Alarm Analysis Workflow Using Language Models and Query Tools
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud security protection systems rely heavily on human resources for analyzing alarm events, leading to low efficiency, accuracy, and specificity in alarm processing.
Innovation Solution
An alarm processing method utilizing a first language model to divide the analysis into multiple steps, extract key alarm data, and use data query tools to obtain associated data, generating a comprehensive alarm analysis result through natural language processing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If human resources are used to analyze alarm events, then the analysis can be performed with human judgment and flexibility, but the efficiency and productivity of alarm processing is low
Solution Approach 1:
The patent introduces an intermediary system comprising a language model and multiple data query tools that act as a bridge between the alarm event and the analysis result. The language model processes the alarm event description, determines necessary analysis steps, selects appropriate data query tools, and synthesizes results from multiple tools to produce the final alarm analysis, thereby achieving both high efficiency and high accuracy
Solution Approach 2:
The alarm analysis process is segmented into multiple independent analysis steps, each corresponding to a specific data query tool. The system divides the complex analysis task into smaller sub-tasks (e.g., querying alarm event details, querying resource information, querying log data) that can be executed independently and parallelized, improving overall processing efficiency while maintaining comprehensive analysis coverage
2Measurement precision
If multiple data query tools are used to obtain comprehensive associated data, then the accuracy and completeness of alarm analysis is improved, but the device complexity increases
Solution Approach 1:
The language model serves as a universal controller that handles multiple functions: understanding alarm events, determining analysis steps, selecting data query tools, and synthesizing results. This single multi-functional component replaces what would otherwise require multiple specialized components, reducing system complexity while maintaining the ability to coordinate multiple data query tools for comprehensive analysis
Solution Approach 2:
The language model acts as an intermediary layer that abstracts the complexity of coordinating multiple data query tools. Instead of requiring direct integration and coordination logic between multiple tools, the language model receives the alarm event, determines what data is needed, selects appropriate tools, executes queries, and synthesizes results, thereby managing complexity centrally rather than distributing it across multiple components
3Productivity
If automated analysis steps are implemented using language models, then the productivity and efficiency of alarm processing is improved, but the extent of automation requires sophisticated system integration
Solution Approach 1:
The language model enables the system to serve itself by automatically processing alarm events without human intervention. The language model independently determines analysis steps, selects data query tools, executes queries, and generates analysis results, making the system self-sufficient in handling alarm processing tasks and achieving high productivity through full automation
Data Source
AI summary
The present disclosure provides an alarm processing method, comprising: obtaining a first alarm event; determining at least one analysis step of the first alarm event and at least one data query tool respectively corresponding to the at least one analysis step, and extracting key alarm data from the first alarm event; for each of the at least one analysis step, performing steps of the following: sending the key alarm data and description information of the data query tool to a first language model; receiving query parameters output by the first language model; and calling, based on the query parameters, the data query tool to obtain associated data; sending the first alarm event and the associated data to the first language model, and receiving an alarm analysis result output by the first language model; and processing the first alarm event based on the alarm analysis result.