Edge-side root cause analysis method and system based on semantic cache and rule engine

Abstract

The application discloses an edge side root cause analysis method and system based on semantic cache and a rule engine, and the method comprises the following steps: collecting edge device indexes and log data; performing alarm detection on the indexes, performing deduplication and aggregation to form an alarm group; performing correlation analysis on the alarm group and the log to extract abnormal logs; inputting alarm group features and associated logs into a four-layer hierarchical decision chain reasoning; outputting an optimal root cause and a repair suggestion by comprehensively considering the confidence of each layer; and storing the result in a cache and recording the reasoning steps to form a traceable path. The application combines alarm aggregation, log correlation, semantic cache and hierarchical reasoning, solves the problems of split alarm logs, dependence on the cloud, lack of interpretability and missing analysis of telecom-specific indexes in edge operation and maintenance, and realizes independent operation, low delay and traceable intelligent root cause analysis on the edge side.

Description

Technical Field

[0001] This invention relates to the field of intelligent operation and maintenance technology for telecommunications access network equipment, specifically to an edge-side root cause analysis method and system based on semantic caching and rule engine. Background Technology

[0002] With the rapid popularization of 5G communication and edge computing, the operational complexity of wireless access network equipment (such as BBU, RRU, pRRU, HUB / RHUB) has increased dramatically. In high-density deployment scenarios, equipment failures often involve complex interactions between multiple hardware subsystems and services, such as RF transceivers, power amplifiers, antennas, fronthaul optical modules, and air interface signals. Single alarms or log information are far from sufficient to accurately pinpoint the root cause. Existing intelligent operations and maintenance (AIOps) systems still have significant shortcomings in architecture design, data fusion, and domain adaptation, making it difficult to meet the high-precision, low-latency edge operations and maintenance requirements.

[0003] At the root cause analysis level, traditional cloud-based RCA solutions rely on uploading alarms and logs to cloud-based large models and CMDB topologies for top-down inference. Although they have been applied in large data centers, their end-to-end latency can reach several minutes. Continuous data transmission leads to bandwidth consumption and privacy risks, and they cannot operate independently at the edge. Network interruption causes analysis failure.

[0004] At the alarm and log processing level, existing aggregation and correlation analysis mostly adopt time window merging or static rule matching, which is difficult to adapt to dynamic fault modes, resulting in high false alarm and false negative rates. Furthermore, the log and alarm systems are isolated from each other, lacking linkage and collaboration. Rule writing relies on manual intervention, and the coverage of unknown anomalies is insufficient, which seriously restricts the accuracy of root cause location.

[0005] In terms of inference efficiency, although LLM semantic cache reduces costs by reusing historical results through vector database, its caching strategy is general LRU or fixed TTL. It does not design alarm level weighting and timeliness decay for operation and maintenance scenarios. The hit judgment only relies on text vector distance and lacks fault context semantic fusion, resulting in insufficient effectiveness and reliability.

[0006] Focusing further on telecom access network scenarios, typical faults (fronthaul link interruption / bit error, RF performance degradation, VSWR anomaly, optical module aging, power amplifier overheating, and air interface quality deterioration) all manifest as interconnected changes in multiple hardware subsystems and service indicators. Determining the root cause requires comprehensive analysis of SFP optical module DDM data, power amplifier power / temperature / VSWR, forward / reverse power, ambient temperature, and RSRP / SINR, among other multi-dimensional indicators. However, existing alarm and log systems lack cross-dimensional joint analysis capabilities for these telecom-specific indicators, forcing maintenance personnel to manually check multiple subsystems one by one, resulting in extremely low localization efficiency.

[0007] The above scenarios reveal a core common problem: the root cause of a failure rarely originates from a single metric, but is mostly caused by the coordinated changes of multiple hardware subsystems and business metrics. However, existing alarm and log systems are fragmented and lack cross-dimensional joint analysis capabilities for the aforementioned telecom-specific metrics (RF, PA, VSWR, fronthaul optical modules, and air interface signals). Maintenance personnel still have to check multiple subsystems one by one, resulting in low localization efficiency.

[0008] In summary, the existing technology has at least the following drawbacks:

[0009] 1. Cloud-based dependency prevents offline operation: Traditional root cause analysis relies on large cloud models, which become completely unavailable when the network is interrupted, failing to meet the offline operation and maintenance needs of edge devices.

[0010] 2. Disjointed alarm and log analysis: The two operate independently, lacking cross-source joint analysis, resulting in inaccurate root cause localization and a high risk of false alarms or missed alarms.

[0011] 3. Semantic caching is not optimized for operation and maintenance scenarios: General caching strategies do not consider time-sensitive decay, alarm level weighting and context association, resulting in low hit rate and possible return of expired results.

[0012] 4. The analysis process is not traceable: Most existing AI solutions are black-box analyses, and maintenance personnel cannot understand the reasoning path and judgment basis, making it difficult to verify the credibility of the results.

[0013] 5. Lack of multi-dimensional correlation analysis capabilities for telecom-specific faults: Existing solutions only focus on general IT indicators (CPU, memory, network, etc.) and do not design cross-dimensional joint root cause analysis mechanisms for telecom-specific hardware subsystems such as RF, power amplifier, antenna feeder, fronthaul optical modules, and air interface signals. For example, when VSWR rises abnormally, it is necessary to simultaneously correlate PA output power, reflected power, PA temperature, and changes in terminal RSRP / SINR to determine whether it is due to antenna feeder hardware failure, loose connectors, or changes in the coverage environment—this capability is currently lacking in existing solutions.

[0014] Therefore, there is an urgent need for a lightweight root cause analysis system that can integrate multi-dimensional telecommunications metrics and log data, has edge-independent reasoning capabilities, and is interpretable, in order to fill the gap in existing technologies in high-density operation and maintenance scenarios of telecommunications access networks. Summary of the Invention

[0015] This invention aims to at least solve one of the technical problems existing in the prior art. To this end, this invention proposes an edge-side root cause analysis method based on semantic caching and a rule engine.

[0016] An edge root cause analysis method based on semantic caching and rule engine according to an embodiment of the present invention includes the following steps:

[0017] S1. Collect operational status indicator data and log data from edge devices;

[0018] S2. Detect alarms on the collected indicator data, generate alarm events, and perform deduplication and aggregation on the alarm events to form alarm groups containing multi-dimensional indicator feature vectors.

[0019] S3. Perform correlation analysis between the alarm group and the log data in the corresponding time window to extract abnormal log records related to the alarm device;

[0020] S4 inputs the feature vector and associated logs of the alarm group into a four-layer hierarchical decision chain for root cause inference. The four-layer hierarchical decision chain includes:

[0021] L0 layer: Based on the rule engine, it performs fixed rule matching. When the alarm feature matches the preset rule, it directly outputs the root cause and the first confidence level.

[0022] L1 layer: If the L0 layer does not output a root cause higher than the first preset threshold, then inference is performed based on the statistical anomaly detection method, and the root cause and second confidence level are output.

[0023] L2 layer: If the L1 layer does not output a root cause higher than the second preset threshold, the semantic cache is queried. The semantic cache stores historical analysis results. The similarity between the current request and the cache entry is calculated, and a comprehensive score is made by combining the timeliness weight and the alarm level weight. When the comprehensive score exceeds the third preset threshold, the cache is hit, and the root cause and third confidence level of the cache are returned.

[0024] L3 layer: If the L2 layer fails to hit or the output confidence score is lower than the fourth preset threshold, the large language model is called to perform deep semantic reasoning and output the root cause and the fourth confidence score.

[0025] S5. Combine the confidence scores of each layer's output, calculate the final confidence score, select the root cause with the highest confidence score as the diagnostic result, and generate repair suggestions;

[0026] S6. Store the results of this analysis in the semantic cache, and record the input, output and judgment basis of each step of the reasoning in the four-layer hierarchical decision chain to form a traceable reasoning path.

[0027] In some embodiments of the present invention, the comprehensive score calculation formula of the semantic cache is: comprehensive score = similarity × timeliness weight × alarm level weight, wherein the timeliness weight decays over time, and the alarm level weight increases with the alarm severity; the cache eviction policy combines LRU and comprehensive score, and entries with low comprehensive scores are evicted first.

[0028] In some embodiments of the present invention, the rule engine is a Lua script engine, the preset rules support runtime hot updates, and rule conflicts are automatically resolved according to priority; the statistical anomaly detection method includes Z-Score sliding window anomaly detection and linear regression trend analysis.

[0029] In some embodiments of the present invention, the method is applied to fault diagnosis of telecommunications access network equipment, and the collected index data includes telecommunications-specific indicators. These telecommunications-specific indicators include at least: TX power, EVM, and ACLR of the radio frequency transceiver; PA output power, temperature, and VSWR of the power amplifier; Tx / Rx optical power, bias current, and temperature of the SFP optical module; CPRI / eCPRI link status and bit error rate (BER); VSWR and reflected power of the antenna port; RSRP, SINR, CQI, RTWP, and noise floor of the air interface signal; and throughput and packet loss rate of the forwarding engine.

[0030] In some embodiments of the present invention, the telecommunications-specific metrics are collected through multiple acquisition adapters, including: six built-in standard adapters for collecting general IT metrics; and five telecommunications equipment CUSTOM adapters dynamically loaded via dlopen to directly collect telecommunications-specific metrics from the device's local hardware interface. The five CUSTOM adapters include I... 2 The system includes a C-bus EEPROM read adapter, a PMBus power / amplifier monitoring adapter, an SFP digital diagnostic monitoring DDM adapter, an RS485 Modbus power amplifier monitoring adapter, and a memory-mapped hardware register HW_REG adapter; as well as a service software read adapter SW_COUNTER, which collects air interface signal quality and forwarding engine statistics from service software through shared memory. The acquisition process adopts a dual-channel acquisition coordination mechanism: the AI ​​real-time channel collects core indicators at a fixed period, while the general acquisition channel collects full telecommunications indicators at a configurable period. The two channels achieve complementary operation through phase offset and shared memory buffering.

[0031] In some embodiments of the present invention, the alarm aggregation and deduplication includes: merging duplicate alarms of the same device and the same type within a configurable time window; using an association rule matrix to associate related alarms of different indicators on the same device into alarm groups, with each rule defining the source alarm type, target alarm type, association type, and association strength; and using a three-level aggregation window to sequentially perform deduplication of the same type on the same device, cross-type association on the same device, and cross-device topology association.

[0032] In some embodiments of the present invention, multidimensional telecommunications index correlation analysis is also included, specifically including:

[0033] Antenna Fault Correlation: When VSWR alarm and TX power alarm are triggered simultaneously, the PA temperature index is automatically correlated. Through three-dimensional correlation analysis of VSWR, TX power and PA temperature, the antenna hardware fault and power amplifier overheat protection are distinguished.

[0034] Fronthaul link fault correlation: When a CPRI link interruption alarm is triggered, the CPRI bit error rate (BER), SFPRx optical power, and RU heartbeat status are automatically correlated. By analyzing the correlation of these three factors, the faults of the interface module, the fiber optic link, or the overall fault of the RU equipment can be located.

[0035] Coverage Issue Correlation: When an RSRP drop alarm is triggered, it automatically correlates SINR, RRC connection count, TX power, and VSWR metrics to distinguish between coverage holes, capacity congestion, and equipment RF faults.

[0036] Multidimensional fault signature matching: Maintain a fault signature library. Each fault signature is defined by the joint anomaly pattern of multiple telecommunications indicators. By performing weighted multidimensional feature distance matching between the multidimensional indicator feature vector of the current alarm group and the fault signature library, a list of candidate root causes and matching degree are output.

[0037] In some embodiments of the present invention, a three-tiered protection system for alarm storms is also included:

[0038] Level T1: Rate limiting is applied to alarms on a single device; alarms exceeding the preset rate limit are discarded or merged.

[0039] Level T2: Performs storm detection on global alarms and triggers back pressure mechanism when the number of global alarms exceeds a preset threshold;

[0040] Level T3: Water level protection is implemented for the back pressure queue. When the queue water level is higher than the high water level threshold, low-priority alarms are rejected from being enqueued. When the queue water level is lower than the low water level threshold, normal reception is restored.

[0041] This invention also mentions an edge-side root cause analysis system based on semantic caching and a rule engine, comprising:

[0042] The data acquisition module is used to collect operational status metrics and log data from edge devices;

[0043] The alarm manager is used to generate alarms based on collected metrics, deduplicate and aggregate alarms to form alarm groups;

[0044] Log analyzer is used to parse logs in a structured way, identify abnormal patterns, and associate abnormal logs related to alarms as root cause candidates;

[0045] The rules engine module is used to perform fixed rule matching and output the first inference result and confidence score;

[0046] The semantic caching module is used to store historical analysis results and perform hit judgments through similarity calculation, timeliness weighting, and alarm level weighting, and outputs the cached inference results and confidence scores.

[0047] The anomaly detection module is used to perform anomaly detection and trend analysis based on statistical methods, and outputs the second inference result and confidence level.

[0048] The large language model interface module is used to call external large language models for deep reasoning and output the third reasoning result and confidence score.

[0049] The decision chain control module is used to call the rule engine module, anomaly detection module, semantic cache module and large language model interface module in L0-L3 order, calculate the final confidence score by combining the confidence scores output by each module, select the result with the highest confidence score as the diagnostic result, and output repair suggestions.

[0050] The traceability recording module is used to record the inputs, outputs, and judgment criteria of each step of the reasoning in the decision chain, forming a traceable reasoning path.

[0051] In some embodiments of the present invention, the system is deployed on the edge management device of the telecommunications access network equipment, and the data acquisition module includes a variety of acquisition adapters for acquiring general IT indicators and telecommunications-specific indicators. The telecommunications-specific indicators include at least radio frequency transceiver parameters, power amplifier parameters, antenna feeder parameters, fronthaul optical module parameters, and air interface signal quality parameters.

[0052] Compared with the prior art, the edge root cause analysis method and system based on semantic caching and rule engine according to embodiments of the present invention have the following advantages:

[0053] First, this invention organically integrates alarm aggregation, log correlation analysis, semantic caching, and root cause inference into a complete chain, all deployed locally on the small base station EU device. The system can independently complete root cause inference offline using an L0 layer Lua rule engine, without relying on cloud-based large-scale model computing power and network transmission. Compared to traditional cloud-based RCA solutions (end-to-end latency of several minutes, with complete unavailability due to network interruption), this invention controls the entire root cause analysis process to within 500ms in offline mode, completely solving the "disconnection" problem in edge scenarios when the network is unstable or interrupted, achieving true independent operation on the edge side.

[0054] Second, this invention constructs 12 standardized acquisition adapters (6 built-in standard adapters + 5 telecom equipment CUSTOM adapters + 1 service software reading adapter SW_COUNTER), achieving plug-and-play functionality through the dlopen dynamic loading mechanism, directly accessing the device's local hardware interface (I 2The system uses C-bus, RS485 serial port, memory-mapped register MMIO, and shared memory to acquire RF transceiver TX power / EVM / ACLR, power amplifier PA output power / temperature / VSWR, SFP optical module Tx / Rx optical power / bias current / temperature, CPRI / eCPRI link status / bit error rate (BER), antenna port VSWR / reflection power, air interface signal quality RSRP / SINR / CQI / RTWP / noise floor, and forwarding engine throughput / packet loss rate, among other telecom-specific metrics. A dual-channel acquisition coordination mechanism (AI real-time channel with a 5s cycle + general acquisition channel with a configurable cycle of 5s~300s) ensures complementary operation of the two channels in resource-constrained embedded environments without file read contention through a 2.5s phase offset and shared memory buffering. Compared to traditional solutions that rely solely on general IT metrics (CPU / memory / disk / network), this invention achieves full-stack data coverage at the edge, from general IT infrastructure to telecom-specific hardware subsystems and service quality, laying a complete data foundation for cross-subsystem joint root cause analysis.

[0055] Third, this invention integrates alarm aggregation, log structured analysis, and indicator anomaly detection into a unified root cause reasoning chain. The alarm manager achieves cross-type alarm association through a matrix of 12 association rules (association strength 0.55~0.95), and the three-level aggregation window (300s / 600s / 900s) converges progressively from the same device to cross devices. The alarm escalation engine implements progressive alarm level management, escalating to Major after three consecutive threshold exceedances and escalating to Critical if no confirmation is received within 30 minutes. The severity scoring model performs quantitative evaluation by comprehensively considering the base score, frequency factor, time decay, and topological impact. The log analyzer parses the raw logs in a structured manner and automatically associates them into root cause candidate evidence. The alarm storm three-level protection (L1 single device 100 messages / minute rate limiting, L2 global 200 messages / 60s storm detection triggering back pressure, L3 high water level 5000 / low water level 1000 queue water level protection) combined with bucket segment lock + read-write lock separation + atomic CAS three-level concurrency security strategy ensures stable system operation under alarm storm scenarios, core alarms are not lost and analysis links are not interrupted.

[0056] Fourth, the invention's unique four-layer hierarchical decision chain (L0-L3) effectively controls LLM API call volume while ensuring analytical accuracy: the L0 layer Lua rule engine (confidence 0.95, response <1ms) handles deterministic fault scenarios; the L1 layer Z-Score anomaly detection + linear regression trend prediction (confidence ≥0.80, response 1-10ms) handles anomalies with obvious statistical characteristics; the L2 layer semantic cache (confidence 0.90, response <2ms) reuses historical analysis results; and the L3 layer DeepSeek API (confidence 0.95, response 500-5000ms) is triggered only when the first three layers fail to provide a high-confidence root cause. Actual testing shows that this hierarchical strategy reduces LLM API call volume by approximately 55%, with a cache hit response time of <50ms, significantly reducing cloud API call costs and network bandwidth consumption while ensuring diagnostic accuracy.

[0057] Fifth, this invention establishes a multi-dimensional fault signature database and a cross-subsystem correlation matrix for fault scenarios specific to telecommunications access network equipment. The antenna feeder fault correlation matrix, through three-dimensional correlation analysis of VSWR + TX power + PA temperature, distinguishes between antenna feeder hardware faults (VSWR↑ + TX power↓ + PA temperature normal) and power amplifier overheat protection (VSWR normal + TX power↓ + PA temperature↑), reducing the misjudgment risk of approximately 20% in traditional solutions to approximately 5%. The fronthaul link fault correlation matrix, through CPRI BER + SFP... The three-dimensional correlation analysis of Rx power and RU heartbeat reduces the fault location granularity from the entire link to the interface module, fiber link / optical module, or RU device as a whole, shortening the average fault repair time by more than 40%. The coverage problem correlation matrix, through the three-dimensional correlation analysis of RSRP+SINR+RRC connection number (statistics from the L2 / L3 protocol stack on the BBU / DU side, aggregated by the EU side and included in the analysis), distinguishes coverage holes, capacity congestion, and equipment RF faults, improving the root cause location accuracy of coverage problems from less than 70% to more than 90%. The multi-dimensional fault signature library (antenna feeder fault signature: VSWR≥2.5 and PA reverse power≥10 and PA forward power≤40; optical module aging signature: SFP Rx power decreasing trend and linear regression slope β1<-0.05 and SFP bias current continuously increasing and SFP temperature≥70°C) compresses the response time of common faults to less than 10ms through weighted multi-dimensional feature distance matching.

[0058] Sixth, this invention specifically optimizes general semantic caching for operational scenarios. The comprehensive scoring model = similarity × timeliness weight × alarm level weight. The timeliness weight dynamically decays according to a preset curve as the cache is created (e.g., maintaining full weight within 24 hours, linearly decaying to 0.7 from 24 to 72 hours). The alarm level weight increases with severity (Warning=0.8, Major=1.0, Critical=1.2), ensuring that cache reuse results possess semantic relevance, timeliness, and importance. The eviction policy links LRU with the comprehensive scoring, prioritizing the eviction of cache entries that are both outdated and low-priority. Compared to the LRU or fixed TTL strategies of general semantic caching, this invention improves the cache hit rate by approximately 15-20 percentage points in operational scenarios, effectively avoiding the reliability risks of returning expired or irrelevant results. Attached Figure Description

[0059] Figure 1 This is a flowchart of the edge-side root cause analysis method based on semantic caching and rule engine of the present invention;

[0060] Figure 2 This is a schematic diagram of the system of the present invention;

[0061] Figure 3 This is a schematic diagram of the processing procedure of the method of the present invention;

[0062] Figure 4 This is a flowchart of the three-dimensional joint analysis of alarms, logs, and indicators in this invention;

[0063] Figure 5 This is a schematic diagram of the three-level protection structure for the alarm storm of this invention. Detailed Implementation

[0064] Embodiments of the present invention are described in detail below, examples of which are illustrated in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain the present invention, and should not be construed as limiting the present invention.

[0065] The following is for reference. Figures 1-5 The method for edge root cause analysis based on semantic caching and rule engine according to embodiments of the present invention includes the following steps:

[0066] S1. Collect operational status indicator data and log data from edge devices;

[0067] S2. Detect alarms on the collected indicator data, generate alarm events, and perform deduplication and aggregation on the alarm events to form alarm groups containing multi-dimensional indicator feature vectors.

[0068] S3. Perform correlation analysis between the alarm group and the log data in the corresponding time window to extract abnormal log records related to the alarm device;

[0069] S4 inputs the feature vector and associated logs of the alarm group into a four-layer hierarchical decision chain for root cause inference. The four-layer hierarchical decision chain includes:

[0070] L0 layer: Based on the rule engine, it performs fixed rule matching. When the alarm feature matches the preset rule, it directly outputs the root cause and the first confidence level.

[0071] L1 layer: If the L0 layer does not output a root cause higher than the first preset threshold, then inference is performed based on the statistical anomaly detection method, and the root cause and second confidence level are output.

[0072] L2 layer: If the L1 layer does not output a root cause higher than the second preset threshold, the semantic cache is queried. The semantic cache stores historical analysis results. The similarity between the current request and the cache entry is calculated, and a comprehensive score is made by combining the timeliness weight and the alarm level weight. When the comprehensive score exceeds the third preset threshold, the cache is hit, and the root cause and third confidence level of the cache are returned.

[0073] L3 layer: If the L2 layer fails to hit or the output confidence score is lower than the fourth preset threshold, the large language model is called to perform deep semantic reasoning and output the root cause and the fourth confidence score.

[0074] S5. Combine the confidence scores of each layer's output, calculate the final confidence score, select the root cause with the highest confidence score as the diagnostic result, and generate repair suggestions;

[0075] S6. Store the results of this analysis in the semantic cache, and record the input, output and judgment basis of each step of the four-level hierarchical decision chain to form a traceable reasoning path.

[0076] In some embodiments of the present invention, the comprehensive score calculation formula for semantic cache is: comprehensive score = similarity × timeliness weight × alarm level weight, wherein the timeliness weight decays over time, and the alarm level weight increases with the increase of alarm severity; the cache eviction policy combines LRU and comprehensive score, and entries with low comprehensive scores are evicted first.

[0077] Understandably, in edge-side root cause analysis scenarios, many faults exhibit repetitive or similar characteristics—it's common for the same device type and alarm type to repeatedly occur at different times. The semantic caching module leverages this characteristic to structurally store historical root cause analysis results. When a new analysis request arrives, it first attempts to reuse historical results through semantic similarity matching, thereby avoiding the repeated execution of the entire reasoning process and significantly reducing computational resource consumption and response latency.

[0078] Specifically, the similarity matching mechanism calculates the semantic similarity between the feature vector of the current analysis request and the feature vector of historical requests stored in the cache. When the similarity exceeds a preset threshold (e.g., 0.85), the system directly returns the cached historical analysis results without triggering subsequent rule engine matching, anomaly detection, or large model calls. Through this mechanism, the root cause analysis response time in recurring failure scenarios can be reduced from hundreds of milliseconds to less than 50 milliseconds, and the system throughput is significantly improved.

[0079] The timeliness-weighted mechanism addresses the issue of fault modes evolving over time in operational scenarios. The more recent the timestamp of a cached record, the higher its timeliness weight; as time progresses, the weight gradually decreases according to a preset decay curve. For example, cached records within the last 24 hours maintain full weight, the weight linearly decays to 0.7 between 24 and 72 hours, and the weight further decreases after 72 hours. This mechanism ensures that outdated or potentially invalid analysis results are not preferentially reused, improving the hit rate while guaranteeing the timeliness and accuracy of diagnostic results.

[0080] The alarm level weighting mechanism assigns differentiated trust levels to cached results based on the severity of the alarm. For Critical level alarms, the analysis results are typically more rigorously verified and have higher reference value, thus receiving a higher alarm level weight; while Warning level alarm results have relatively lower weight. This mechanism makes the system more inclined to reuse verified and reliable results in high-priority alarm scenarios, further improving the diagnostic accuracy of critical faults.

[0081] Regarding cache eviction strategies, when the cache space reaches its capacity limit, the system needs to remove some old entries to make room for new entries. This invention organically combines the traditional LRU strategy with a comprehensive scoring mechanism: the LRU strategy ensures that recently accessed hot data is retained, avoiding the mistaken eviction of frequently accessed cache entries; the comprehensive scoring mechanism evaluates the value of each cache entry from two dimensions: timeliness and alarm importance. During eviction, the system prioritizes eviction of entries with the lowest comprehensive score, i.e., those cache results that are both outdated and have low alarm levels. Compared to simple LRU or fixed TTL strategies, this composite eviction strategy can improve the cache hit rate by approximately 15 to 20 percentage points in operational scenarios, effectively extending the residence time of high-value cache entries.

[0082] Through the coordinated efforts of similarity matching, timeliness weighting, alarm level weighting, and LRU-linked eviction strategy, the semantic caching module significantly reduces the number of LLM API calls (approximately 55% reduction in actual measurements) while ensuring the reliability and timeliness of cached results, achieving an effective balance between response speed, cost control, and diagnostic accuracy.

[0083] In some embodiments of the present invention, the rule engine is a Lua script engine, the preset rules support runtime hot updates, and the rules are automatically adjudicated according to priority when there is a conflict; the statistical anomaly detection method includes Z-Score sliding window anomaly detection and linear regression trend analysis.

[0084] In some embodiments of the present invention, this method can be applied to fault diagnosis of telecommunications access network equipment, and the collected index data includes telecommunications-specific indicators. These telecommunications-specific indicators include at least: TX power, EVM, and ACLR of the radio frequency transceiver; PA output power, temperature, and VSWR of the power amplifier; Tx / Rx optical power, bias current, and temperature of the SFP optical module; CPRI / eCPRI link status and bit error rate (BER); VSWR and reflected power of the antenna port; RSRP, SINR, CQI, RTWP, and noise floor of the air interface signal; and throughput and packet loss rate of the forwarding engine.

[0085] To address the diverse data sources and interface protocols of telecommunications-specific metrics, this invention employs multiple acquisition adapters to collect data, covering all dimensions of data collection needs from the general IT layer to the telecommunications-specific hardware layer and then to the business software layer.

[0086] Specifically, regarding the acquisition adapter architecture:

[0087] 1. Six built-in standard adapters are used to collect common IT metrics, including CPU utilization, memory usage, Flash storage status, network throughput, device temperature, and system logs, providing a basic reference for system operation status for root cause analysis.

[0088] 2. Five types of telecom equipment CUSTOM adapters, which achieve plug-and-play functionality through the dlopen dynamic loading mechanism, each target different hardware interface protocols and data sources:

[0089] I 2 C-bus EEPROM read adapter: used to read device hardware configuration information and board-level identification parameters;

[0090] PMBus (Power Management Bus) power supply / amplifier monitoring adapter: used to collect power amplifier power supply voltage, current and power output parameters;

[0091] SFP Digital Diagnostic Monitoring (DDM) Adapter: Used to read digital diagnostic monitoring parameters of optical modules, including transmit optical power, receive optical power, bias current, module temperature and supply voltage;

[0092] RS485 Modbus power amplifier monitoring adapter: used to read operating status parameters from the power amplifier module via the Modbus protocol;

[0093] Memory-mapped hardware register (HW_REG) adapter: used to directly read real-time status parameters (TX power, EVM, ACLR and CPRI link BER, etc.) of core hardware such as RF transceivers and baseband processing units from hardware register addresses.

[0094] 3. One type of business software read adapter SW_COUNTER: Through a shared memory mechanism, it reads air interface signal quality indicators (RSRP, SINR, CQI, RTWP, noise floor) and forwarding engine statistical indicators (throughput, packet loss rate, latency, etc.) from the business software process, bridging the data gap between hardware acquisition and business perception.

[0095] Through the collaborative work of the above 12 adapters, the system achieves full-stack data collection from general IT infrastructure to telecommunications-specific hardware subsystems and then to business service quality, laying a complete data foundation for cross-dimensional root cause correlation analysis.

[0096] Furthermore, based on the aforementioned multi-adaptor architecture, this invention also configures a dual-channel acquisition coordination mechanism. The AI ​​real-time channel acquires core indicators such as VSWR, PA power, and temperature at a fixed short period (e.g., 5 seconds) for real-time anomaly detection and ReAct decision-making; the general acquisition channel acquires all telecommunications indicators at a configurable period (adjustable from 5 seconds to 300 seconds) for backend aggregation analysis. The two channels execute in staggered phase shifts (e.g., 2.5-second shifts) and reuse data through shared memory caching, thereby avoiding file read contention in resource-constrained embedded environments, reducing CPU overhead, and ensuring complementary operation of the two channels.

[0097] When the alarm aggregator detects telecom-specific alarms such as high VSWR, CPRI interruption, PA overheating, abnormal TX power, or abnormal SFP optical power, the system immediately retrieves full-dimensional data within the alarm time window as needed: HW_REG collects TX power / EVM / ACLR and CPRI link BER; PMBus collects PA output power / temperature / VSWR; SFP_DDM collects optical module Tx / Rx power / bias current / temperature; SW_COUNTER collects RSRP / SINR / CQI and RTWP / noise floor. All adapters are output using the DaqSample data structure, along with quality codes (GOOD / UNCERTAIN / BAD) to help the subsequent analysis engine distinguish between valid and suspicious data.

[0098] Understandably, by organically combining the aforementioned 12 standardized acquisition adapters, dual-channel acquisition coordination mechanism, and alarm-driven on-demand deep acquisition, this invention constructs a complete telecommunications-specific indicator acquisition system. This fundamentally solves the core pain point of missing data acquisition for telecommunications-specific hardware indicators (RF, power amplifier, antenna feeder, fronthaul optical module, and air interface signal) in existing solutions. This acquisition system ensures that when telecommunications-specific faults such as VSWR anomalies, CPRI link interruptions, and PA overheating occur, the system can instantly acquire full-dimensional hardware status data and service quality data. This provides accurate, real-time, and high-quality data input for the antenna feeder fault correlation matrix, fronthaul link fault correlation matrix, and coverage problem correlation matrix in the root cause analysis engine, thereby improving the root cause localization accuracy in telecommunications equipment-specific fault scenarios.

[0099] In some embodiments of the present invention, alarm aggregation and deduplication include: merging duplicate alarms of the same type and from the same device within a configurable time window; associating related alarms of different indicators on the same device into alarm groups using an association rule matrix, wherein each rule defines the source alarm type, target alarm type, association type, and association strength; and performing deduplication of the same type on the same device, cross-type association on the same device, and cross-device topology association sequentially using a three-level aggregation window.

[0100] Specifically, within a configurable time window, duplicate alarms of the same device and type are merged into a single alarm to reduce alarm storms and achieve alarm deduplication. Related alarms with different metrics on the same device are associated into alarm groups to form alarm contexts, thus achieving alarm aggregation. For example, a matrix of 12 association rules can be used (…). - Each rule defines the source alarm type, target alarm type, correlation type (causal / concurrency / derivative), and correlation strength (0.55~0.95). The three-level aggregation windows are: Level 1 300s (duplicate alarms of the same type on the same device), Level 2 600s (cross-type correlation on the same device), and Level 3 900s (cross-device topology correlation), progressively expanding the aggregation scope to achieve gradual alarm convergence from local to global over time. This avoids information loss due to premature aggregation and analysis delays caused by late aggregation.

[0101] Furthermore, the alarm manager also includes a built-in alarm escalation engine to monitor the duration and recurrence frequency of alarms. When the same alarm exceeds the threshold three times consecutively, it is automatically escalated from the Warning level to Major; when a Major-level alarm is not acknowledged within 30 minutes, it is further escalated to the Critical level. Through this progressive escalation mechanism, the system can guide operations and maintenance personnel to prioritize alarms that are continuously worsening or have not been addressed for a long time, preventing critical faults from being missed due to an overload of alarms, thereby improving the timeliness and relevance of operations and maintenance responses.

[0102] Meanwhile, the alarm manager uses a comprehensive severity scoring model to quantitatively evaluate each alarm. The calculation formula is: score = base + log2(count) × 5 + (age_min / 10) × 2 + (root_cause ? 15 :0), where base is the base score, count is the number of times the same type of alarm occurs within the window, age_min is the number of minutes the alarm has lasted, and root_cause is a Boolean value indicating whether the alarm is the root cause. This scoring model integrates multiple dimensions such as the inherent severity of the alarm, its frequency of occurrence, duration, and topology impact, making alarm prioritization more scientific and reasonable, and assisting operations personnel in quickly locating high-impact faults.

[0103] In addition, the alarm manager is also configured with a three-level alarm storm protection mechanism (T1-T3):

[0104] Level T1: Rate limiting is applied to alarms on a single device; alarms exceeding the preset rate limit are discarded or merged.

[0105] Level T2: Performs storm detection on global alarms and triggers back pressure mechanism when the number of global alarms exceeds a preset threshold;

[0106] Level T3: Water level protection is implemented for the back pressure queue. When the queue water level is higher than the high water level threshold, low-priority alarms are rejected from being enqueued. When the queue water level is lower than the low water level threshold, normal reception is restored.

[0107] Specifically, for alarm events reported by RU devices, the system first performs a T1-level single-device rate limiting judgment: if the number of alarm reports from the device exceeds the preset rate limiting value within a 1-minute time window, the alarms exceeding the limit are discarded or merged; otherwise, the alarms are queued normally and proceed to the next level of judgment. Next, it enters the T2-level global storm detection: the system counts the total number of global alarms within a 60-second sliding window. If it exceeds the preset storm threshold, the backpressure mechanism is triggered, actively reducing the alarm reception rate; if it does not exceed the threshold, the alarms are processed normally and queued. Finally, it performs a T3-level backpressure queue level protection: the system monitors the current depth of the backpressure queue in real time. If the queue level is higher than the high-level threshold, low-priority alarms are automatically rejected from queuing, and only high-priority alarms (Critical / Major level) are allowed to pass; if the queue level is lower than the low-level threshold, normal reception of all levels of alarms is restored. Through the above three-level progressive judgment, alarms that do not exceed the T2 global preset threshold and those that have resumed normal reception in T3 ultimately enter the alarm aggregation processing stage.

[0108] Understandably, through the aforementioned three-tiered protection mechanism—T1 single-device flow limiting, T2 global storm detection, and T3 backpressure queue level protection—this invention constructs a three-dimensional alarm storm defense system from single-point devices to the global system and then to queue buffering. These three levels advance progressively and cooperate synergistically, forming a complete closed-loop control system for alarm flow shaping and pressure adaptation. Level T1 intercepts sudden alarm surges at the single-device inlet, initially reducing the impact of the alarm storm at its source, effectively preventing abnormal alarm surges from a single device from interfering with alarm processing on other devices. Level T2 perceives the overall alarm status of the system globally; once a storm trend is detected, the backpressure mechanism is triggered, actively slowing down the alarm reception rate to avoid system overload. Level T3, as the last line of defense, ensures the system maintains core functionality under extreme storm scenarios through queue level protection, prioritizing the smooth operation of high-priority alarm processing pathways. The coordinated operation of the three-level mechanism ensures that the system can maintain stable operation even in extreme scenarios where the number of alarms surges by more than 10 times, the alarm loss rate is controlled within 1%, and the system CPU utilization is reduced by about 65% compared to the unprotected state.

[0109] The alarm manager also supports full lifecycle management of alarms, fully tracking every state change from alarm creation, deduplication, aggregation, escalation, confirmation, recovery to archiving, providing complete data support for post-event auditing and root cause analysis. In terms of concurrency security, the alarm manager employs a three-level locking strategy: bucket segmented locking to reduce lock contention, read-write lock separation to improve read concurrency, and atomic CAS operations to ensure lock-free updates of critical counters, thereby achieving high-concurrency alarm processing capabilities under the limited computing resources of embedded edge devices.

[0110] Furthermore, the alarm manager supports runtime hot updates of association rules, allowing dynamic adjustments to the association rule matrix without restarting the system. When rules conflict (e.g., multiple matching rules exist for a pair of alarm types), the system automatically adjudicates the conflict based on the priority order of association strength > association type > rule ID, ensuring a smooth and controllable rule change process and adapting to the actual needs of continuous iteration of operational knowledge.

[0111] By organically combining the above-mentioned alarm aggregation and deduplication, automatic escalation, severity scoring, storm protection, lifecycle tracking and hot update mechanisms, this invention achieves a comprehensive improvement in alarm management in terms of accuracy, real-time performance, robustness and maintainability, providing high-quality and low-redundancy alarm input for subsequent root cause analysis.

[0112] In some embodiments of the present invention, multidimensional telecommunications index correlation analysis may also be included, specifically including:

[0113] Antenna Fault Correlation: When VSWR alarm and TX power alarm are triggered simultaneously, the PA temperature index is automatically correlated. Through three-dimensional correlation analysis of VSWR, TX power and PA temperature, the antenna hardware fault and power amplifier overheat protection are distinguished.

[0114] Fronthaul link fault correlation: When a CPRI link interruption alarm is triggered, the CPRI bit error rate (BER), SFPRx optical power, and RU heartbeat status are automatically correlated. By analyzing the correlation of these three factors, the faults of the interface module, the fiber optic link, or the overall fault of the RU equipment can be located.

[0115] Coverage Issue Correlation: When an RSRP drop alarm is triggered, it automatically correlates SINR, RRC connection count, TX power, and VSWR metrics to distinguish between coverage holes, capacity congestion, and equipment RF faults.

[0116] Multidimensional fault signature matching: Maintain a fault signature library. Each fault signature is defined by the joint anomaly pattern of multiple telecommunications indicators. By performing weighted multidimensional feature distance matching between the multidimensional indicator feature vector of the current alarm group and the fault signature library, a list of candidate root causes and matching degree are output.

[0117] The fault signatures pre-set in the fault signature library may include:

[0118] Antenna feeder fault signature: VSWR ≥ 2.5 and PA reverse power ≥ 10 and PA forward power ≤ 40;

[0119] Aging signature of fronthaul optical module: SFP Rx power shows a decreasing trend and linear regression slope β1 < -0.05, SFP bias current continues to increase, and SFP temperature ≥ 70°C;

[0120] Power amplifier overheat protection signature: PA temperature ≥ 85°C and TX power drops ≥ 3dB from rated value and PA status register is abnormal;

[0121] Covering hole signatures: RSRP ≤ -95dBm and SINR ≤ 10dB and RRC connection count is within the normal range.

[0122] Specifically, regarding antenna feeder fault correlation, the root cause analysis engine automatically pulls PA temperature indicators from the acquisition adapter to construct a three-dimensional correlation analysis space of VSWR, TX power, and PA temperature for scenarios where VSWR alarms and TX power alarms are triggered concurrently. When VSWR rises (≥2.5) and TX power decreases (≤40% of rated value) while PA temperature is within the normal range (≤75°C), it is determined to be an antenna feeder hardware fault (such as loose antenna interface, damaged feeder, or connector oxidation). In this case, the root cause of the fault lies in the antenna feeder link itself, and the PA and power amplifier subsystem are operating normally. When VSWR is normal (<2.0) and TX power decreases while PA temperature rises abnormally (≥85°C), it is determined to be a transmit power backoff triggered by power amplifier overheat protection. Through this three-dimensional correlation analysis, the system can accurately distinguish two completely different fault root causes under similar alarm symptoms, effectively avoiding the misjudgments that are easily caused by traditional solutions that rely solely on a single VSWR indicator.

[0123] Furthermore, regarding fronthaul link fault correlation, when a CPRI / eCPRI link interruption alarm is triggered, the engine automatically correlates three dimensions—CPRI bit error rate (BER), SFP Rx optical power, and RU heartbeat status—for comprehensive fault localization. If the BER continues to rise (≥10⁻⁻⁶), the engine will detect the fault. 6 If the Rx optical power is normal (≥-14dBm), it indicates good physical connectivity of the optical fiber but deterioration of digital signal quality, which is identified as an interface module fault (such as a clock recovery circuit lockout or a serializer / deserializer SERDES malfunction); if the BER is normal (<10⁻ 9 If the Rx optical power is below the threshold (≤-20dBm), it indicates that the optical signal attenuation is too large during transmission, which is located as a fiber optic link failure or optical module aging (optical transmitter degradation leading to insufficient output optical power). If all three are abnormal and the RU heartbeat is lost, it indicates that the RU device has lost power or the main control board is faulty. This three-dimensional correlation analysis reduces the granularity of fronthaul link fault location from the entire link (hundreds of meters to several kilometers) to specific sub-modules, thus narrowing the scope of fault diagnosis for on-site maintenance personnel and effectively reducing the maintenance costs caused by ineffective site visits and blind replacement of spare parts.

[0124] Furthermore, regarding coverage issue correlation, when an RSRP drop alarm is triggered, the engine automatically correlates SINR, RRC connection count, TX power, and VSWR to construct a multi-dimensional analysis matrix. Specifically, if RSRP and SINR both drop while RRC connection count remains normal, it indicates that the signal strength and signal quality in the coverage area deteriorate simultaneously, but the number of users accessing the network does not change abruptly, which is identified as a coverage hole (such as obstruction by new buildings or changes in the propagation environment). If RSRP is normal while SINR drops and RRC connection count increases significantly, it indicates that the signal strength is sufficient, but the interference level increases with the increase in the number of users accessing the network, which is identified as increased interference caused by capacity congestion. Moreover, if TX power drops abnormally (≤40% of the rated value) or VSWR is abnormal (≥2.5), it is further identified as coverage contraction caused by equipment RF fault. In this case, the coverage problem is not caused by changes in the external environment but by the degradation of the equipment's own transmission performance. Through this hierarchical and progressive multidimensional correlation analysis, the system can distinguish the three major root causes of coverage problems (environmental changes, capacity bottlenecks, and equipment failures), and provide maintenance personnel with differentiated repair suggestions (adjusting antenna tilt angle / expansion scheme / replacing RF devices), thereby improving the accuracy of locating coverage problems.

[0125] For multi-dimensional fault signature matching, the engine maintains a scalable telecommunications equipment fault signature library. Each fault signature is defined by a joint anomaly pattern of multiple telecommunications indicators and its threshold range. For example, "antenna feeder fault signature" is defined as VSWR ≥ 2.5, PA reverse power ≥ 10W, and PA forward power ≤ 40W; "optical module aging signature" is defined as SFP Rx optical power ≤ -20dBm, SFP bias current ≥ 120% of rated value, and optical module temperature ≥ 75°C; "PA fault signature" is defined as PA output power ≤ 50% of rated value, PA temperature ≥ 85°C, and abnormal fluctuation of PA power supply current. The engine performs weighted multi-dimensional feature distance matching between the multi-dimensional indicator feature vector of the current alarm group and each fault signature in the signature library (different dimensions are assigned differentiated weights based on operation and maintenance experience; for example, indicators directly related to faults, such as VSWR and forward power, have higher weights than auxiliary indicators), outputs a candidate root cause list, and sorts them in descending order of matching degree. Root causes with a matching degree exceeding the threshold (e.g., 0.85) are directly adopted. This signature matching mechanism enables the identification of the root cause of common faults to be completed within 10ms after the rule inference results are output, without going through the complete LLM inference chain, which further accelerates the diagnostic response speed of high-frequency fault scenarios.

[0126] Understandably, through the organic synergy of the four mechanisms mentioned above—antenna feeder fault correlation, fronthaul link fault correlation, coverage problem correlation, and multi-dimensional fault signature matching—this invention, for the first time, achieves cross-dimensional joint root cause analysis capabilities for proprietary hardware subsystems of telecom access networks at the edge, filling a long-standing gap in the analysis capabilities of telecom-specific indicators in existing AIOps solutions. This mechanism fundamentally solves the inherent problem of the separation between alarms, logs, and hardware indicators in traditional operation and maintenance solutions. It deeply integrates alarm manifestations, log context, and multi-dimensional hardware status data such as RF / power amplifier / antenna feeder / optical module / air interface signals, enabling the system to possess intelligent diagnostic capabilities that penetrate from single-point alarm manifestations to the underlying physical root causes.

[0127] This invention mentions an edge-side root cause analysis system based on semantic caching and a rule engine, comprising:

[0128] The data acquisition module is used to collect operational status metrics and log data from edge devices;

[0129] The alarm manager is used to generate alarms based on collected metrics, deduplicate and aggregate alarms to form alarm groups;

[0130] Log analyzer is used to parse logs in a structured way, identify abnormal patterns, and associate abnormal logs related to alarms as root cause candidates;

[0131] The rules engine module is used to perform fixed rule matching and output the first inference result and confidence score;

[0132] The semantic caching module is used to store historical analysis results and perform hit judgments through similarity calculation, timeliness weighting, and alarm level weighting, and outputs the cached inference results and confidence scores.

[0133] The anomaly detection module is used to perform anomaly detection and trend analysis based on statistical methods, and outputs the second inference result and confidence level.

[0134] The large language model interface module is used to call external large language models for deep reasoning and output the third reasoning result and confidence score.

[0135] The decision chain control module is used to call the rule engine module, anomaly detection module, semantic cache module and large language model interface module in L0-L3 order, and calculate the final confidence score by combining the confidence scores output by each module. The result with the highest confidence score is selected as the diagnostic result and repair suggestions are output.

[0136] The traceability recording module is used to record the inputs, outputs, and judgment criteria of each step of the reasoning in the decision chain, forming a traceable reasoning path.

[0137] In some embodiments of the present invention, the system is deployed on the edge management device of the telecommunications access network equipment. The data acquisition module includes a variety of acquisition adapters for acquiring general IT indicators and telecommunications-specific indicators. The telecommunications-specific indicators include at least radio frequency transceiver parameters, power amplifier parameters, antenna feeder parameters, fronthaul optical module parameters, and air interface signal quality parameters.

[0138] In some embodiments of the present invention, the alarm manager is also configured to perform: merging duplicate alarms of the same device and type within a configurable time window; associating related alarms of different indicators on the same device into alarm groups using an association rule matrix; sequentially performing deduplication of the same type on the same device, cross-type association on the same device, and cross-device topology association using a three-level aggregation window; escalating the alarm level when the threshold is continuously exceeded or the timeout is not acknowledged; and calculating the alarm severity score according to a formula.

[0139] In some embodiments of the present invention, the alarm manager further includes a three-level alarm storm protection module: a T1 level single-device rate limiting module, used to discard or merge alarms that exceed a preset rate limiting value; a T2 level global storm detection module, used to trigger a back pressure mechanism when the global alarm quantity exceeds a preset threshold; and an L3 level back pressure queue level protection module, used to reject low-priority alarms from being queued when the queue level is higher than a high level threshold, and to restore normal reception when the queue level is lower than a low level threshold.

[0140] In some embodiments of the present invention, the system further includes a telecommunications multidimensional indicator correlation analysis module for performing: antenna feeder fault correlation, fronthaul link fault correlation, coverage problem correlation, and multidimensional fault signature matching.

[0141] Example 1: General Operation and Maintenance Scenario - Root Cause Analysis of CPU Overheating Fault

[0142] Application Scenario: A small cell intelligent operation and maintenance system where an EU (Edge Unit) device simultaneously manages 16 RU (Radio Unit) devices, deployed in a high-density indoor coverage scenario. The EU device runs the edge-side root cause analysis method and system based on semantic caching and rule engine described in this invention, independently completing the entire root cause analysis process offline. When an RU device reports a high CPU temperature alarm, the system automatically triggers root cause analysis.

[0143] System operation process

[0144] Step S1: Collect operational status metrics and log data from the edge device: The RU-5 device reports a CPU overheating alarm (Level: Major). Simultaneously, the system collects the device's general IT metrics via the built-in standard adapter: CPU temperature sensor reading is 89°C, and fan speed is 45% of its rated value; via I... 2The C-bus adapter acquires data from the onboard ambient temperature sensor, which shows 52°C; it also acquires the raw log data stream from RU-5 within the alarm time window.

[0145] Step S2: Generate alarms based on the collected indicator data, perform deduplication and aggregation on the alarms to form alarm groups containing multi-dimensional indicator feature vectors.

[0146] Step S21, Alarm Triggering and Deduplication: The alarm manager receives the CPU over-temperature alarm reported by RU-5 and records its timestamp, device ID, alarm type, and original level. Within a 300-second first-level aggregation window, a duplicate check is performed using the composite key of device ID=RU-5 and alarm type=CPU over-temperature. In this embodiment, since this alarm appears for the first time within the window, there is no need to merge it; a new alarm record is created, the occurrence count counter is initialized to count=1, and the first occurrence time is recorded.

[0147] Step S22, Alarm Aggregation: Enter the 600-second secondary aggregation window and check if there are other types of related alarms on the RU-5 device. In this embodiment, there are no other related alarms, and the alarm group currently only includes the CPU over-temperature alarm.

[0148] Step S23, Alarm Storm Protection Detection: The system synchronously performs a three-level alarm storm protection detection:

[0149] T1 Level Single Device Rate Limiting: Check the alarm reporting volume of RU-5 within a 1-minute window. In this embodiment, there is only this alarm, which is far below the rate limiting threshold of 100 alarms / minute, so normal access is allowed.

[0150] T2 Level Global Storm Detection: The total number of alarms in the system within a 60-second sliding window is 15 / 60 seconds, which is far below the storm trigger threshold of 200 / 60 seconds, and the back pressure mechanism is not activated;

[0151] T3 level queue water level protection: Check the current depth of the back pressure queue. It is 200 entries, which is lower than the low water level threshold of 1000 entries. The system is in normal receiving state, and the alarm is normal for queuing.

[0152] Step S24, Initial Severity Assessment: The alarm manager calculates the severity score for this alarm. Base score = 60 (Major level), frequency factor = 0 (first occurrence, count = 1), time decay factor = 0.2 (lasted for 10 minutes), topology root cause impact = 0.3 (affects 2 lower-level RUs). Overall score = 60 × (1+0) × (1-0.2) × (1+0.3) = 62.4 points, tentatively set as Major level.

[0153] Step S3: Perform correlation analysis between the alarm group and the log data within the corresponding time window to extract abnormal log records related to the alarm device;

[0154] Step S31, Alarm-Log Linkage Trigger: The alarm aggregator sends the RU-5 alarm group context (Device ID=RU-5, Time Window=5 minutes before and after the alarm, Alarm Type=CPU Temperature Too High) to the log analyzer.

[0155] Step S32, Log Structured Parsing: The log analyzer queries the raw log data stream of RU-5 within the target time window, extracts key fields (timestamp, log level, event type, error code, message body) through the structured parsing engine, and transforms the unstructured raw log into structured records.

[0156] Step S33, Abnormal Pattern Identification: The log analyzer identifies abnormal log patterns through rule matching and statistical features, discovering two key log records:

[0157] Log ①: [ERROR] CPU frequency throttled due to thermal limit (coretemp: 89°C), event type determined as CPU thermal throttling;

[0158] Log ②: [WARN] Ambient temperature sensor reading: 52°C (threshold: 45°C), event type determined as ambient temperature exceeding threshold.

[0159] Step S34, Alarm-Log Correlation: The two log entries mentioned above are strongly correlated with the current CPU overheating alarm. The log analyzer automatically correlates them as root cause candidate evidence and appends them to the alarm group context. Simultaneously, the alarm aggregator pulls relevant metric data for RU-5 within the alarm time window via the acquisition adapter (PMBus adapter acquires PA temperature 42°C, I...). 2 The C adapter collected an ambient temperature of 52°C, the built-in adapter collected a CPU temperature of 89°C and a fan speed of 45% as the basis for inference.

[0160] Step S4: Input the feature vector and associated logs of the alarm group into the four-layer hierarchical decision chain for root cause reasoning;

[0161] The system checks the current network connectivity and the reachability of the cloud-based large language model API. In this embodiment, the system is online, but given the clear fault scenario and the existence of complete matching rules in the rule engine, the system prioritizes local inference.

[0162] Step S41, L0 Layer (Rule Engine Inference): The system inputs the alarm group feature vector (device type = RU-5, fault type = CPU overheating, CPU temperature = 89°C, ambient temperature = 52°C, fan speed = 45%) into the Lua rule engine. The rule base in the rule engine contains judgment rules for general faults of telecommunications equipment. Among them, rule R-THERMAL-007 is: IF CPU temperature ≥ 85°C AND ambient temperature ≥ 50°C AND fan speed ≤ 60% of rated value THEN root cause = heat dissipation system failure (insufficient heat dissipation), confidence level = 0.95. In the current scenario, all three conditions are met, the rule match is successful, and the L0 layer directly outputs the root cause judgment as "heat dissipation system failure (insufficient heat dissipation)", with a first confidence level of 0.95 and a response time of <1ms. Since the L0 layer has output a root cause higher than the first preset threshold (0.85), the system skips the L1, L2, and L3 layers and does not trigger semantic cache queries and large language model calls.

[0163] Step S42, Alarm Escalation Judgment: The alarm manager continuously monitors the alarm status during the inference process. In this embodiment, if the CPU over-temperature alarm is not confirmed by the operations and maintenance personnel within 30 minutes, the timeout escalation mechanism is triggered, and the alarm level is upgraded from Major to Critical. The base score in the severity rating is adjusted accordingly to 80 points, and this escalation event is recorded in the alarm lifecycle tracking chain.

[0164] Step S5: Combine the confidence scores of each layer's output, calculate the final confidence score, select the root cause with the highest confidence score as the diagnostic result, and generate repair suggestions;

[0165] Step S51, Confidence Score: In this embodiment, only the L0 layer outputs the result (confidence score 0.95), and the overall confidence score is 0.95. This root cause is selected as the final diagnostic result.

[0166] Step S52, Final Assessment of Alarm Severity: The alarm manager updates the overall severity score for this alarm. Base score = 60, frequency factor = 0.5 (occurred 3 times within 5 minutes, including the cumulative count after deduplication and merging), time decay factor = 0.2 (lasted for 10 minutes), topology root cause impact = 0.3. Overall score = 60 × (1+0.5) × (1-0.2) × (1+0.3) = 93.6 points. This score further verifies the rationality of escalating the alarm to the Critical level.

[0167] Step S53, Repair suggestion generation: The system automatically generates repair suggestions based on the root cause type: Check whether the cooling fan of the RU-5 equipment is stuck or damaged, clean the dust accumulated in the vents, confirm that the air inlet / outlet of the equipment installation environment is not blocked, and replace the fan assembly or adjust the equipment installation position if necessary.

[0168] Step S6: Store the analysis results in the semantic cache and record the input, output, and judgment criteria for each step of the four-layer hierarchical decision chain to form a traceable reasoning path.

[0169] Step S61, Semantic Cache Storage: Store the feature vector (alarm group type combination, device type, fault indicator dimension, associated log mode) of this analysis request and its corresponding root cause analysis results (diagnostic conclusion, confidence level 0.95, repair suggestions) into the semantic cache, and mark the cache timestamp (for timeliness weighted calculation) and alarm level weighted score (Critical level corresponds to weight 1.2) for reuse in subsequent similar fault scenarios.

[0170] Step S62, Decision Chain Traceability Recording: The decision chain module decomposes this root cause analysis process into the following discrete steps and records them one by one, forming a complete decision traceability chain:

[0171] Step D1, Alarm Filtering: The input is the RU-5 CPU over-temperature alarm group output by the alarm manager, and the output is the filtered target alarms (Major level). The reasoning is based on the composite key matching of device ID and alarm type.

[0172] Step D2, Log Association: The input is the device ID and time window of the target alarm, and the output is the associated log records (CPU thermal throttling log, ambient temperature exceeding threshold log). The reasoning is based on the timestamp matching and abnormal pattern recognition of the log analyzer.

[0173] Step D3, Indicator Correlation: The input is the target device ID and time window, and the output is multi-dimensional indicator data (CPU temperature 89°C / ambient temperature 52°C / fan speed 45%). The reasoning is based on the on-demand retrieval of the acquisition adapter and the output of the DaqSample data structure.

[0174] Step D4, L0 rule matching: The input is three-dimensional data of alarm + log + metric, and the output is the root cause conclusion "heating system failure (insufficient heat dissipation)". The reasoning is based on the Lua rule engine matching a predefined rule (rule ID: R-THERMAL-007) with a confidence level of 0.95.

[0175] Step D5, Confidence Assessment: The input is the confidence level of L0 layer 0.95, and the output is the overall confidence level 0.95. The reasoning is based on the fact that the output of a single layer is the final confidence level.

[0176] Step S7: Output the root cause analysis report

[0177] The system integrates the results of root cause reasoning with the decision chain records to generate a complete root cause analysis report, including:

[0178] 1) Root cause diagnosis conclusion: The RU-5 equipment heat dissipation system failed (insufficient heat dissipation).

[0179] 2) Final confidence score: 0.95 (L0 rule engine output);

[0180] 3) Corresponding evidence: CPU temperature 89°C (exceeding the threshold of 85°C), ambient temperature 52°C (exceeding the threshold of 45°C), fan speed is 45% of the rated value (below the normal value of 60%).

[0181] 4) Decision tracing chain: The above D1 to D5 are a complete reasoning path of 5 steps;

[0182] 5) Repair suggestions: Check if the cooling fan of the RU-5 equipment is stuck or damaged, clean the dust accumulated in the vents, and ensure that the air inlet / outlet of the equipment installation environment is not blocked. If necessary, replace the fan assembly or adjust the equipment installation position.

[0183] Under the configuration of the above embodiments, the system exhibits the following technical effects:

[0184] The L0 layer rule engine completes root cause determination within <1ms, and the entire root cause analysis process takes <500ms, far superior to the several minutes of latency of traditional cloud-based RCA solutions. In this embodiment, the system completes inference entirely locally at the edge, without calling any cloud-based large language model APIs, verifying the independent operation capability of this invention in offline mode. In this embodiment, because the L0 layer directly hits the target, the L3 layer LLM call is not triggered, demonstrating the effective control of the four-layer hierarchical decision chain over the LLM API call volume. The L0 rules are accurately matched, with a diagnostic confidence of 0.95, and the root cause is accurately located. From alarm screening, log association, indicator association to rule matching and confidence assessment, every step is documented, and operations personnel can fully verify the rationality of the inference path. The L1-L3 three-level hierarchical protection mechanism ensures the stability of the alarm queuing process, and the system can still operate stably even in scenarios with a sudden increase in alarm traffic. After the analysis results are stored in the cache, subsequent identical or similar fault scenarios can directly hit the cache, and the response time can be further compressed to <50ms, with a continuous reduction in the LLM call volume.

[0185] Example 2: Telecommunication Equipment Dedicated Fault Scenario

[0186] Application Scenario: A small cell intelligent operation and maintenance system, where the EU device simultaneously manages 16 pRRU devices deployed in a high-density indoor coverage scenario. The RU-3 device simultaneously reports an antenna port VSWR too high alarm (VSWR=3.2) and a TX power drop alarm (TX power drops 4dB from the rated value). The system automatically triggers a full-link root cause analysis process for telecommunications equipment-specific faults, verifying the invention's multi-dimensional indicator correlation analysis capabilities in telecommunications-specific fault scenarios.

[0187] System operation process

[0188] Step S1: Collect operational status metrics and log data from edge devices:

[0189] Within 5 minutes, the RU-3 device reported two alarms: a high VSWR (VSWR=3.2, level: Major) and an abnormal TX power (TX Power=36dBm, rated value 40dBm, level: Major). Simultaneously, the system collected comprehensive operational data from the RU-3 within the alarm time window using 12 different acquisition adapters: the HW_REG adapter read VSWR=3.2, PA forward power=35W, PA reverse power=15W at the antenna port; the PMBus adapter read PA temperature=68°C (normal range ≤75°C), and the power amplifier supply current was normal; the SW_COUNTER adapter read the terminal's average RSRP from shared memory: -102dBm (normal value -85dBm, a drop of 17dB), SINR=6dB (normal value 15dB, a drop of 9dB), and CQI=7 (normal value 12, a drop of 5); the SFP_DDM adapter read all optical module indicators, all within the normal range, ruling out a possible fronthaul link failure. Simultaneously, the raw log data stream of RU-3 within the alarm time window is collected for log correlation analysis.

[0190] Step S2: Generate alarms based on the collected indicator data, perform deduplication and aggregation on the alarms, and form alarm groups containing multi-dimensional indicator feature vectors.

[0191] Step S21, Alarm Deduplication and Aggregation: The alarm manager receives two alarms and checks for duplicate alarms of the same type within a 300-second primary aggregation window. If both are confirmed to be first occurrences, alarm records are created and occurrence counters are initialized. Then, a 600-second secondary aggregation window is entered. Using device ID=RU-3 as the composite key, a VSWR high alarm and a TX power abnormality alarm are detected concurrently within the window. The system calls the association rule matrix and matches rule R-ANT-003 (source alarm type=VSWR high, target alarm type=TX power decrease, association type=causal association, association strength=0.92). It is determined that the two alarms have a causal relationship (abnormally high VSWR causes the amplifier to protectively back off power), and they are associated with the same alarm group, forming a complete alarm context.

[0192] Step S22, Alarm Storm Protection Detection: During the alarm queuing process, the system performs a three-level alarm storm protection detection. Level L1 single-device rate limiting check: RU-3 reports 2 alarms within a 1-minute window, far below the threshold of 100 alarms / minute; Level L2 global storm detection: The global alarm count is 12 alarms / 60 seconds, below the threshold of 200 alarms / 60 seconds; Level L3 queue level check: The current backpressure queue depth is 150, below the low-level threshold of 1000. Alarms are then allowed to proceed to the next processing step.

[0193] Step S23, Initial Assessment of Alarm Severity: The alarm manager calculates the severity scores for the two alarms separately. VSWR Too High Alarm: Base score = 60 (Major level), Frequency Factor = 0 (first occurrence), Time Decay Factor = 0.1 (lasting for 5 minutes), Topology Root Cause Impact = 0.3 (affecting lower-level RU services). TX Power Anomaly Alarm: Base score = 60, Frequency Factor = 0, Time Decay Factor = 0.1, Topology Root Cause Impact = 0.3. Both alarms are initially classified as Major level; the overall severity will be further improved after forming an alarm group.

[0194] Step S3: Perform correlation analysis between the alarm group and the log data within the corresponding time window to extract abnormal log records related to the alarm device.

[0195] Step S31, Alarm-Log Linkage Trigger: The alarm aggregator sends the RU-3 alarm group context (Device ID=RU-3, Time Window=5 minutes before and after the alarm, Alarm Type=VSWR too high + TX power drop) to the log analyzer.

[0196] Step S32, Log Structured Parsing and Anomaly Identification: The log analyzer queries the raw log data stream of RU-3 within the target time window and extracts key fields through the structured parsing engine. In this embodiment, a key log record is found: "[ERROR] PA output power back-off due to high VSWR detected (VSWR=3.2, P_out=36dBm)", and the event type is determined to be PA protective rollback. This log has a strong correlation with the current high VSWR and TX power reduction alarm. The log analyzer automatically associates it as root cause candidate evidence, confirming the causal relationship between the VSWR anomaly and the TX power reduction.

[0197] Step S33, In-depth collection of multi-dimensional telecom indicators: The root cause analysis engine detects that the alarm group involves the radio frequency and antenna feeder subsystems, and immediately triggers the full-dimensional telecom indicator retrieval process. It obtains the full amount of indicator data of RU-3 through 12 acquisition adapters within the alarm time window. All adapters output in a unified DaqSample data structure, and the quality code is GOOD to ensure data credibility.

[0198] Step S4: Input the feature vector and associated logs of the alarm group into the four-layer hierarchical decision chain for root cause inference.

[0199] Step S41, Telecom Multidimensional Fault Signature Matching (Pre-analysis): Before entering the four-layer decision chain, the engine first extracts the multidimensional feature vector of the current alarm group {VSWR=3.2, PA forward power=35W, PA reverse power=15W, PA temperature=68°C, TX power=36dBm, RSRP=-102dBm, SINR=6dB}, and performs weighted multidimensional feature distance matching with the fault signature database.

[0200] Antenna fault signature (VSWR ≥ 2.5 AND PA reverse power ≥ 10W AND PA forward power ≤ 40W): Fully matched, matching degree = 0.95;

[0201] Amplifier overheat protection signature (PA temperature ≥ 85°C AND TX power drop ≥ 3dB from rated value): PA temperature = 68°C, not met, matching degree = 0.12, excluded;

[0202] Fronthaul optical module aging signature (SFP Rx optical power ≤ -20dBm AND bias current ≥ 120% of rated value): All indicators are normal, but mismatched. The engine initially judges it to be an antenna feeder hardware failure, ruling out the possibility of power amplifier overheat protection and fronthaul link failure, providing a priori guidance for decision chain inference.

[0203] Step S42, L0 layer Lua rule engine inference: The rule engine performs lightweight Lua rule matching. Rule R-ANT-001 is defined as IF VSWR>3.0 THEN Root cause = Antenna system fault (impedance mismatch), confidence level = 0.95, current VSWR = 3.2>3.0, rule hit, output preliminary diagnostic conclusion, response time <1ms.

[0204] Step S43, L1 Layer Z-Score Trend Detection: The system retrieves historical time-series data of the VSWR at the RU-3 antenna port over the past 60 sampling periods (60 minutes, 60-second sampling period) and calculates the Z-Score anomaly score. The current VSWR = 3.2 has a historical mean of 1.8 and a standard deviation of 0.4. Z-Score = (3.2 - 1.8) / 0.4 = 3.5 (|Z| > 3.0, significantly anomaly). Further linear regression analysis of the historical VSWR time series yields a slope β1 = +0.012 / period (positive value, continuous upward trend), indicating that the VSWR has been continuously deteriorating over the past 60 minutes, with non-sudden transient fluctuations. The trend detection confidence level is 0.85.

[0205] Step S44, L2 Layer Semantic Cache Query: The system sends the current alarm group feature vector to the semantic cache module for similarity matching. The cache shows that RU-8 experienced a similar alarm combination of "VSWR increase + TX power decrease" 7 days ago, with the historical root cause diagnosed as "antenna feeder connector water ingress corrosion". The semantic similarity between the current request and this historical record is 0.88, the timeliness weight is 0.78 (the cache was generated 7 days ago, and the weight decreases according to the decay curve), and the alarm level weight is 1.0 (both are Major level). The overall score = 0.88 × 0.78 × 1.0 = 0.686, which is lower than the preset hit threshold of 0.85. The cache is not hit, and the system continues with subsequent inference.

[0206] Step S45, L3 Layer DeepSeek API Enhanced Analysis: Due to the L2 layer cache miss and the network status being online, the system sends the multi-dimensional indicator feature vector and complete alarm context (alarm group correlation, timing information, and associated log records) to the DeepSeek large language model API for enhanced analysis. The model's comprehensive output diagnostic conclusion is: "Antenna port impedance mismatch is inferred to be caused by loose feeder connectors or water ingress corrosion, leading to an abnormal increase in VSWR. Increased reflected power triggers PA protective power back-off (TX power decreases by 4dB), which in turn leads to a 17dB decrease in RSRP and a 9dB deterioration in SINR. Antenna feeder system failure is the only root cause that can simultaneously explain the linkage of the three indicators," with a confidence level of 0.93.

[0207] Step S5: Combine the confidence scores of each layer's output, calculate the final confidence score, select the root cause with the highest confidence score as the diagnostic result, and generate repair suggestions;

[0208] Step S51, Cross-Dimensional Confidence Synthesis: The engine collects the inference confidence scores for each of the above dimensions and calculates the final confidence score using a weighted fusion model. Fault signature matching score: 0.95 (weight 0.25), L0 rule confidence score: 0.95 (weight 0.20), L1 trend confidence score: 0.85 (weight 0.15), L3 LLM confidence score: 0.93 (weight 0.30), Bayesian posterior probability P(Antenna feeder fault | High VSWR, Low TX power) = 0.91 (weight 0.10). Final confidence score C = 0.95×0.25 + 0.95×0.20 + 0.85×0.15 + 0.93×0.30 + 0.91×0.10 = 0.93, outputting the root cause conclusion "Antenna feeder system fault (loose antenna feeder connector or water corrosion)," with a comprehensive confidence score of 0.93.

[0209] Step S52, Repair Recommendation Generation: The system automatically generates repair recommendations based on the root cause type: Check if the feeder connector at RU-3 antenna port 1 is loose, use an antenna analyzer to test the feeder VSWR, check if the waterproof seal of the feeder connector is intact, and replace the feeder or connector if necessary; it is recommended to manually reduce the RU-3 transmit power to 30dBm before repair to protect the PA device from damage caused by reflected power.

[0210] Step S6: Store the analysis results in the semantic cache and record the input, output, and judgment criteria for each step of the four-layer hierarchical decision chain to form a traceable reasoning path:

[0211] Step S61, Semantic Cache Storage: Store the feature vector of this analysis request (alarm group type combination = VSWR too high + TX power drop, device type = pRRU, fault indicator dimension = VSWR / PA forward power / PA reverse power / RSRP / SINR) and its corresponding root cause analysis results (antenna system fault, confidence level 0.93, repair suggestions) into the semantic cache, mark the cache timestamp and alarm level weighted score (Major level corresponds to weight 1.0), for reuse in subsequent similar fault scenarios.

[0212] Step S62, Decision Chain Traceability Recording: The decision chain module decomposes this root cause analysis process into the following discrete steps and records them one by one, forming a complete decision traceability chain:

[0213] 1) Alarm filtering: The input is the VSWR high alarm (VSWR=3.2) and TX power abnormal alarm (36dBm) reported by RU-3 within a 5-minute window. The output is the aggregated alarm group. The reasoning is based on the association rule R-ANT-003 (causal association, strength 0.92).

[0214] 2) Log Correlation: The input is the RU-3 device ID and time window, and the output is the PA protective rollback log record. The reasoning is based on the log analyzer's abnormal pattern recognition.

[0215] 3) Multidimensional indicator acquisition: The input is the device ID and time window of RU-3 in the alarm group, and the output is VSWR=3.2, PA forward power=35W, PA reverse power=15W, PA temperature=68°C, RSRP=-102dBm, SINR=6dB. The reasoning is based on the on-demand retrieval of 12 types of acquisition adapters.

[0216] 4) Fault signature matching: The input is the multi-dimensional feature vector of the alarm group, and the output is the antenna and feeder fault signature hit (match degree 0.95). The reasoning is based on the weighted multi-dimensional feature distance matching of the signature library.

[0217] 5) L0 rule reasoning: The input is VSWR=3.2, and the output is antenna system failure (confidence level 0.95). The reasoning is based on Lua rule R-ANT-001.

[0218] 6) L1 trend detection: The input is 60 periods of historical time series data from VSWR, and the output is Z-Score=3.5, slope β1=+0.012 / period (confidence level 0.85). The reasoning is based on Z-Score anomaly detection + linear regression.

[0219] 7) L2 cache query: The input is the feature vector of the current alarm group, and the output is a miss (overall score 0.686 < threshold 0.85). The reasoning is based on the semantic similarity + timeliness weighted comprehensive score.

[0220] 8) L3 LLM Inference: The input is a multi-dimensional feature vector + alarm context, and the output is antenna port impedance mismatch (confidence level 0.93). The inference is based on the comprehensive analysis of the DeepSeek large language model.

[0221] 9) Confidence synthesis: The input is a five-dimensional confidence source (signature 0.95 / rule 0.95 / trend 0.85 / LLM 0.93 / Bayes 0.91), and the output is the final confidence score of 0.93. The reasoning is based on a weighted fusion model.

[0222] Step S7, Root Cause Analysis Report Output:

[0223] The system integrates the results of root cause reasoning with the decision chain records to generate a complete root cause analysis report, including:

[0224] Root cause diagnosis conclusion: Antenna feeder system failure (loose antenna feeder connector or water ingress corrosion).

[0225] Overall confidence score: 0.93;

[0226] Related evidence: VSWR=3.2 (exceeding threshold 2.5), PA reverse power=15W (exceeding threshold 10W), PA forward power=35W (below threshold 40W), PA temperature=68°C (normal, excluding power amplifier overheating), RSRP decreased by 17dB, SINR decreased by 9dB, and related log PA protective rollback records.

[0227] Decision tracing chain: The above R1 to R9 are a complete reasoning path of 9 steps, and each step is verifiable;

[0228] Repair recommendations: Check if the feeder connector at RU-3 antenna port 1 is loose; use an antenna analyzer to test the feeder VSWR; check if the waterproof seal of the feeder connector is intact; replace the feeder or connector if necessary; it is recommended to manually reduce the RU-3 transmit power to 30dBm before repair to protect the PA device from damage caused by reflected power.

[0229] In this embodiment, the system exhibits the following technical effects:

[0230] 1. The L0 layer Lua rule engine completes the initial judgment of antenna and feeder faults within 1ms. The total time of the four-layer decision chain hierarchical reasoning process is controlled within 430ms, which is far better than the latency index of several minutes of traditional cloud RCA solutions, and fully meets the rigid requirements of low latency in edge operation and maintenance scenarios.

[0231] 2. The system achieves a comprehensive confidence level of 0.93 through a five-dimensional weighted fusion of fault signature matching (0.95), L0 rules (0.95), L1 trends (0.85), L3 LLM (0.93), and Bayesian posterior probability (0.91). Crucially, through cross-dimensional joint analysis of telecom-specific indicators such as VSWR, TX power, PA temperature, RSRP, and SINR, the system accurately distinguishes between antenna hardware faults and power amplifier overheat protection. Traditional solutions, when VSWR and TX power alarms occur concurrently, rely solely on a single VSWR threshold, easily misjudging power amplifier overheat protection as an antenna fault or vice versa, with a misjudgment risk of approximately 20%. In contrast, the three-dimensional correlation analysis (VSWR + TX power + PA temperature) combined with over-the-air verification of RSRP / SINR reduces the misjudgment risk to approximately 5%, increasing the root cause localization accuracy to over 95%.

[0232] 3. Stable alarm storm protection: The L1-L3 three-level protection mechanism provides full protection during the alarm queuing process. In this embodiment, alarms are released normally, the queue depth is stable below the low water level, and the system does not experience performance bottlenecks due to alarm processing.

[0233] 4. Explainable and Traceable Process: The system fully records the 9-step reasoning process, from alarm screening, log association, multi-dimensional indicator collection, and fault signature matching, to the execution results of each layer of the L0-L3 four-layer decision chain, and then to the weighted fusion details of confidence synthesis. The inputs, outputs, and reasoning basis of each step are all verifiable. Operations personnel can backtrack step by step to verify the rationality of the analysis conclusions, significantly improving the explainability and auditability that traditional black-box AI solutions lack.

[0234] 5. Continuous Optimization and Knowledge Reuse: After the analysis results of this embodiment are stored in the semantic cache, when other RU devices subsequently experience similar alarms with the combination of "increased VSWR + decreased TX power," the L2 cache hit will reduce the analysis latency to less than 50ms, further reducing the number of LLM API calls and forming a positive feedback loop of knowledge reuse. The system continuously accumulates diagnostic experience over time, leading to continuous improvement in operational efficiency.

[0235] Although embodiments of the invention have been shown and described, those skilled in the art will understand that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the claims and their equivalents.

Claims

1. An edge-side root cause analysis method based on semantic caching and rule engine, characterized in that, Includes the following steps: S1. Collect operational status indicator data and log data from edge devices; S2. Detect alarms on the collected indicator data, generate alarm events, and perform deduplication and aggregation on the alarm events to form alarm groups containing multi-dimensional indicator feature vectors. S3. Perform correlation analysis between the alarm group and the log data in the corresponding time window to extract abnormal log records related to the alarm device; S4. Input the feature vector and associated logs of the alarm group into a four-layer hierarchical decision chain for root cause inference. The four-layer hierarchical decision chain includes: L0 layer: Based on the rule engine, it performs fixed rule matching. When the alarm feature matches the preset rule, it directly outputs the root cause and the first confidence level. L1 layer: If the L0 layer does not output a root cause higher than the first preset threshold, then inference is performed based on the statistical anomaly detection method, and the root cause and second confidence level are output. L2 layer: If the L1 layer does not output a root cause higher than the second preset threshold, the semantic cache is queried. The semantic cache stores historical analysis results. The similarity between the current request and the cache entry is calculated, and a comprehensive score is made by combining the timeliness weight and the alarm level weight. When the comprehensive score exceeds the third preset threshold, the cache is hit, and the root cause and third confidence level of the cache are returned. L3 layer: If the L2 layer fails to hit or the output confidence score is lower than the fourth preset threshold, the large language model is called to perform deep semantic reasoning and output the root cause and the fourth confidence score. S5. Combine the confidence scores of the outputs from each layer, calculate the final confidence score, select the root cause with the highest confidence score as the diagnostic result, and generate repair suggestions; S6. Store the results of this analysis in the semantic cache, and record the input, output and judgment basis of each step of the reasoning in the four-layer hierarchical decision chain to form a traceable reasoning path.

2. The edge root cause analysis method based on semantic caching and rule engine according to claim 1, characterized in that, The comprehensive score calculation formula for the semantic cache is: Comprehensive score = similarity × timeliness weight × alarm level weight, wherein the timeliness weight decays over time, and the alarm level weight increases with the severity of the alarm; the cache eviction policy combines LRU and comprehensive score, and entries with low comprehensive scores are evicted first.

3. The edge-side root cause analysis method based on semantic caching and rule engine according to claim 1, characterized in that, The rule engine is a Lua script engine, and the pre-defined rules support runtime hot updates. When rules conflict, they are automatically adjudicated according to priority. The statistical anomaly detection methods include Z-Score sliding window anomaly detection and linear regression trend analysis.

4. The edge-side root cause analysis method based on semantic caching and rule engine according to claim 1, characterized in that, The method is applied to fault diagnosis of telecommunications access network equipment, and the collected index data includes telecommunications-specific indicators.

5. The edge-side root cause analysis method based on semantic caching and rule engine according to claim 4, characterized in that, The telecom-specific metrics are collected through multiple acquisition adapters, including: six built-in standard adapters for collecting general IT metrics; and five telecom equipment CUSTOM adapters dynamically loaded via dlopen to directly collect telecom-specific metrics from the device's local hardware interface. These five CUSTOM adapters include I... 2 The system includes a C-bus EEPROM read adapter, a PMBus power / amplifier monitoring adapter, an SFP digital diagnostic monitoring DDM adapter, an RS485 Modbus power amplifier monitoring adapter, and a memory-mapped hardware register HW_REG adapter; as well as a service software read adapter SW_COUNTER, which collects air interface signal quality and forwarding engine statistics from service software through shared memory. The acquisition process adopts a dual-channel acquisition coordination mechanism: the AI ​​real-time channel collects core indicators at a fixed period, while the general acquisition channel collects full telecommunications indicators at a configurable period. The two channels achieve complementary operation through phase offset and shared memory buffering.

6. The edge-side root cause analysis method based on semantic caching and rule engine according to claim 4, characterized in that, The alarm aggregation and deduplication include: merging duplicate alarms of the same type and from the same device within a configurable time window; using an association rule matrix to associate related alarms of different indicators on the same device into alarm groups, with each rule defining the source alarm type, target alarm type, association type, and association strength; and using a three-level aggregation window to sequentially perform deduplication of the same type on the same device, cross-type association on the same device, and cross-device topology association.

7. The edge-side root cause analysis method based on semantic caching and rule engine according to claim 4, characterized in that, It also includes multi-dimensional correlation analysis of telecommunications indicators, specifically including: Antenna Fault Correlation: When VSWR alarm and TX power alarm are triggered simultaneously, the PA temperature index is automatically correlated. Through three-dimensional correlation analysis of VSWR, TX power and PA temperature, the antenna hardware fault and power amplifier overheat protection are distinguished. Fronthaul link fault correlation: When a CPRI link interruption alarm is triggered, the CPRI bit error rate (BER), SFP Rx optical power, and RU heartbeat status are automatically correlated. By analyzing the correlation of these three factors, the faults of the interface module, fiber optic link, or RU equipment as a whole can be located. Coverage Issue Correlation: When an RSRP drop alarm is triggered, it automatically correlates SINR, RRC connection count, TX power, and VSWR metrics to distinguish between coverage holes, capacity congestion, and equipment RF faults. Multidimensional fault signature matching: Maintain a fault signature library. Each fault signature is defined by the joint anomaly pattern of multiple telecommunications indicators. By performing weighted multidimensional feature distance matching between the multidimensional indicator feature vector of the current alarm group and the fault signature library, a list of candidate root causes and matching degree are output.

8. The edge-side root cause analysis method based on semantic caching and rule engine according to claim 4, characterized in that, It also includes a three-tiered protection system for storm alerts: Level T1: Rate limiting is applied to alarms on a single device; alarms exceeding the preset rate limit are discarded or merged. Level T2: Performs storm detection on global alarms and triggers back pressure mechanism when the number of global alarms exceeds a preset threshold; Level T3: Water level protection is implemented for the back pressure queue. When the queue water level is higher than the high water level threshold, low-priority alarms are rejected from being enqueued. When the queue water level is lower than the low water level threshold, normal reception is restored.

9. An edge-side root cause analysis system based on semantic caching and a rule engine, characterized in that, include: The data acquisition module is used to collect operational status metrics and log data from edge devices; The alarm manager is used to generate alarms based on collected metrics, deduplicate and aggregate alarms to form alarm groups; Log analyzer is used to parse logs in a structured way, identify abnormal patterns, and associate abnormal logs related to alarms as root cause candidates; The rules engine module is used to perform fixed rule matching and output the first inference result and confidence score; The semantic caching module is used to store historical analysis results and perform hit judgments through similarity calculation, timeliness weighting, and alarm level weighting, and outputs the cached inference results and confidence scores. The anomaly detection module is used to perform anomaly detection and trend analysis based on statistical methods, and outputs the second inference result and confidence level. The large language model interface module is used to call external large language models for deep reasoning and output the third reasoning result and confidence score. The decision chain control module is used to call the rule engine module, anomaly detection module, semantic cache module and large language model interface module in L0-L3 order, calculate the final confidence score by combining the confidence scores output by each module, select the result with the highest confidence score as the diagnostic result, and output repair suggestions. The traceability recording module is used to record the inputs, outputs, and judgment criteria of each step of the reasoning in the decision chain, forming a traceable reasoning path.

10. The edge-side root cause analysis system based on semantic caching and rule engine according to claim 9, characterized in that, The system is deployed on the edge management device of the telecommunications access network equipment. The data acquisition module includes a variety of acquisition adapters for collecting general IT indicators and telecommunications-specific indicators. The telecommunications-specific indicators include at least RF transceiver parameters, power amplifier parameters, antenna feeder parameters, fronthaul optical module parameters, and air interface signal quality parameters.

Images