some embodiments, three modal feature vectors of core evidence are extracted.

[0093] Step S403: In the vector knowledge base, calculate the similarity with historical cases by modality.

[0094] In step S403 of some embodiments, the similarity of each modality feature vector is calculated by querying the vector knowledge base to obtain the similarity in three dimensions.

[0095] Step S404: The similarity is fused into a comprehensive similarity using a weighted function.

[0096] In step S404 of some embodiments, the similarity in the three dimensions is fused into a comprehensive similarity by a preset or user-defined weighting function.

[0097] Step S405: Retrieve the historical success cases with the highest overall similarity.

[0098] In step S405 of some embodiments, historical successful cases that match the core evidence are determined based on comprehensive similarity, and these historical successful cases are used as examples of the thought chain.

[0099] Step S406: Format the case as a mind chain example.

[0100] Step S407, return to the mind chain example.

[0101] Please see Figure 5 In some embodiments, step S102 may also include, but is not limited to, steps S501 to S504: Step S501: Service dependency resolution and influence domain identification.

[0102] It should be noted that, based on the initial detection of component anomalies, we are conducting related rights confirmation and initiating impact assessment.

[0103] In step S501 of some embodiments, the real-time topology is obtained and all downstream services are identified.

[0104] Understandably, by analyzing key indicators of multi-source data through analytical models, preliminary abnormal nodes are obtained. Based on the service dependency topology graph, downstream service nodes of the preliminary abnormal nodes are obtained, and the preliminary abnormal nodes and downstream service nodes constitute a potential influence domain.

[0105] Optionally, key metrics can be customized by the user.

[0106] Step S502, Impact path weighting and quantization.

[0107] In step S502 of some embodiments, the initial service impact score is calculated by weight accumulation (including attenuation factor) along the path.

[0108] It is understandable that a business criticality weight is configured for each service node in the potential impact domain, and the business impact score is calculated based on the potential impact domain and the business criticality weight.

[0109] Step S503: Downstream health status verification and risk escalation.

[0110] In step S503 of some embodiments, health indicators affecting services within the domain are queried concurrently.

[0111] Optionally, if downstream indicators are found to have deteriorated, the business impact score can be dynamically increased based on the degree of deterioration.

[0112] Understandably, the core health metrics of each service node in the potential impact domain are queried and identified; if the core health metrics show a deterioration trend, the degree of deterioration of the core health metrics showing a deterioration trend is analyzed, and the business impact score is updated based on the degree of deterioration.

[0113] Step S504, threshold decision and task instantiation.

[0114] In step S504 of some embodiments, it is determined whether the business impact score is greater than the decision threshold. If so, a high-priority diagnostic task is instantiated; otherwise, the current triggering is suppressed and monitoring continues.

[0115] Understandably, if the business impact score exceeds the preset decision threshold, it is determined that there is anomaly in the multi-source data.

[0116] Figure 6 This is a schematic diagram of the cloud-native system architecture. In this embodiment, the intelligent diagnosis of the cloud-native system is performed through an intelligent diagnostic device (AI Agent) deployed in the cloud-native environment. This Agent internally establishes an automated closed-loop workflow of perception-decision-reasoning-learning, the overall process of which is shown in the attached diagram. Figure 7As shown, this workflow does not rely on pre-training for specific failure modes, but dynamically combines the real-time operating status of the system with external general reasoning capabilities to solve complex operation and maintenance diagnosis problems in a programmatic manner.

[0117] The intelligent diagnostic device includes the following logic modules: Module 1, Environmental Awareness Module 10: This module serves as the system's unified data entry point and real-time status representation center.

[0118] Functionality: Enables connectivity with various heterogeneous data sources in a cloud-native environment (e.g., additional data sources) through a pluggable data source adapter layer. Figure 6 It enables efficient asynchronous communication with Prometheus 210, Kubernetes API Server 220, and logging systems such as Loki.

[0119] Processing logic: This module actively pulls or passively receives raw data from the data source and immediately performs normalization processing, transforming it into a unified internal data structure. The processed data is stored in real time in a context data buffer with time-series characteristics, providing subsequent modules with a complete, multi-dimensional snapshot of the system's state within a specific time window.

[0120] Module 2, Anomaly Decision Module 20: This module acts as an intelligent gatekeeper and trigger for the diagnostic process.

[0121] Function: Employs a two-stage decision-making mechanism to ensure the accuracy of diagnostic triggers and effectively suppress alarm storms.

[0122] Processing logic: Phase 1: Preliminary Detection. This module incorporates multiple analytical models to perform real-time analysis of the data stream of key indicators, identifying preliminary anomalies that deviate from normal behavioral patterns.

[0123] Phase Two: Related Rights Confirmation and Impact Assessment. Upon detection of an initial anomaly, an anomaly event aggregation engine is activated. To further improve the accuracy of diagnostic triggering, this invention innovatively implements an intelligent diagnostic triggering algorithm based on business impact assessment in this phase. The detailed process is attached. Figure 5 As shown: a) Service Dependency Resolution and Impact Domain Identification: The algorithm first obtains the real-time service dependency topology map of the system, and based on this, accurately identifies all downstream services that depend on the abnormal component, forming a potential impact domain.

[0124] b) Impact Path Weighting and Quantification: The algorithm assigns a business criticality weight to each service node in the graph and performs weighted accumulation along the impact path (a path decay factor can be introduced) to finally calculate a quantified business impact score.

[0125] c) Downstream health status verification and risk escalation: The algorithm concurrently queries the core health indicators of all services within the potential impact domain. If an existing indicator is found to be deteriorating, the risk escalation of the business impact score will be dynamically adjusted according to the degree of deterioration.

[0126] d) Threshold decision and task instantiation: Ultimately, a high-priority diagnostic task is instantiated and passed to subsequent modules only when the calculated business impact score exceeds the preset decision threshold.

[0127] Module 3, Cognitive Reasoning Module 30: This module constitutes the core of the present invention and is a procedural reasoning coordinator that connects system facts with general intelligence.

[0128] Function: Its core responsibility is not to perform the reasoning itself, but to automatically construct a logically clear and information-complete structured diagnostic reasoning query (Prompt) from discrete multidimensional contextual evidence in a procedural manner.

[0129] Processing Logic: Upon receiving a diagnostic task, this module retrieves relevant data from the context data buffer based on the abnormal event. To improve the signal-to-noise ratio of the input data to the large language model, this invention innovatively implements a context refinement algorithm based on dynamic evidence graphs in this module, the detailed process of which is attached. Figure 3 As shown: a) Heterogeneous data entityization: The algorithm parses the initially collected data and automatically extracts key technical entities (such as service name, Pod IP, TraceID, etc.).

[0130] b) Constructing a temporal entity co-occurrence graph: The algorithm uses these entities as nodes and constructs a temporary evidence graph based on their co-occurrence relationships in time or logs.

[0131] c) Calculation of evidence node saliency: The algorithm uses graph centrality algorithm and other methods to calculate an evidence saliency score for each entity.

[0132] d) High-significance evidence screening and construction: The algorithm sorts all raw data entries according to their scores, selecting only the top K data entries containing the entity with the highest score as core evidence. Subsequently, the module populates this core evidence into a pre-defined query template with output format constraints and calls it via API (see Appendix). Figure 6 It is sent to the external general knowledge reasoning engine 300.

[0133] Module 4, Experience Learning Module 40: This module is key to enabling the self-evolution of diagnostic capabilities and the accumulation of knowledge.

[0134] Function: Its core adopts a method as shown in the attached figure. Figure 4 The diagram illustrates a closed-loop feedback architecture based on Retrieval-Augmented Generation (RAG). This invention employs a case knowledge retrieval algorithm based on multimodal feature fusion to achieve deeper and more accurate matching of historical fault cases.

[0135] Processing logic: Multimodal representation and storage of knowledge (experience accumulation process): as attached Figure 2 As shown in the experience accumulation process, when a diagnostic case is confirmed to be accurate through user feedback and needs to be solidified, the module will extract and encode feature vectors of three different modalities: temporal morphology, topological structure, and semantic context, and store them in the vector knowledge base.

[0136] Multimodal fusion retrieval and experience injection (experience injection process): as attached Figure 2 As shown in the experience injection process, when handling a new diagnostic task, the cognitive reasoning module first requests this module. This module extracts the three modal feature vectors of the new question, independently calculates the similarity in the three dimensions in the knowledge base, and merges them into a comprehensive similarity to find the best-matching historical success case. Finally, this case is formatted as a thought chain example to enhance the newly constructed diagnostic reasoning query.

[0137] Figure 8 This is a flowchart illustrating a specific implementation of the intelligent diagnostic method provided in this application when applied to the diagnosis of memory overflow (OOM) faults caused by data skew in a Kubernetes-based big data Flink cluster in a cloud-native system. Figure 8 The methods may include, but are not limited to, the following steps: Step 1, Environmental Perception and Anomaly Decision Making (corresponding to modules 10 and 20).

[0138] Continuous Awareness: The AI ​​Agent's environment awareness module 10 continuously collects all key performance metrics of the Flink cluster from Prometheus and monitors the event stream from the Kubernetes API Server in real time, storing the normalized data in the context data buffer (see attached diagram). Figure 7 Step S701 in the process.

[0139] Intelligent Decision Making: The anomaly decision-making module 20 analyzes the data stream in real time (S702). Its dynamic baseline model first detects a sudden increase in the `flink_taskmanager_job_task_numRestarts` metric, constituting an initial anomaly. This decision-making process follows the attached... Figure 5The business impact assessment process shown involves the aggregation engine being triggered, which is associated with multiple TaskManager Pods reporting OOMKilled events in succession. Due to the strong correlation between the metrics and events in terms of time and topology, constituting a substantial business impact (S703), the module confirms that this is a serious failure and formally creates and triggers a deep diagnostic task (S704).

[0140] Step 2, cognitive reasoning (corresponding to the collaboration of modules 30 and 40).

[0141] Deep Contextual Retrieval and Refinement: After receiving the task, the cognitive reasoning module 30 immediately performs deeper data mining on the Pod that experienced the OOM (Out of Memory) error (S705). This process follows the attached... Figure 3 The context refinement algorithm shown extracts detailed monitoring data of the faulty Pod, finds that its JVM heap memory usage is much higher than other instances, and filters these data entries containing significant entities (such as Pod name, high memory metrics) as core evidence.

[0142] Experience Retrieval and Enhancement (RAG): Before constructing the final query, the cognitive reasoning module consults the experience learning module 40 (S706). This process follows the appendix... Figure 4 The experience injection process shown in the diagram involves the experience learning module converting the core features of the current failure (Flink, OOMKilled, high memory usage in some instances) into a multimodal vector, retrieving them from its knowledge base, and finding historical success cases where uneven upstream data partitioning led to data skew, which are then returned as examples of the thought chain.

[0143] Structured query construction: The cognitive reasoning module fills the refined core evidence, along with the obtained thought chain examples, into a structured query template containing output format constraints (S707), and sends it to the general large language model service 300 via API (S708).

[0144] Step 3: Results generation, feedback, and experience learning (corresponding to modules 30 and 40).

[0145] Acquisition and Parsing: The cognitive reasoning module acquires and parses the JSON results returned by the model, accurately pointing out that the root cause is data skew, corresponding to step S709.

[0146] Report generation and outreach: The module generates a diagnostic report containing a clear chain of evidence and remediation recommendations, and sends it to the operations and maintenance team.

[0147] Closed-loop learning: After the operations engineer fixes the problem, they click the "Accurate Diagnosis" button (S710) on the report card. This feedback is captured by the experience learning module 40, and this learning process is the appendix. Figure 2The experience accumulation process shown involves the module automatically vectorizing this successful case into a multimodal form and storing it in its knowledge base (S711). Thus, the AI ​​Agent not only resolved a fault but also became more advanced through learning, successfully completing the attached... Figure 7 The diagram shows a complete closed loop of perception-decision-reasoning-learning.

[0148] It should be noted that this invention, compared with existing technologies, is not a simple functional optimization, but rather a paradigm-level innovation in the field of cloud-native fault diagnosis. Its core technical points and revolutionary effects are concentrated in the following aspects: 1. Innovation Point 1: It realizes a paradigm shift from experience-driven to general reasoning-driven, and has the ability to diagnose unknown faults.

[0149] Key technical points: The core of this invention is to abandon the traditional AIOps approach that relies on historical fault data for model training. It innovatively designs a cognitive reasoning module whose responsibility is to programmatically construct the system's real-time, multi-dimensional state (indicators, events, topology) into a structured diagnostic context (Prompt) and submit it to a general, pre-trained large language model for logical reasoning.

[0150] Revolutionary effect: This approach frees diagnostic systems from being limited to known, recurring failure patterns. Leveraging the generalization and reasoning capabilities of general artificial intelligence, it can effectively analyze complex, first-time-and-unseen failures based on first principles and available evidence, much like a human expert. This fundamentally solves the limitations of traditional AIOps models, which suffer from weak generalization and low failure coverage.

[0151] 2. Innovation Point Two: A feedback-based Retrieval Enhancement Generation (RAG) self-evolutionary closed loop was constructed, realizing the automated accumulation and large-scale replication of expert knowledge.

[0152] Key Technical Points: This invention uniquely introduces an experience learning module. This module receives feedback from operations and maintenance personnel regarding the validity of diagnostic results, vectorizes successful diagnostic context-reasoning results, and solidifies them into an internal vector knowledge base. When dealing with new problems, the system prioritizes searching this knowledge base and injects the most similar successful cases as thought chain examples into the new diagnostic context.

[0153] Revolutionary effect: This is equivalent to creating a digital operations and maintenance expert capable of self-learning and continuous evolution. Every successful diagnosis becomes a valuable, reusable experience for the system, causing the accuracy and efficiency of diagnosis to spiral upwards over time. It transforms the implicit troubleshooting knowledge of top operations and maintenance experts into scalable, 24 / 7 online automated capabilities.

[0154] 3. Innovation Point Three: It delivered a diagnostic report with an explainable process and reliable conclusions, solving the black-box trust problem of AI in the field of operation and maintenance.

[0155] Technical highlights: This invention forces large language models to return structured results containing root causes, complete chains of evidence, and reasoning logic by designing output format constraints in structured queries.

[0156] Revolutionary effect: What is ultimately delivered to users is no longer a simple alarm conclusion, but a logically clear and verifiable analysis report. Operations personnel can clearly see how the system derives the final conclusion step by step from the raw data, greatly enhancing their trust in the automated diagnostic results and solving the core pain point that traditional machine learning models, due to their black-box nature, are difficult to adopt in serious production environments.

[0157] 4. Innovation Point Four: It adopts a plug-and-play autonomous AI Agent architecture, which greatly reduces the threshold for implementing advanced AIOps solutions.

[0158] Key technical points: This invention encapsulates all complex diagnostic logic into a lightweight, independent, autonomous diagnostic AIAgent.

[0159] Revolutionary effect: Users no longer need to go through complex model selection, data cleaning, and lengthy model training. They can simply deploy the agent in any standard cloud-native environment and configure the data source, just like deploying a regular application, to obtain top-notch intelligent diagnostic capabilities. This transforms advanced AIOps technology from a luxury that only a few leading companies can afford into a standard component that can be easily applied by a wide range of enterprises.

[0160] Please see Figure 9 This application also provides an intelligent diagnostic device that can implement the above-described method. The device includes: The data acquisition module 901 is used to collect multi-source data, including time-series indicators, system events, and topology information. The anomaly detection module 902 is used to determine whether there are anomalies in multi-source data; Example query module 903 is used to construct core evidence based on multi-source data if anomalies exist in multi-source data, and obtain the thought chain example by querying the vector knowledge base based on the core evidence. The core evidence includes deep context. The model reasoning module 904 is used to construct a diagnostic reasoning query from core evidence and thought chain examples, and to obtain the reasoning result by reasoning based on the diagnostic reasoning query through the large language model. The report generation module 905 is used to generate diagnostic reports based on the reasoning results.

[0161] It is understood that the content of the above method embodiments is applicable to the present device embodiments. The specific functions implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0162] This application also provides an electronic device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the above-described method. This electronic device can be any smart terminal, including tablet computers, in-vehicle computers, etc.

[0163] It is understood that the content of the above method embodiments is applicable to this device embodiment. The specific functions implemented by this device embodiment are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0164] Please see Figure 10 , Figure 10 The hardware structure of an electronic device according to another embodiment is illustrated. The electronic device includes: The processor 1001 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this application. The memory 1002 can be implemented as a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 1002 can store the operating system and other applications. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 1002 and is called and executed by the processor 1001 using the methods described in the embodiments of this application. Input / output interface 1003 is used to implement information input and output; The communication interface 1004 is used to enable communication and interaction between this device and other devices. Communication can be achieved through wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.). Bus 1005 transmits information between various components of the device (e.g., processor 1001, memory 1002, input / output interface 1003, and communication interface 1004); The processor 1001, memory 1002, input / output interface 1003 and communication interface 1004 are connected to each other within the device via bus 1005.

[0165] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described method.

[0166] It is understood that the content of the above method embodiments is applicable to this storage medium embodiment. The specific functions implemented in this storage medium embodiment are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those achieved in the above method embodiments.

[0167] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0168] It is understood that the content of the above method embodiments is applicable to the embodiments of this program product. The specific functions implemented by the embodiments of this program product are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0169] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. Furthermore, memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory may optionally include memory remotely located relative to the processor, and these remote memories can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0170] The intelligent diagnostic method, device, electronic device, storage medium, and program product provided in this application collect multi-source data, including time-series indicators, system events, and topology information; determine whether there are anomalies in the multi-source data; if anomalies are found, construct core evidence based on the multi-source data, and obtain thought chain examples by querying a vector knowledge base based on the core evidence. The core evidence includes deep context, improving the accuracy and efficiency of diagnosis; construct a diagnostic reasoning query using the core evidence and thought chain examples, and obtain the reasoning result by reasoning based on the diagnostic reasoning query using a large language model. This eliminates the need for complex model deployment operations, achieving automated fault diagnosis, possessing the ability to diagnose unknown faults, and improving the model detection effect; and generate a diagnostic report based on the reasoning result, achieving logically clear and verifiable fault diagnosis, increasing the trust of maintenance personnel in the automated diagnostic results, and improving the user experience.

[0171] The embodiments described in this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided by the embodiments of this application. As those skilled in the art will know, with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.

[0172] Those skilled in the art will understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of this application, and may include more or fewer steps than shown, or combine certain steps, or different steps.

[0173] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0174] Those skilled in the art will understand that all or some of the steps in the methods disclosed above, as well as the functional modules / units in the systems and devices, can be implemented as software, firmware, hardware, or suitable combinations thereof.

[0175] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0176] It should be understood that in this application, "at least one (item)" means one or more, and "more than" means two or more. "And / or" is used to describe the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one (item) of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one (item) of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0177] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of the units described above is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0178] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0179] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0180] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes multiple instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing programs, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0181] The preferred embodiments of the present application have been described above with reference to the accompanying drawings, but this does not limit the scope of the claims of the present application. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and substance of the embodiments of the present application shall be within the scope of the claims of the present application.

Claims

1. An intelligent diagnostic method, characterized in that, The method includes the following steps: Collect multi-source data, including time-series indicators, system events, and topology information; Determine whether there are any anomalies in the multi-source data; If the multi-source data is abnormal, core evidence is constructed based on the multi-source data, and a thought chain example is obtained by querying the vector knowledge base based on the core evidence. The core evidence includes deep context. The core evidence and the thought chain example are used to construct a diagnostic reasoning query, and the reasoning result is obtained by reasoning based on the diagnostic reasoning query using a large language model. A diagnostic report is generated based on the reasoning results.

2. The method according to claim 1, characterized in that, The determination of whether the multi-source data is abnormal includes: By analyzing the key indicators of the multi-source data using the analytical model, preliminary abnormal nodes are obtained. The downstream service nodes of the initial anomaly point are obtained based on the service dependency topology graph. The initial anomaly point and the downstream service nodes are combined to form a potential influence domain. The service nodes of the potential influence domain include the initial anomaly point and the downstream service nodes. Configure a business criticality weight for each service node in the potential impact domain, and calculate the business impact score based on the potential impact domain and the business criticality weight; Query and identify the core health metrics for each service node in the potential impact domain; If the core health indicators show a deteriorating trend, the degree of deterioration of the core health indicators showing a deteriorating trend is analyzed, and the business impact score is updated based on the degree of deterioration. If the business impact score is greater than the preset decision threshold, then it is determined that the multi-source data is abnormal.

3. The method according to claim 1, characterized in that, If the multi-source data contains anomalies, then core evidence is constructed based on the multi-source data, including: If the multi-source data is abnormal, the multi-source data is parsed to extract key technical entities, and the key technical entities are associated with the multi-source data. Construct a temporal entity co-occurrence graph based on the aforementioned key technology entities; The graph centrality algorithm is used to calculate the evidence significance score corresponding to the key technology entity based on the temporal entity co-occurrence graph; Based on the evidence significance score of the key technical entity, the corresponding multi-source data are sorted, and the top-ranked number of multi-source data are selected as core evidence.

4. The method according to claim 1, characterized in that, The example of obtaining the thought chain based on the core evidence query vector knowledge base includes: The feature vectors of the core evidence are extracted. The feature vectors include three modal feature vectors, namely temporal morphological feature vectors, topological structure feature vectors, and semantic context feature vectors. The similarity of each modality feature vector is calculated by querying the vector knowledge base, resulting in similarity in three dimensions; The similarity scores across the three dimensions are combined to obtain a comprehensive similarity score. Based on the comprehensive similarity, historical successful cases that match the core evidence are identified, and these historical successful cases are used as examples of the thought chain.

5. The method according to claim 1, characterized in that, The construction of a diagnostic reasoning query by combining the core evidence with the thought chain example includes: Fill the query template with the core evidence to obtain the diagnostic reasoning query; The diagnostic reasoning query is enhanced by the aforementioned thought chain example to obtain the enhanced diagnostic reasoning query. Alternatively, the core evidence and the thought chain example can be filled into the query template to obtain a diagnostic reasoning query, wherein the query template includes output format constraints.

6. The method according to claim 1, characterized in that, The method further includes: Obtain user feedback on the diagnostic report; If the user feedback indicates that the diagnosis is correct, then feature vectors of the three different modalities of the diagnostic reasoning query—temporal morphology, topological structure, and semantic context—are extracted. The feature vectors of the three different modalities are stored in the vector knowledge base.

7. An intelligent diagnostic device, characterized in that, The device includes: The data acquisition module is used to collect multi-source data, including time-series indicators, system events, and topology information. An anomaly detection module is used to determine whether there are any anomalies in the multi-source data; The example query module is used to construct core evidence based on the multi-source data if an anomaly exists in the multi-source data, and to query the vector knowledge base based on the core evidence to obtain a thought chain example, wherein the core evidence includes deep context. The model reasoning module is used to construct a diagnostic reasoning query by combining the core evidence and the thought chain example, and to obtain the reasoning result by reasoning based on the diagnostic reasoning query through the large language model. The report generation module is used to generate a diagnostic report based on the reasoning results.

8. An electronic device, characterized in that, The electronic device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the method according to any one of claims 1 to 6.

9. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 6.

Images