Incident correlation based on semantic similarity

Abstract

The present disclosure proposes a method, apparatus and computer program products for incident correlation. A current incident vector of a current incident may be calculated. A historical incident vector set corresponding to a historical incident set may be obtained. A similar incident set that are similar to the current incident may be searched from the historical incident set according to the current incident vector and the historical incident vector set. A correlation criteria in natural language may be received. A prompt may be created based on the current incident, the similar incident set, and the correlation criteria. A correlation result for the current incident may be generated based on the prompt through a large language model. The present disclosure also proposes an incident correlation system. The incident correlation system may comprise an incident search engine, a correlation decision engine and a correlation operation engine.

Description

INCIDENT CORRELATION BASED ON SEMANTIC SIMILARITYBACKGROUND

[0001] Nowadays, people may use terminal devices such as desktop computers, tablets, smart phones, etc., to access and use various services through the Internet. Herein, a service refers to an application or a function that relies on computer technology, network technology, etc. The service includes, e.g., cloud computing service, video sendee, search service, conference service, etc. A service is operated and managed by a service provider. In order to provide a reliable service, the service provider will continuously monitor various indicators during the operation of the service, to discover and solve issues in the service in time.SUMMARY

[0002] This Summary is provided to introduce a selection of concepts that are further described below in the Detailed Description. It is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter.

[0003] Embodiments of the present disclosure propose a method, apparatus and computer program products for incident correlation. A current incident vector of a current incident may be calculated. A historical incident vector set corresponding to a historical incident set may be obtained. A similar incident set that are similar to the current incident may be searched from the historical incident set according to the current incident vector and the historical incident vector set. A correlation criteria in natural language may be received. A prompt may be created based on the current incident, the similar incident set, and the correlation criteria. A correlation result for the current incident may be generated based on the prompt through a large language model, the correlation result indicating that the current incident is correlated with at least one similar incident in the similar incident set. The embodiments of the present disclosure also propose an incident correlation system. The incident correlation system may comprise an incident search engine, a correlation decision engine and a correlation operation engine.

[0004] It should be noted that the above one or more aspects comprise the features hereinafter fully described and particularly pointed out in the claims. The following description and the drawings set forth in detail certain illustrative features of the one or more aspects. These features are only indicative of the various ways in which the principles of various aspects may be employed, and this disclosure is intended to include all such aspects and their equivalents.BRIEF DESCRIPTION OF THE DRAWINGS

[0005] The disclosed aspects will hereinafter be described in connection with the appended drawings that are provided to illustrate and not to limit the disclosed aspects.

[0006] FIG. 1 illustrates an exemplary process for incident correlation according to an embodiment of the present disclosure.

[0007] FIG. 2 illustrates an exemplary process for searching, from a historical incident set, a similar incident set that are similar to a current incident according to an embodiment of the present disclosure.

[0008] FIG. 3 illustrates another exemplary process for searching, from a historical incident set, a similar incident set that are similar to a current incident according to an embodiment of the present disclosure.

[0009] FIG. 4 illustrates an exemplary process for generating a correlation result for a current incident according to an embodiment of the present disclosure.

[0010] FIG. 5 illustrates an exemplary process for verifying a correlation result according to an embodiment of the present disclosure.

[0011] FIG. 6 is a flowchart of an exemplary method for incident correlation according to an embodiment of the present disclosure.

[0012] FIG. 7 illustrates an exemplary incident correlation system according to an embodiment of the present disclosure.

[0013] FIG. 8 illustrates an exemplary apparatus for incident correlation according to an embodiment of the present disclosure.

[0014] FIG. 9 illustrates another exemplary apparatus for incident correlation according to an embodiment of the present disclosure.DETAILED DESCRIPTION

[0015] The present disclosure will now be discussed with reference to several example implementations. It is to be understood that these implementations are discussed only for enabling those skilled in the art to better understand and thus implement the embodiments of the present disclosure, rather than suggesting any limitations on the scope of the present disclosure.

[0016] Time-series data generated during the operation of a service may be monitored. Herein, time-series data refers to a data sequence recorded in chronological order, and data points in the data sequence reflect the state or extent of a specific phenomenon, indicator, thing, etc., changing over time. When a software, a hardware, etc., used to run the sendee fails, exception data points may appear in the corresponding time-series data. When the number and / or value of exception data points in the time-series data reaches a predetermined threshold, an alert indicating the exception situation may be automatically generated and notified to relevant technician via email, text message, phone call, etc. Herein, an alert produced due to faults of software, hardware, etc., during the operation of a service is referred to as an incident. Specific incident information contained in the incident depends on a pre-established incident generation rule. Accordingly,incidents caused by different faults include different incident information, but generally speaking, each incident may include, e.g., title, content, one or more attribute values, etc. The content may include text or graphics describing the incident, screenshots containing exception data points, etc. The attribute values may be values of pre-specified attribute fields. The attribute fields may include, e.g.. an error type, an identifier of a monitor monitoring the time-series data, etc. A technician may handle an incident, e.g., analyzing the incident, locating the cause of the incident, and taking actions to resolve the incident. Herein, a technician that handle incidents may be referred to as a user. A large number of incidents may be produced during the operation of a service. If each incident is handled one by one, it will take up significant human and machine resources, and the overall incident processing efficiency will be low, which will make it difficult to resolve faults that affect the operation of the service in time.

[0017] A newly produced incident that has not yet been handled may be similar to an incident that has been handled or is currently being handled, e.g., having the same root cause, indicating the same issue, etc. Herein, a newly produced incident that has not yet been handled is referred to as a current incident, and an incident that has been handled or is currently being handled is referred to as a historical incident. Embodiments of the present disclosure propose to determine whether a current incident may be correlated with at least one historical incident in a set of historical incidents based on a pre-established correlation criteria. The correlation criteria is in natural language. Herein, natural language refers to the language that a human being uses to communicate with each other. The natural language is in contrast to computer languages, such as source code languages, object code languages, computer scripting languages, etc., but it should be appreciated that there may be some overlap between natural language and computer language. The correlation criteria may specify a condition for the correlation of two incidents, e.g., having the same root cause, having the same exception, indicating the same issue, being resolved in the same way, etc. Alternatively or additionally, the correlation criteria may specify' which incident information should be checked and / or which incident information should be excluded when generating a correlation result. If it is determined that the current incident may be correlated with at least one historical incident, the current incident may be automatically correlated with the historical incident. While the current incident is automatically correlated with this historical incident, a severity level of the current incident may be downgraded, and a notification indicating the current incident is suppressed from being sent. The technical effect of this approach is to reduce the number of incidents notified to users, enabling users to focus on handling incidents with high severity levels. When the historical incident correlated with the current incident is resolved, the current incident may also be resolved simultaneously, thereby improving the overall incident processing efficiency and speeding up the resolution of faults that affect the operation of the service. Alternatively, if itis determined that the current incident may be correlated with at least one historical incident, a suggestion that correlates the current incident with the historical incident may be generated. The suggestion may include a reason for the current incident being correlated with the historical incident. The suggestion may be provided to a user. The technical effect of this method is to inform the user that the current incident may be correlated with a historical incident and the reason for the current incident being correlated with the historical incident, and the user therefore may decide whether to correlate the current incident with the historical incident.

[0018] When the current incident is received, a similar incident set similar to the current incident may be searched from a historical incident set through semantic similarity matching, or through both time window filtering and semantic similarity matching. The time window filtering intends to identify, from the historical incident set, an incident whose occurrence time is close to the occurrence time of the current incident. The semantic similarity matching intends to search an incident that is semantically similar to the current incident from the historical incident set. An incident whose occurrence time is close to the occurrence time of the current incident and / or that is semantically similar to the current incident is an incident that is more likely to be correlated with the current incident, therefore, the similar incident set may be used as a candidate incident set that are potentially correlated with the current incident. A prompt may be created based on the current incident, the similar incident set, and the correlation criteria. Subsequently, a correlation result for the current incident may be generated based on the prompt through a Large Language Model (LLM). Herein, a large language model refers to a deep learning model that is trained with a large amount of training data and can understand the meaning of natural language, generate natural language texts, or perform other natural language tasks. It should be appreciated that large language models include multi-modal models that can perform processing tasks for multiple modalities including natural language. The correlation result may indicate whether the current incident is correlated with at least one similar incident in the similar incident set. The correlation result may be in natural language. The large language model may use its semantic understanding ability, logical reasoning ability, big data support ability, language expression ability, etc., to semantically match the current incident with each similar incident in the similar incident set, to determine whether the current incident and the similar incident meet the correlation criteria. If the large language model determines that the current incident and at least one similar incident in the similar incident set meet the correlation criteria, a correlation result indicating that the current incident is correlated with at least one similar incident in the similar incident set may be generated. In this case, preferably, the correlation result may include a reason for the current incident being correlated with the similar incident. If the large language model determines that the current incident and all similar incidents in the similar incident set do not meet the correlation criteria, acorrelation result indicating that the current incident is not correlated with any similar incident in the similar incident set may be generated.

[0019] In the process described above, firstly, the similar incident set similar to the current incident are searched from the historical incident set through semantic similarity matching, or through both time window filtering and semantic similarity matching. Subsequently, the current incident is semantically matched with each similar incident in the similar incident set, to determine whether the current incident and the similar incident meet the correlation criteria. Based on this, incident correlation according to the embodiments of the present disclosure may be referred to as incident correlation based on semantic similarity.

[0020] Before generating the correlation result for the cunent incident through the large language model, firstly, the similar incident set similar to the current incident are searched from the historical incident set through semantic similarity7matching, or through both time window filtering and semantic similarity matching, and only the searched similar incident set are provided to the large language model. The technical effect of this approach is to reduce the number of historical incidents provided to the large language model, and ensure that the historical incidents provided to the large language model are incidents that are more likely to be correlated with the current incident, thereby improving the efficiency of the large language model in generating the correlation result and improving the accuracy of the correlation result. An accurate correlation result can accurately indicate whether the current incident may be correlated with a historical incident. If correlated, the current incident can be correlated with the historical incident, a severity level of the current incident may be dow ngraded, and a notification indicating the current incident may be suppressed from being sent. If the correlation result is wrong, it will cause the severity7level of the current incident that should not be correlated with the historical incident to be downgraded, and since the user does not receive a notification indicating the current incident, the current incident cannot be resolved in time, which will cause the associated fault to persist.

[0021] Providing the correlation criteria in natural language to the large language model can determine whether the current incident may be correlated with a historical incident at a semantic level. Additionally, the correlation criteria in natural language is flexible and can be universally applied to various incidents and scenarios, and is easy to be understood and customized by users. The technical effect of this approach is to improve the correlation rate of incidents, reduce the number of notifications sent to users, while ensuring the accuracy of the correlation result.

[0022] In order to further improve the accuracy of the correlation result, the embodiments of the present disclosure also propose that when creating the prompt, in addition to considering the current incident, the similar incident set and the correlation criteria, a user’s feedback on a historical correlation result previously generated by the large language model is also considered.The user may be the user handling the current incident or another user. The feedback may include positive feedback and / or negative feedback. The user's positive feedback on the correlation result may indicate that the user considers the correlation result to be correct. The user's negative feedback on the correlation result may indicate that the user considers the correlation result to be wrong. The prompt is the input used by the large language model to generate the correlation result. The technical effect of additionally considering user feedback on the historical correlation result when creating the prompt is to enable the large language model to leam from the feedback what can be learned and what needs to be improved when it generates correlation results in the past, thereby improving its accuracy when generating the correlation result for the current incident.

[0023] A generative language model such as a large language model sometimes produce a meaningless or untrustworthy output, a problem referred to as hallucination problem. The embodiments of the present disclosure propose to verify the correctness of the correlation result generated by the large language model through the large language model. For example, when the correlation result generated by the large language model indicate that the current incident is correlated with at least one historical incident, the correlation result and incident information of the current incident and the historical incident may be input to the large language model. The large language model may determine whether the correlation result is tenable through performing logical reasoning. If the correlation result is not tenable, the correlation result is considered to be wrong, i.e., the current incident should not be correlated with the historical incident. In this case, no correlation action for the current incident will be performed. The technical effect of this approach is to avoid performing wrong correlation actions and ensure that the current incident is only correlated with a historical incident that can indeed be correlated.

[0024] Various embodiments of the present disclosure will hereinafter be described in detail in connection with the appended drawings.

[0025] FIG. 1 illustrates an exemplary process 100 for incident correlation according to an embodiment of the present disclosure. The process 100 may be performed through an incident correlation system 110 according to an embodiment of the present disclosure.

[0026] A current incident 102 may be obtained. The current incident 102 may be a newly produced incident that has not yet been handled. Preferably, the current incident 102 may be an incident with a high severity level, that is, a severe incident. The current incident 102 may have current incident information. Herein, incident information of a current incident is referred to as current incident information. The cunent incident information may include at least one of title, content, and attribute values of the current incident 102. The content may include text or graphics describing the current incident, screenshots containing exception data points, etc. The attribute values may be values of pre-specified attribute fields. The attribute fields may include, e.g., anerror type, a monitor identifier, etc.

[0027] A historical incident set 104 may include a plurality of historical incidents that have been handled or are currently being handled. Each historical incident in the historical incident set 104 may have historical incident information. Herein, incident information of a historical incident is referred to as historical incident information. The historical incident information may include at least one of title, content, attribute values, and processing result of the historical incident. The processing result of the historical incident may include a processing history of the incident, e.g., the identified cause of the incident, how the incident was resolved, etc.

[0028] The incident correlation system 110 may include an incident search engine 120. The incident search engine 120 may search a similar incident set 122 that are similar to the current incident 102 from the historical incident set 104. It should be appreciated that the similar incident in the similar incident set 122 is a historical incident. The similar incident set 122 may be searched through a plurality of implementations.

[0029] In an implementation, the similar incident set 122 may be searched through semantic similarity matching. Semantic similarity matching intends to search an incident that is semantically similar to the current incident from the historical incident set. For example, a current incident vector of the current incident 102 may be calculated. Herein, a vector of a current incident is referred to as a current incident vector. A historical incident vector set corresponding to the historical incident set 104 may be obtained. Herein, a vector of a historical incident is referred to as a historical incident vector. Subsequently, a similar incident set 122 that are similar to the current incident 102 may be searched from the historical incident set 104 according to the current incident vector and the historical incident vector set. For example, the similar incident set 122 may be searched through performing semantic similarity matching on the current incident vector and the historical incident vector set. An exemplary process for searching the similar incident set through semantic similarity matching will be explained later in conjunction with FIG. 2.

[0030] In another implementation, the similar incident set 122 may be searched through both time window filtering and semantic similarity matching. The time window filtering intends to identity', from the historical incident set, an incident whose occurrence time is close to the occurrence time of the current incident. For example, a current incident vector of the current incident 102 may be calculated. A historical incident vector set corresponding to the historical incident set 104 may be obtained. A historical incident subset whose occurrence time is close to the occurrence time of the current incident may be identified from the historical incident set 104, and a historical incident vector subset corresponding to the historical incident subset may be extracted from the historical incident vector set. Subsequently, the similar incident set 122 that are similar to the current incident 102 may be searched from the historical incident set 104 throughperforming semantic similarity matching on the current incident vector and the historical incident vector subset. An exemplary process for searching the similar incident set through both time window filtering and semantic similarity matching will be explained later in conjunction with FIG. 3.

[0031] The incident correlation system 110 may further comprise a correlation decision engine 130. The correlation decision engine 130 may receive a correlation criteria 124 in natural language. The correlation criteria 124 may specify a condition for the correlation of two incidents, e.g., having the same root cause, having the same exception, indicating the same issue, being resolved in the same way, etc. It should be appreciated that the condition described above are merely exemplary, and any other condition may also be used to evaluate whether two incidents are correlated. Alternatively or additionally, the correlation criteria 124 may specify which incident information should be checked and / or which incident information should be excluded when generating the correlation result. As an example, the correlation criteria 124 may specify’ that exception data points and exception messages for each incident should be traversed when generating the correlation result. As another example, the correlation criteria 124 may specify' that a source address that reported the incident should be excluded when generating the correlation result. The correlation criteria 124 may be a default correlation criteria provided by the incident correlation system 110, or a customized correlation criteria provided by a user. The customized correlation criteria may be included in configuration information of the user. The correlation decision engine 130 may generate a correlation result 132 for the current incident 102 based on the current incident 102, the similar incident set 122, and the correlation criteria 124. For example, the correlation result 132 may be generated through a large language model. The correlation result 132 may indicate whether the current incident 102 is correlated with at least one similar incident in the similar incident set 122. In the case where the correlation result 132 indicates that the current incident 102 may be correlated with at least one similar incident in the similar incident set 122, preferably, the correlation result 132 may include a reason for the current incident being correlated with the similar incident. An exemplary process for generating the correlation result for the current incident will be described later in conjunction with FIG. 4. The correlation result 132 may be provided to the user, so that the user can clearly know which historical incident that the current incident may be correlated with and the reason for the current incident being correlated with the historical incident.

[0032] In the case where the correlation result 132 indicates that the current incident 102 is not correlated with any similar incident in the similar incident set 122, the current incident 102 may be handled according to the usual process, e.g., keeping a severity level of the current incident 102 unchanged, sending a notification indicating the current incident 102, etc.

[0033] In the case where the correlation result 132 indicates that the current incident 102 may be correlated with at least one similar incident in the similar incident set 122, the correlation result 132 may be provided to a correlation operation engine 140 in the incident correlation system 110. The correlation operation engine 140 may perform a correlation action 142 for the current incident 102 according to the correlation result 132 and an operation configuration 134. The correlation action 142 may include: e.g., automatically correlating the current incident 102 with the at least one similar incident, defining the at least one similar incident as a parent incident of the current incident 102, downgrading a severity level of the current incident 102, suppressing sending a notification indicating the current incident 102. generating a suggestion to correlate the current incident 102 with the at least one similar incident, etc. The operation configuration 134 may be included in the configuration information of the user. The operation configuration 134 may indicate correlation actions that the correlation operation engine 140 should perform upon receiving the correlation results 132.

[0034] As an example, when the operation configuration 134 indicates that automatic performing of correlation operation on the current incident is allowed, the correlation operation engine 140 may automatically correlate the current incident 102 with a similar incident included in the correlation result 132. Additionally , the correlation operation engine 140 may define the similar incident as a parent incident of the current incident 102, that is, the current incident 102 may be a child incident of the similar incident. The technical effect of this operation is that when the historical incident correlated with the current incident is resolved, the current incident can also be resolved simultaneously, thereby improving the overall incident processing efficiency and accelerating the speed of resolving faults that affect the operation of the service. Furthermore, the correlation operation engine 140 may downgrade a severity level of the current incident 102 and / or suppress sending a notification indicating the current incident 102. The technical effect of this operation is to reduce the number of incidents notified to users, enabling users to focus on handling incidents with high severity levels.

[0035] As another example, when the operation configuration 134 indicates that automatic performing of correlation operation on the current incident is not allowed, the correlation operation engine 140 may generate a suggestion to correlate the current incident 102 with a similar incident included in the correlation result 132. The suggestion may include a reason for the current incident 102 being correlated with the similar incident. The suggestion may be provided to a user. The technical effect of this method is to inform the user that the current incident may be correlated with a historical incident and the reason for the current incident being correlated with the historical incident, and the user therefore may decide whether to correlate the current incident with the historical incident.

[0036] A generative language model such as a large language model sometimes produce a meaningless or untrustworthy output, a problem referred to as hallucination problem. Preferably, when the correlation result 132 indicates that the current incident 102 is correlated with at least one historical incident, the correlation operation engine 140 may first verify the correctness of the correlation result 132 through a large language model, and only when the correlation result 132 is correct, the correlation action 142 for the current incident 102 is performed according to the correlation result 132 and the operation configuration 134. An exemplary process for verifying the correlation result will be described later in conjunction with FIG. 5.

[0037] It should be appreciated that the process for incident correlation described above in conjunction with FIG. 1 is merely exemplary. Depending on actual application requirements, the steps in the process for incident correlation may be replaced or modified in any manner, and the process may comprise more or fewer steps. Additionally, it should be appreciated that the incident correlation system 110 illustrated in FIG. 1 is merely one example of the incident correlation system. Depending on actual application requirements, the incident correlation system may have any other structure and may comprise more or fewer modules. Furthermore, each module in the incident correlation system 110 may perform operations other than the operations described above.

[0038] FIG. 2 illustrates an exemplary' process 200 for searching, from a historical incident set. a similar incident set that are similar to a current incident according to an embodiment of the present disclosure. The process 200 may correspond to an implementation of the operation performed by the incident search engine 120 in FIG. 1. In the process 200, the similar incident set may be searched through semantic similarity matching.

[0039] A current incident 202 and a historical incident set 204 may correspond to the current incident 102 and the historical incident set 104 in FIG. 1, respectively.

[0040] A current incident vector of the current incident 202 may be calculated. Original current incident information 206 of the current incident 202 may be obtained first. The original current incident information 206 may include at least one of title, content, and attribute values of the current incident 202. The original current incident information 206 may be provided to a preprocessing module 210. The preprocessing module 210 may splice various incident information into a continuous string, thereby generating preprocessed current incident information 212. When the incident information contains non-text information such as pictures, the preprocessing module 210 may convert the non-text information into text information through techniques such as encoding. The preprocessed current incident information 212 may be provided to an encoder 220. The encoder 220 may be a machine learning model capable of generating a vector or an embedding based on text input. The encoder 220 may generate a current incident vector 222 of the current incident 202 based on the preprocessed current incident information 212.The length of the input to encoder 220 may be limited. Preferably, the preprocessing module 210 may delete, from the original current incident information 206, information that is not valuable for understanding the semantics of the current incident 202, e.g., format information, sty le information, etc. The original current incident information and the preprocessed current incident information may be collectively referred to as current incident information. It should be appreciated that both the original current incident information and the preprocessed current incident information essentially include title, content, attribute values, etc., of the current incident.

[0041] A historical incident vector set 208 corresponding to the historical incident set 204 may be obtained. The historical incident vector set 208 may be obtained from a database. The database is, e.g., a database included in the incident correlation system, or a database accessible to the incident correlation system. Each historical incident vector in the historical incident vector set 208 may correspond to a historical incident in the historical incident set 204. The historical incident vector may be previously generated through the technique similar to that used to generate the cunent incident vector 222 and stored in the database.

[0042] A similar incident set 232 that are similar to the current incident 202 may be searched from the historical incident set 204 according to the current incident vector 222 and the historical incident vector set 208. For example, the similar incident set 122 may be searched through performing semantic similarity matching on the current incident vector 222 and the historical incident vector set 208 through the similarity matching module 230. The similarity matching module 230 may employ a technology such as Nearest Neighbor Search to search several historical incident vectors that are closest to the current incident vector 222 from the historical incident vector set 208, thereby determining several historical incidents that are most semantically similar to the current incident 202. These several historical incidents may be combined into the similar incident set 232.

[0043] FIG. 3 illustrates another exemplary process 300 for searching, from a historical incident set, a similar incident set that are similar to a current incident according to an embodiment of the present disclosure. The process 300 may correspond to an implementation of the operation performed by the incident search engine 120 in FIG. 1. In the process 300, the similar incident set may be searched through both time window filtering and semantic similarity matching.

[0044] A current incident 302 and a historical incident set 304 may correspond to the current incident 102 and the historical incident set 104 in FIG. 1, respectively.

[0045] A current incident vector 322 of the current incident 302 may be calculated. The process of generating the current incident vector 322 may be similar to the process of generating the current incident vector 222 described in conjunction with FIG. 2. Original current incident information 306 of the current incident 302 may be obtained first. The original current incidentinformation 306 may include at least one of title, content, and attribute values of the current incident 302. The original current incident information 306 may be provided to a preprocessing module 310. The preprocessing module 310 may splice various incident information into a continuous string, thereby generating preprocessed current incident information 312. When the incident information contains non-text information such as pictures, the preprocessing module 310 may convert the non-text information into text information through techniques such as encoding. The preprocessed current incident information 312 may be provided to an encoder 320. The encoder 320 may generate a current incident vector 322 of the current incident 302 based on the preprocessed current incident information 312. The length of the input to encoder 320 may be limited. Preferably, the preprocessing module 310 may delete, from the original current incident information 306, information that is not valuable for understanding the semantics of the current incident 302, e g., format information, style information, etc.

[0046] A historical incident subset 332 whose occurrence time is close to the occurrence time of the current incident 302 may be identified from the historical incident set 304 through a time window filtering module 330. For example, historical incidents that occur within a predetermined time interval from the occurrence time of the current incident 302 may be identified from the historical incident set 304, and the identified historical incidents may be combined into the historical incident subset 332. A historical incident vector subset 334 corresponding to the historical incident subset 332 may be extracted from a historical incident vector set corresponding to the historical incident set 304. A similar incident set 342 that are similar to the current incident 302 may be searched from the historical incident subset 332 according to the current incident vector 322 and the historical incident vector subset 334. For example, the similar incident set 342 may be searched through performing semantic similarity matching on the current incident vector 322 and the historical incident vector subset 334 through a similarity matching module 340. The similarity matching module 340 may employ a technology such as Nearest Neighbor Search to search several historical incident vectors that are closest to the current incident vector 322 from the historical incident vector subset 334, thereby determining several historical incidents that are most semantically similar to the current incident 302. These several historical incidents may be combined into the similar incident set 342.

[0047] In the process 200 or the process 300, the similar incident set 232 or the similar incident set 342 may be provided to a large language model as a candidate incident set with which the current incident is potentially correlated. The technical effect of providing only the similar incident set that are similar to the current incident searched from the historical incident set, instead of the historical incident set, to the large language model, is to reduce the number of historical incidents provided to the large language model, and ensure that the historical incidents providedto the large language model are incidents that are more likely to be correlated with the current incident, thereby improving the efficiency of the large language model in generating a correlation result and improving the accuracy of a correlation result.

[0048] The historical incident subset whose occurrence time is close to the occurrence time of the current incident is first identified from the historical incident set through the time window filtering, then incidents that are semantically similar to the current incident may be searched from the historical incident subset through the semantic similarity matching, which is able to exclude, from the historical incident set, historical incidents whose occurrence time is far away from the current time. The likelihood of such an incident being similar to the current incident is low. The technical effect of this approach is to reduce the number of historical incidents provided to the similarity matching module and ensure that the historical incidents provided to the similarity matching module are incidents that are more likely to be similar to the current incident, thereby improving the search efficiency and quality of the similarity matching module.

[0049] It should be appreciated that the process for searching, from the historical incident set, the similar incident set that are similar to the current incident described above in conjunction with FIG. 2 to FIG. 3 is merely exemplary. Depending on actual application requirements, the steps in the process for searching, from the historical incident set. the similar incident set that are similar to the current incident may be replaced or modified in any manner, and the process may comprise more or fewer steps. Additionally, the specific orders or hierarchies of the steps in the process 200 and the process 300 are merely exemplar}', and the process for searching the similar incident set may be performed in an order different from the described order.

[0050] FIG. 4 illustrates an exemplary process 400 for generating a correlation result for a current incident according to an embodiment of the present disclosure. The process 400 may correspond to the operation performed by the correlation decision engine 130 in FIG. 1. In the process 400, a prompt 412 may be created based at least on a current incident 402, a similar incident set 404, and a correlation criteria 406 through a prompt creator 410. A correlation result 422 for the current incident 402 may be generated based on the prompt 412 through a large language model 420.

[0051] The current incident 402 may correspond to the current incident 102 in FIG. 1.

[0052] The similar incident set 404 may be a similar incident set similar to the current incident 402 that are searched from the historical incident set through the incident search engine 120 in FIG. 1 or through the process shown in FIG. 2 or FIG. 3. The similar incident set 404 may serve as a candidate incident set with which the current incident may potentially be correlated.

[0053] The correlation criteria 406 may correspond to the correlation criteria 124 in FIG. 1. The correlation criteria 406 may be in natural language. The correlation criteria 406 may specilya condition for the correlation of two incidents, e.g., having the same root cause, having the same exception, indicating the same issue, being resolved in the same way, etc. Alternatively or additionally, the correlation criteria 406 may specify which incident information should be checked and / or which incident information should be excluded when generating the correlation result. As an example, the correlation criteria 406 may specify that exception data points and exception messages for each incident should be traversed when generating the correlation result. As another example, the correlation criteria 406 may specify' that a source address that reported the incident should be excluded when generating the correlation result. The correlation criteria 406 may be a default correlation criteria provided by the incident correlation system, or a customized correlation criteria provided by a user. The customized correlation criteria may be included in configuration information of the user. Providing the correlation criteria in natural language to the large language model can determine whether the current incident may be correlated with a historical incident at a semantic level. Additionally, the correlation criteria in natural language is flexible and can be universally applied to various incidents and scenarios, and is easy to be understood and customized by users. The technical effect of this approach is to improve the correlation rate of incidents, reduce the number of notifications sent to users, while ensuring the accuracy of the correlation result.

[0054] The prompt 412 may be created based on the current incident 402. the similar incident set 404, and the correlation criteria 406 through the prompt creator 410. Current incident information of the current incident 402 may be obtained, e.g., title, content, attribute values, etc., of the current incident 402. The current incident information may be original current incident information or preprocessed current incident information. Similar incident information of each similar incident in the similar incident set 404 may be obtained. Herein, incident information of a similar incident is referred to as similar incident information. Similar incident information of a similar incident includes, e.g., title, content, attribute values, processing result, etc., of the similar incident. The processing result of the similar incident may include a processing history of the incident, e.g., the identified cause of the incident, how the incident was resolved, etc. The technical effect of including the processing result in the similar incident information of the similar incident is to provide the large language model with more context information about the similar incident, thereby facilitating the large language model to generate a more accurate correlation result. The current incident information of the current incident 402, the similar incident information set corresponding to the similar incident set 404, and the correlation criteria 406 may be combined into the prompt 412.

[0055] A correlation result 422 for the current incident 402 may be generated based on the prompt 412 through the large language model 420. By way of example only and not limitation,the large language model 420 may be a Generative Pre-trained Transformer-4 (GPT-4) model, a GTP-3.5 Turbo model, etc. The correlation result 422 may indicate whether the current incident 402 is correlated with at least one similar incident in the similar incident set 404. The correlation result 422 may be in natural language. The large language model 420 may semantically match the current incident 402 with each similar incident in the similar incident set 404 with its semantic understanding ability, logical reasoning ability’, big data support ability, language expression ability, etc., to determine whether the current incident 402 and the similar incident meet the correlation criteria 406.

[0056] If the large language model 420 determines that the current incident 402 and at least one similar incident in the similar incident set 404 meet the correlation criteria 406, the correlation result 422 indicating that the current incident 402 is correlated with at least one similar incident in the similar incident set 404 may be generated. For example, the correlation result 422 may include an indication of a similar incident correlated with the current incident, such as identifier, number, title, etc., of the similar incident. Preferably, the correlation result 422 may include a reason for the current incident 402 being correlated with the similar incident. Assume that the number of this similar incident is "46670799". The correlation result 422 may include the following statement: "The current incident may be correlated with the incident 46670799. Both the current incident and the incident 46670799 have the same monitor identifier (6d87d-140e- 45f2-332f6) and have similar error messages indicating a 'Popssl Probe' availability issue. The error messages for both incidents indicate a 'request timeout' error and a 'backend authentication timeout' issue. Therefore, the current incident may be correlated with the incident 46670799". The correlation result 422 may be provided to a user so that the user can clearly know which historical incident that the current incident may be correlated with and the reason for the current incident being correlated with the historical incident.

[0057] If the large language model 420 determines that the current incident 402 and all similar incidents in the similar incident set 404 do not meet the correlation criteria 406, the correlation result 422 indicating that the current incident 402 is not correlated with any similar incident in the similar incident set 404 may be generated.

[0058] Preferably, when creating the prompt 412, in addition to considering the current incident 402, the similar incident set 404 and the correlation criteria 406, feedback 408 on a historical correlation result may also be considered. The historical correlation result may be previously generated by the large language model 420, which may include two incidents that are previously determined to be correlated by the large language model 420. The feedback 408 on the historical correlation result may be previously provided by a user. The user may be the user handling the current incident or another user. The feedback 408 on the historical correlation resultmay include positive feedback and / or negative feedback. The user's positive feedback on the correlation result may indicate that the user considers the correlation result to be correct. The user's negative feedback on the correlation result may indicate that the user considers the correlation result to be wrong. The prompt is the input used by the large language model to generate the correlation result. The technical effect of additionally considering user feedback on the historical correlation result when creating the prompt is to enable the large language model to leam from the feedback what can be learned and what needs to be improved when it generates correlation results in the past, thereby improving its accuracy when generating the correlation result for the current incident.

[0059] It should be appreciated that the process for generating the correlation result for the current incident described above in conjunction with FIG. 4 is merely exemplary. Depending on actual application requirements, the steps in the process for generating the correlation result for the current incident may be replaced or modified in any manner, and the process may comprise more or fewer steps.

[0060] A generative language model such as a large language model sometimes produce a meaningless or untrustworthy output, a problem referred to as hallucination problem. The embodiments of the present disclosure propose to verify the correctness of a correlation result generated by a large language model through the large language model. FIG. 5 illustrates an exemplary process 500 for verifying a correlation result according to an embodiment of the present disclosure. The process 500 may be performed by a correlation operation engine, e.g., performed by the correlation operation engine 140 in FIG. 1. The process 500 may be performed on e g., the correlation result 422 generated by the large language model 420 in FIG. 4.

[0061] The process 500 may start at 502. At 504, it may be determined whether a correlation result indicates that a current incident is correlated with at least one historical incident.

[0062] If it is determined at 504 that the correlation result does not indicate that the current incident is correlated with at least one historical incident, that is, the large language model determines that the current incident is not correlated with any historical incident, the process 500 may proceed to a step 512. At 512, no correlation action for the current incident may be performed. In this case, the current incident may be handled according to the usual process, e.g., keeping a severity level of the current incident unchanged, sending a notification indicating the current incident, etc.

[0063] If it is determined at 504 that the correlation result indicates that the current incident is correlated with at least one historical incident, the process 500 may proceed to a step 506. At 506, the correctness of the correlation result may be verified through a large language model. The large language model used to verify the correctness of the correlation result and the large languagemodel used to generate the correlation result may be the same model. The correlation result and incident information of the current incident and the historical incident may be input to the large language model. The large language model may determine whether the correlation result is tenable through performing logical reasoning. If it is tenable, the correlation result may be considered to be correct; if it is not tenable, the correlation result may be considered to be wrong.

[0064] If it is determined at 508 that the correlation result is correct, the process 500 may proceed to a step 510. At 510, a correlation action for the current incident may be performed. For example, the correlation operation engine may perform the correlation action for the current incident according to the correlation result and the operation configuration.

[0065] If it is determined at 508 that the correlation result is not correct, i.e., the correlation result is wrong, the process 500 may proceed to the step 512. At 512, no correlation action for the current incident may be performed. In this case, the current incident may be handled according to the usual process, e g., keeping a severity level of the current incident unchanged, sending a notification indicating the current incident, etc.

[0066] In the process 500, if the large language model determines that the correlation result is not tenable through performing logical reasoning, the correlation result is considered to be wrong, i.e., the current incident should not be correlated with the historical incident. In this case, no correlation action for the current incident will be performed. The technical effect of this approach is to avoid performing wrong correlation actions and ensure that the current incident is only correlated with a historical incident that can indeed be correlated.

[0067] It should be appreciated that the process for verifying the correlation result described above in conjunction with FIG. 5 is merely exemplary. Depending on actual application requirements, the steps in the process for verifying the correlation result may be replaced or modified in any manner, and the process may comprise more or fewer steps. Additionally, the specific order or hierarchy of the steps in the process 500 is merely exemplary, and the process for verifying the correlation result may be performed in an order different from the described order.

[0068] FIG. 6 is a flowchart of an exemplary method 600 for incident correlation according to an embodiment of the present disclosure.

[0069] At 610, a current incident vector of a current incident may be calculated.

[0070] At 620, a historical incident vector set corresponding to a historical incident set may be obtained.

[0071] At 630, a similar incident set that are similar to the current incident may be searched from the historical incident set according to the current incident vector and the historical incident vector set.

[0072] At 640, a correlation criteria in natural language may be received.

[0073] At 650, a prompt may be created based on the current incident, the similar incident set, and the correlation criteria.

[0074] At 660, a correlation result for the current incident may be generated based on the prompt through a large language model, the correlation result indicating that the current incident is correlated with at least one similar incident in the similar incident set.

[0075] In an implementation, the current incident may have current incident information. The current incident information may include at least one of title, content, and attribute values. Each similar incident of the similar incident set may have similar incident information. The similar incident information may include at least one of title, content, attribute values, and processing result.

[0076] In an implementation, the method 600 may further comprise: identifying, from the historical incident set, a historical incident subset whose occurrence time is close to the occurrence time of the current incident; and extracting a historical incident vector subset corresponding to the historical incident subset from the historical incident vector set. The searching, from the historical incident set, a similar incident set that are similar to the current incident may comprise: searching, from the historical incident subset, the similar incident set according to the current incident vector and the historical incident vector subset.

[0077] In an implementation, the correlation criteria may specify a condition for the correlation of two incidents. The condition may include at least one of: having the same root cause, having the same exception, indicating the same issue, and being resolved in the same way.

[0078] In an implementation, each incident of the current incident and the similar incident set may have one or more incident information. The correlation criteria may specify’ which incident information should be checked and / or which incident information should be excluded when generating the correlation result.

[0079] In an implementation, the method 600 may further comprise: obtaining feedback on a historical correlation result previously generated by the large language model, the feedback including positive feedback and / or negative feedback. The creating a prompt may comprise: creating the prompt based on the current incident, the similar incident set, the correlated criteria, and the feedback.

[0080] In an implementation, the correlation result may include a reason for the current incident being correlated with the at least one similar incident.

[0081] In an implementation, the method may further comprise: performing a correlation action for the current incident according to the correlation result and operation configuration, the correlation action including at least one of: automatically correlating the current incident with the at least one similar incident; defining the at least one similar incident as a parent incident of thecurrent incident; downgrading a severity level of the current incident; suppressing sending a notification indicating the current incident; and generating a suggestion to correlate the current incident with the at least one similar incident.

[0082] The method 600 may further comprise: verifying the correctness of the correlation result through the large language model. The performing a correlation action for the current incident may comprise: in response to the correlation result being correct, performing the correlation action based on the correlation result and the operation configuration.

[0083] It should be appreciated that the method 600 may further comprise any other step / process for incident correlation according to the embodiments of the present disclosure as mentioned above.

[0084] FIG. 7 illustrates an exemplary incident correlation system 700 according to an embodiment of the present disclosure.

[0085] The incident correlation system 700 may comprise: an incident search engine 710, for: calculating a current incident vector of a cunent incident, obtaining a historical incident vector set corresponding to a historical incident set, and searching, from the historical incident set, a similar incident set that are similar to the current incident according to the current incident vector and the historical incident vector set; and a correlation decision engine 720, for: receiving a correlation criteria in natural language, creating a prompt based on the current incident, the similar incident set, and the correlation criteria, and generating a correlation result for the current incident based on the prompt through a large language model, the correlation result indicating that the current incident is correlated with at least one similar incident in the similar incident set.

[0086] The incident correlation system 700 may further comprise: a correlation operation engine 730, for performing a correlation action for the cunent incident according to the correlation result and operation configuration, the correlation action including at least one of: automatically correlating the current incident with the at least one similar incident; defining the at least one similar incident as a parent incident of the current incident; downgrading a severity level of the current incident; suppressing sending a notification indicating the current incident; and generating a suggestion to correlate the current incident with the at least one similar incident.

[0087] It should be appreciated that the incident correlation system 700 may further comprise any other modules configured for incident correlation according to the embodiments of the present disclosure as mentioned above.

[0088] FIG. 8 illustrates an exemplary' apparatus 800 for incident correlation according to an embodiment of the present disclosure.

[0089] The apparatus 800 may comprise: a current incident vector calculating module 810, for calculating a current incident vector of a current incident; a historical incident vector setobtaining module 820, for obtaining a historical incident vector set corresponding to a historical incident set; a similar incident set searching module 830, for searching, from the historical incident set, a similar incident set that are similar to the current incident according to the current incident vector and the historical incident vector set; a correlation criteria receiving module 840, for receiving a correlation criteria in natural language; a prompt creating module 850. for creating a prompt based on the current incident, the similar incident set, and the correlation criteria; and a correlation result generating module 860, for generating a correlation result for the current incident based on the prompt through a large language model, the correlation result indicating that the current incident is correlated with at least one similar incident in the similar incident set. Furthermore, the apparatus 800 may further comprise any other modules configured for incident correlation according to the embodiments of the present disclosure as mentioned above.

[0090] FIG. 9 illustrates another exemplary apparatus 900 for incident correlation according to an embodiment of the present disclosure.

[0091] The apparatus 900 may comprise: a processor 910; and a memory 920 storing computer-executable instructions. The computer-executable instructions, when executed, may cause the processor 910 to: calculate a current incident vector of a current incident; obtain a historical incident vector set corresponding to a historical incident set; search, from the historical incident set, a similar incident set that are similar to the current incident according to the current incident vector and the historical incident vector set; receive a correlation criteria in natural language; create a prompt based on the current incident, the similar incident set, and the correlation criteria; and generate a correlation result for the current incident based on the prompt through a large language model, the correlation result indicating that the current incident is correlated with at least one similar incident in the similar incident set.

[0092] In an implementation, the computer-executable instructions, when executed, may further cause the processor 910 to: identify, from the historical incident set, a historical incident subset whose occurrence time is close to the occurrence time of the current incident; and extract a historical incident vector subset corresponding to the historical incident subset from the historical incident vector set. The searching, from the historical incident set, a similar incident set that are similar to the current incident may comprise: searching, from the historical incident subset, the similar incident set according to the current incident vector and the historical incident vector subset.

[0093] In an implementation, the correlation criteria may specify a condition for the correlation of two incidents. The condition may include at least one of: having the same root cause, having the same exception, indicating the same issue, and being resolved in the same way.

[0094] In an implementation, each incident of the cunent incident and the similar incident setmay have one or more incident information. The correlation criteria may specify which incident information should be checked and / or which incident information should be excluded when generating the correlation result.

[0095] In an implementation, the computer-executable instructions, when executed, may further cause the processor 910 to: obtain feedback on a historical correlation result previously generated by the large language model, the feedback including positive feedback and / or negative feedback. The creating a prompt may comprise: creating the prompt based on the current incident, the similar incident set, the correlated criteria, and the feedback.

[0096] In an implementation, the correlation result may include a reason for the current incident being correlated with the at least one similar incident.

[0097] In an implementation, the computer-executable instructions, when executed, may further cause the processor 910 to: perform a correlation action for the current incident according to the correlation result and operation configuration, the correlation action including at least one of: automatically correlating the current incident with the at least one similar incident; define the at least one similar incident as a parent incident of the current incident; downgrade a severity level of the current incident; suppress sending a notification indicating the current incident; and generate a suggestion to correlate the current incident with the at least one similar incident.

[0098] The computer-executable instructions, when executed, may further cause the processor 910 to: verify the correctness of the correlation result through the large language model. The performing a correlation action for the current incident may comprise: in response to the correlation result being correct, performing the correlation action based on the correlation result and the operation configuration.

[0099] It should be appreciated that the processor 910 may further perform any other steps / processes of the method for incident correlation according to the embodiments of the present disclosure as mentioned above.

[0100] The embodiments of the present disclosure propose a computer program product for incident correlation, comprising a computer program that is executed by a processor for: calculating a current incident vector of a current incident; obtaining a historical incident vector set corresponding to a historical incident set; searching, from the historical incident set, a similar incident set that are similar to the current incident according to the current incident vector and the historical incident vector set; receiving a correlation criteria in natural language; creating a prompt based on the current incident, the similar incident set, and the correlation criteria; and generating a correlation result for the current incident based on the prompt through a large language model, the correlation result indicating that the current incident is correlated with at least one similar incident in the similar incident set. Furthermore, the computer program may further be performedfor implementing any other steps / processes of the method for incident correlation according to the embodiments of the present disclosure as mentioned above.

[0101] The embodiments of the present disclosure may be embodied in a computer-readable medium for incident correlation. The computer-readable medium may comprise instructions that, when executed, cause a processor to: calculate a current incident vector of a current incident; obtain a historical incident vector set corresponding to a historical incident set; search, from the historical incident set, a similar incident set that are similar to the current incident according to the current incident vector and the historical incident vector set; receive a correlation criteria in natural language; create a prompt based on the cunent incident, the similar incident set. and the correlation criteria; and generate a correlation result for the current incident based on the prompt through a large language model, the correlation result indicating that the current incident is correlated with at least one similar incident in the similar incident set. Furthermore, the instructions, when executed, may further cause the processor to perform any other steps / processes of the method for incident correlation according to the embodiments of the present disclosure as mentioned above.

[0102] It should be appreciated that all the operations in the methods described above are merely exemplary, and the present disclosure is not limited to any operations in the methods or sequence orders of these operations, and should cover all other equivalents under the same or similar concepts. In addition, the articles '‘a” and ‘’an” as used in this specification and the appended claims should generally be construed to mean “one” or “one or more” unless specified otherwise or clear from the context to be directed to a singular form.

[0103] It should also be appreciated that all the modules in the apparatuses described above may be implemented in various approaches. These modules may be implemented as hardware, softw are, or a combination thereof. Moreover, any of these modules may be further functionally divided into sub-modules or combined together.

[0104] Processors have been described in connection with various apparatuses and methods. These processors may be implemented using electronic hardware, computer software, or any combination thereof. Whether such processors are implemented as hardware or software will depend upon the particular application and overall design constraints imposed on the system. By way of example, a processor, any portion of a processor, or any combination of processors presented in the present disclosure may be implemented with a microprocessor, microcontroller, digital signal processor (DSP), a field-programmable gate array (FPGA), a programmable logic device (PLD), a state machine, gated logic, discrete hardware circuits, and other suitable processing components configured for performing the various functions described throughout the present disclosure. The functionality of a processor, any portion of a processor, or any combinationof processors presented in the present disclosure may be implemented with software being executed by a microprocessor, microcontroller, DSP, or other suitable platform.

[0105] Software shall be construed broadly to mean instructions, instruction sets, code, code segments, program code, programs, subprograms, software modules, applications, software applications, software packages, routines, subroutines, objects, threads of execution, procedures, functions, etc. The software may reside on a computer-readable medium. A computer-readable medium may include, by way of example, memory such as a magnetic storage device (e.g., hard disk, floppy disk, magnetic strip), an optical disk, a smart card, a flash memory device, random access memory (RAM), read only memory (ROM), programmable ROM (PROM), erasable PROM (EPROM), electrically erasable PROM (EEPROM), a register, or a removable disk. Although memory is shown separate from the processors in the various aspects presented throughout the present disclosure, the memory may be internal to the processors, e.g., cache or register.

[0106] The previous description is provided to enable any person skilled in the art to practice the various aspects described herein. Various modifications to these aspects will be readily apparent to those skilled in the art, and the generic principles defined herein may be applied to other aspects. Thus, the claims are not intended to be limited to the aspects shown herein. All structural and functional equivalents to the elements of the various aspects described throughout the present disclosure that are known or later come to be known to those of ordinary skilled in the art are expressly incorporated herein and intended to be encompassed by the claims.

Claims

CLAIMS1 . A method for incident correlation, comprising: calculating a current incident vector of a current incident; obtaining a historical incident vector set corresponding to a historical incident set; searching, from the historical incident set, a similar incident set that are similar to the current incident according to the current incident vector and the historical incident vector set; receiving a correlation criteria in natural language; creating a prompt based on the current incident, the similar incident set, and the correlation criteria; and generating a correlation result for the cunent incident based on the prompt through a large language model, the correlation result indicating that the current incident is correlated with at least one similar incident in the similar incident set.

2. The method of claim 1, wherein: the current incident has current incident information, the current incident information including at least one of title, content, and attribute values, and / or each similar incident of the similar incident set has similar incident information, the similar incident information including at least one of title, content, attribute values, and processing result.

3. The method of claim 1, further comprising: identifying, from the historical incident set, a historical incident subset whose occurrence time is close to the occurrence time of the current incident; and extracting a historical incident vector subset corresponding to the historical incident subset from the historical incident vector set, and wherein the searching, from the historical incident set, a similar incident set that are similar to the current incident comprises: searching, from the historical incident subset, the similar incident set according to the current incident vector and the historical incident vector subset.

4. The method of claim 1, wherein the correlation criteria specifies a condition for the correlation of two incidents, the condition including at least one of: having the same root cause, having the same exception, indicating the same issue, and being resolved in the same way.

5. The method of claim 1, wherein each incident of the current incident and the similar incident set have one or more incident information, and the correlation criteria specifies which incident information should be checked and / or which incident information should be excluded when generating the correlation result.

6. The method of claim 1, further comprising: obtaining feedback on a historical correlation result previously generated by the largelanguage model, the feedback including positive feedback and / or negative feedback, and wherein the creating a prompt comprises: creating the prompt based on the current incident, the similar incident set, the correlated criteria, and the feedback.

7. The method of claim 1. wherein the correlation result includes a reason for the current incident being correlated with the at least one similar incident.

8. The method of claim 1, further comprising: performing a correlation action for the current incident according to the correlation result and operation configuration, the correlation action including at least one of: automatically correlating the current incident with the at least one similar incident; defining the at least one similar incident as a parent incident of the current incident; dow ngrading a severity level of the current incident; suppressing sending a notification indicating the current incident; and generating a suggestion to correlate the current incident with the at least one similar incident.

9. The method of claim 8, further comprising: verifying the correctness of the correlation result through the large language model, and wherein the performing a correlation action for the current incident comprises: in response to the correlation result is correct, performing the correlation action based on the correlation result and the operation configuration.

10. An incident correlation system, comprising: an incident search engine, for: calculating a current incident vector of a current incident, obtaining a historical incident vector set corresponding to a historical incident set, and searching, from the historical incident set, a similar incident set that are similar to the current incident according to the current incident vector and the historical incident vector set; and a correlation decision engine, for: receiving a correlation criteria in natural language, creating a prompt based on the current incident, the similar incident set, and the correlation criteria, and generating a correlation result for the current incident based on the prompt through a large language model, the correlation result indicating that the current incident is correlated with at least one similar incident in the similar incident set.

11. The incident correlation system of claim 10. further comprising:a correlation operation engine, for performing a correlation action for the current incident according to the correlation result and operation configuration, the correlation action including at least one of: automatically correlating the current incident wi th the at least one similar incident; defining the at least one similar incident as a parent incident of the current incident; downgrading a severity level of the current incident; suppressing sending a notification indicating the current incident; and generating a suggestion to correlate the current incident with the at least one similar incident.

12. An apparatus for incident correlation, comprising: a processor; and a memory storing computer-executable instructions that, when executed, cause the processor to: calculate a current incident vector of a current incident, obtain a historical incident vector set corresponding to a historical incident set, search, from the historical incident set, a similar incident set that are similar to the current incident according to the current incident vector and the historical incident vector set, receive a correlation criteria in natural language, create a prompt based on the current incident, the similar incident set, and the correlation criteria, and generate a correlation result for the current incident based on the prompt through a large language model, the correlation result indicating that the current incident is correlated with at least one similar incident in the similar incident set.

13. The apparatus of claim 12, wherein the computer-executable instructions, when executed, further cause the processor to: obtain feedback on a historical correlation result previously generated by the large language model, the feedback including positive feedback and / or negative feedback, and wherein the creating a prompt comprises: creating the prompt based on the current incident, the similar incident set, the correlated criteria, and the feedback.

14. The apparatus of claim 12, wherein the correlation result includes a reason for the current incident being correlated with the at least one similar incident.

15. A computer program product for incident correlation, comprising a computer program that is executed by a processor for: calculating a current incident vector of a current incident;obtaining a historical incident vector set corresponding to a historical incident set; searching, from the historical incident set, a similar incident set that are similar to the current incident according to the current incident vector and the historical incident vector set; receiving a correlation criteria in natural language; creating a prompt based on the current incident, the similar incident set, and the correlation criteria; and generating a correlation result for the current incident based on the prompt through a large language model, the correlation result indicating that the current incident is correlated with at least one similar incident in the similar incident set.

Images