CN117852548A - Alarm solution generating method and computer equipment - Google Patents

Abstract

The application discloses an alarm solution generating method and computer equipment, and belongs to the technical field of alarm processing. The method comprises the following steps: and acquiring target alarm information, and carrying out semantic analysis on the target alarm information through a pre-trained large language model to obtain alarm semantics. And then searching a solution corresponding to the alarm semantics in the first corresponding relation. If the solution corresponding to the alarm semantics is not found in the first corresponding relation, generating the solution corresponding to the alarm semantics through the large language model. Because the large language model learns a great deal of priori knowledge, the related field is wider, and more accurate alarm semantics can be obtained by carrying out semantic analysis on the target alarm information through the large language model. In addition, for the newly-appearing alarm, the embodiment of the application can also generate a more accurate solution through the large language model.

Description

Alarm solution generating method and computer equipment

Technical Field

The present disclosure relates to the field of alarm processing technologies, and in particular, to an alarm solution generating method and a computer device.

Background

With the continuous development of computer technology, the types and the number of alarms generated by various applications, services and devices are increasing, and the alarms may involve problems in terms of software errors, hardware faults, performance bottlenecks and the like, which affect the normal operation of the applications, services and devices. Therefore, a solution for timely and accurately acquiring alarms when generating the alarms is a urgent problem to be solved.

In the related art, a technician may store solutions of various alarm categories in a database in advance. Upon receiving an alert, the alert system may search the database for solutions related to the alert category of the alert.

However, the above approach only enables solutions of known alarm categories, while for newly emerging alarm categories, it is difficult to obtain more accurate solutions.

Disclosure of Invention

The application provides an alarm solution generating method and computer equipment, which can generate a more accurate solution. The technical scheme is as follows:

in a first aspect, there is provided an alarm solution generating method, the method comprising:

acquiring target alarm information;

Carrying out semantic analysis on the target alarm information through a pre-trained large language model to obtain alarm semantics;

searching a solution corresponding to the alarm semantics in a first corresponding relation, wherein the first corresponding relation is the corresponding relation between the alarm semantics and the solution;

if the solution corresponding to the alarm semantics is not found in the first corresponding relation, generating the solution corresponding to the alarm semantics through the large language model.

In the method, the target alarm information is acquired, and semantic analysis is carried out on the target alarm information through a pre-trained large language model, so that alarm semantics are obtained. And then searching a solution corresponding to the alarm semantics in the first corresponding relation. If the solution corresponding to the alarm semantics is not found in the first corresponding relation, generating the solution corresponding to the alarm semantics through the large language model. Because the large language model learns a great deal of priori knowledge, the related field is wider, and more accurate alarm semantics can be obtained by carrying out semantic analysis on the target alarm information through the large language model. In addition, for the newly-appearing alarm, the embodiment of the application can also generate a more accurate solution through the large language model.

Optionally, the acquiring the target alarm information includes:

receiving original alarm information, wherein the original alarm information comprises an alarm identifier and alarm content;

under the condition that the original alarm information is not empty alarm information or repeated alarm information, acquiring the alarm category of the original alarm information according to the alarm identifier and acquiring key information in the alarm content;

and generating the target alarm information according to the alarm category of the original alarm information and the key information.

Optionally, the alarm semantics include a system to which the target alarm information belongs and/or an alarm category of the target alarm information.

Optionally, after the solution corresponding to the alarm semantics is generated through the large language model, the method further includes:

and if the solution is effective after execution, storing the alarm semantics and the solution into the first corresponding relation, and updating the large language model according to the alarm semantics and the solution.

Optionally, after the solution corresponding to the alarm semantics is generated through the large language model, the method further includes:

if the solution is invalid after execution, acquiring solution modification information;

Generating a target solution according to the solution and the solution modification information;

storing the alarm semantics and the target solution in the first corresponding relation correspondingly, and updating the large language model according to the alarm semantics and the target solution.

Optionally, the first corresponding relation is a corresponding relation among alarm semantics, a solution and a validity value;

after searching the solution corresponding to the alarm semantics in the first corresponding relation, the method further comprises:

and if one or more solutions corresponding to the alarm semantics are found in the first corresponding relation, sequencing the one or more solutions according to the validity value corresponding to each solution in the first corresponding relation.

Optionally, the sorting the one or more solutions according to the validity value corresponding to each solution in the one or more solutions in the first correspondence includes:

acquiring a correlation value between the alarm semantics and each of the one or more solutions;

Determining a recommended value for each of the one or more solutions based on the relevance value and the validity value for each solution;

the one or more solutions are ordered in order of the recommended value from big to small.

Optionally, after searching the solution corresponding to the alarm semantics in the first correspondence, the method further includes:

if a solution corresponding to the alarm semantics is found in the first corresponding relation, increasing validity values of the alarm semantics and the solution corresponding to the first corresponding relation under the condition that the solution is valid after execution;

and in the case that the solution is invalid after execution, reducing the alarm semantics and the validity value corresponding to the solution in the first corresponding relation.

Optionally, the method further comprises:

the method comprises the steps of displaying a target interface, wherein a scheme viewing button, an effect feedback button and an information feedback button are displayed on the target interface, the scheme viewing button is used for viewing a solution corresponding to the alarm semantics, the effect feedback button is used for feeding back whether the solution is effective or ineffective after execution, and the information feedback button is used for feeding back scheme modification information.

In a second aspect, there is provided an alarm solution generating apparatus, the apparatus comprising:

the first acquisition module is used for acquiring target alarm information;

the semantic analysis module is used for carrying out semantic analysis on the target alarm information through a pre-trained large language model to obtain alarm semantics;

the searching module is used for searching a solution corresponding to the alarm semantics in a first corresponding relation, wherein the first corresponding relation is the corresponding relation between the alarm semantics and the solution;

the first generation module is used for generating the solution corresponding to the alarm semantics through the large language model if the solution corresponding to the alarm semantics is not found in the first corresponding relation.

In a third aspect, a computer device is provided, the computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, the computer program implementing the alarm solution generation method of the first aspect described above when executed by the processor.

In a fourth aspect, a computer readable storage medium is provided, the computer readable storage medium storing a computer program, which when executed by a processor, implements the alert solution generating method according to the first aspect.

In a fifth aspect, there is provided a computer program product comprising instructions which, when run on a computer, cause the computer to perform the steps of the alert solution generating method of the first aspect described above.

It will be appreciated that the advantages of the second, third, fourth and fifth aspects may be found in the relevant description of the first aspect, and are not repeated here.

Drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings that are needed in the description of the embodiments will be briefly introduced below, and it is obvious that the drawings in the following description are only some embodiments of the present application, and that other drawings may be obtained according to these drawings without inventive effort for a person skilled in the art.

FIG. 1 is a schematic diagram of a recommendation system provided in an embodiment of the present application;

FIG. 2 is a flow chart of an alarm solution generation method provided by an embodiment of the present application;

FIG. 3 is a schematic diagram of a bypass network provided by an embodiment of the present application;

FIG. 4 is a schematic structural diagram of an alarm solution generating device according to an embodiment of the present application;

Fig. 5 is a schematic structural diagram of a computer device according to an embodiment of the present application.

Detailed Description

For the purpose of making the objects, technical solutions and advantages of the present application more apparent, embodiments of the present application will be described in further detail below with reference to the accompanying drawings.

It should be understood that reference herein to "a plurality" means two or more. In the description of the present application, "/" means or, unless otherwise indicated, for example, a/B may represent a or B; "and/or" herein is merely an association relationship describing an association object, and means that three relationships may exist, for example, a and/or B may mean: a exists alone, A and B exist together, and B exists alone. In addition, for the purpose of facilitating the clear description of the technical solutions of the present application, the words "first", "second", etc. are used to distinguish between the same item or similar items having substantially the same function and effect. It will be appreciated by those of skill in the art that the words "first," "second," and the like do not limit the amount and order of execution, and that the words "first," "second," and the like do not necessarily differ.

The statements of "one embodiment" or "some embodiments" and the like, described in this application, mean that a particular feature, structure, or characteristic described in connection with the embodiment is included in one or more embodiments of the present application. Thus, appearances of the phrases "in one embodiment," "in some embodiments," "in other embodiments," and the like in various places throughout this application are not necessarily all referring to the same embodiment, but mean "one or more, but not all, embodiments" unless expressly specified otherwise. Furthermore, the terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically noted.

The application scenario of the embodiment of the present application is described below.

The alarm solution generating method provided by the embodiment of the application can be applied to the scene of the solution requiring to acquire the alarm.

For example, after receiving the alarm information, the recommendation system may generate a corresponding solution according to the alarm solution generating method provided in the embodiment of the present application.

The source of the alert information (hereinafter referred to as alert source) may be an Application (App) where there is an alert requirement, an electronic device, a system, etc. These alert sources may generate different categories of alerts during operation. For example, if the alert source is an application, a software alert, a performance alert, etc. may be generated. For another example, if the alert source is an electronic device, a hardware alert may be generated.

The alert source may be in communication with the recommendation system via a wired connection or a wireless connection. When the alert sources generate alert information, the alert information may be sent to the recommender system and solutions corresponding to the alert information may be generated by the recommender system. By way of example, the solution may be an alarm cause location solution, an alarm processing solution, etc., which embodiments of the present application do not limit.

Next, a recommendation system according to an embodiment of the present application will be described.

Fig. 1 is a schematic diagram of a recommendation system provided in an embodiment of the present application. Referring to fig. 1, the recommendation system 10 includes an alert module 101, a solution recommendation module 102.

The alarm module 101 is configured to receive alarm information, preprocess the alarm information, and transmit the preprocessed alarm information to the solution recommendation module 102. In some embodiments, preprocessing the alarm information may include filtering, classifying, acquiring key information of the alarm information, and the like, and of course, the alarm information may also be preprocessed in other manners, which is not limited in the embodiments of the present application.

The solution recommendation module 102 is configured to generate and recommend solutions related to alert information. In the embodiment of the present application, after the solution recommending module 102 acquires the alarm information, the solution corresponding to the alarm information may be acquired.

In some cases, the alarm module 101 and the solution recommendation module 102 may operate as separate modules in a computer device, and of course, the alarm module 101 and the solution recommendation module 102 may also operate as a combined module in a computer device, which is not limited in the embodiment of the present application.

The alarm solution generating method provided in the embodiment of the present application is explained in detail below.

Fig. 2 is a flowchart of an alarm solution generating method provided in an embodiment of the present application. The method may be applied to a computer device. By way of example, the method may be applied to a recommendation system in a computer device, which may be recommendation system 10 described above in the embodiment of fig. 1. Referring to fig. 2, the method includes the steps of:

step 201: the computer device obtains the target alert information.

The target alarm information may be effective alarm information that the computer device needs to process.

In some embodiments, the operations of step 201 may include the following steps (1) to (3):

(1) The computer device receives original alarm information, wherein the original alarm information comprises an alarm identifier and alarm content.

The original alarm information refers to alarm information sent by an alarm source. For example, the original alarm information may be alarm information generated by a change of an operation state of the device, or may be alarm information generated by an abnormality of a system, which is not limited in the embodiment of the present application.

The alert identification is used to identify a specific category of alert. In some embodiments, the alert identification may be an identification that the technician uses to indicate the alert when registering the alert. For example, the alert identification may indicate the context and classification of the alert.

The alarm content is specific information generated when the alarm occurs. For example, the alarm content may include a log, a monitoring index, a device status, and the like, which is not limited in the embodiment of the present application.

(2) Under the condition that the original alarm information is not empty alarm information or repeated alarm information, the computer equipment acquires the alarm category of the original alarm information according to the alarm identification of the original alarm information and acquires key information in the alarm content.

The empty alarm information refers to alarm information with empty alarm content. The original alarm information with empty alarm content is invalid alarm information.

The repeated alarm information means that the computer equipment receives the alarm information which is the same as the alarm identification of the original alarm information in a preset time before receiving the original alarm information. The preset duration may be preset, for example, the preset duration may be set to 8 minutes, 9 minutes, 10 minutes, or the like, which is not limited in the embodiment of the present application.

The alert category of the original alert information may be one of a plurality of categories divided in advance. For example, the operation and maintenance alert categories may include a machine alert category, which may include a central processing unit (Central Processing Unit, CPU) alert category.

Redundant information and key information may be included in the alert content. Redundant information in the alarm content refers to information unrelated to the reason of the alarm. For example, the redundant information may be various identifications (e.g., user identifications), random strings (e.g., encrypted strings), and the like. The key information in the alarm content refers to information related to the reason of the alarm. For example, if the original alarm information is a CPU alarm, the key information in the alarm content may include information such as process occupancy rate, thread occupancy rate, and the like.

Because repeated alarm information or null alarm information may exist in the original alarm information received by the computer device, the computer device may filter the original alarm information after receiving the original alarm information, so as to filter invalid alarm information. That is, if the original alarm information is an empty alarm information or a duplicate alarm information, the computer device may determine that the original alarm information is an invalid alarm information, and then may discard (i.e., filter out) the original alarm information without processing. If the original alarm information is not the null alarm information or the repeated alarm information, the computer device may determine that the original alarm information is a valid alarm information, and may then continue to process the original alarm information. In this way, the efficiency of the computer device in processing alarms can be improved.

In some embodiments, there is a correspondence between the alert identification and the alert category. The corresponding relation comprises a plurality of alarm identifications and alarm categories corresponding to each alarm identification in the plurality of alarm identifications. The correspondence may be preset.

In this case, the operation of the computer device to obtain the alert class of the original alert information according to the alert identifier of the original alert information may be: and acquiring a corresponding alarm category from the corresponding relation according to the alarm identification of the original alarm information.

Because the alarm content of the original alarm information contains the key information related to the alarm reason and the redundant information unrelated to the alarm reason, the computer equipment can remove the redundant information in the alarm content after determining that the original alarm information is effective alarm information, and the key information in the alarm content is obtained. In this way, interference of redundant information can be avoided.

(3) And the computer equipment generates target alarm information according to the alarm category and the key information of the original alarm information.

The alarm category of the original alarm information can represent a specific category of the alarm, and the key information of the original alarm information is related to the alarm reason, so that after the computer equipment generates the target alarm information according to the alarm category and the key information of the original alarm information, a more accurate solution can be obtained according to the target alarm information.

In some embodiments, the operation of step (3) may be: the computer equipment combines the alarm category of the original alarm information and the key information into target alarm information with a preset data format.

The preset data format may be preset. For example, the preset data format may be set as: alert category + critical information + additional information.

Wherein the additional information is supplementary information for locating the cause of the alarm. By way of example, the additional information may include a system operating environment, a system operating version, a system operating language, etc., which embodiments of the present application do not limit.

For example, the target alert information may be:

alarm category: the base alert/rpc invokes failure/php/go.

Key information: cURL, error#: operation timed out after 1000000milliseconds wi50bytes received,URL: ….

Additional information: and no.

For another example, the target alert information may be:

alarm category: operation and maintenance alarm/machine alarm/CPU alarm.

Key information: CPU rate high, top 70%, superviser10% ….

Additional information: windows (Windows) system.

Step 202: the computer equipment carries out semantic analysis on the target alarm information through the pre-trained large language model to obtain alarm semantics.

The large language model (Large Language Model, LLM) is an artificial intelligence model trained from large-scale text data, and can perform a wide range of tasks, such as semantic parsing, text summarization, and the like.

Illustratively, the large language model may include a plurality of network layers including an input layer, a plurality of hidden layers, and an output layer. The input layer is responsible for receiving input data; the output layer is responsible for outputting the processed data; a plurality of hidden layers are located between the input layer and the output layer, responsible for processing data, the plurality of hidden layers being invisible to the outside.

Alternatively, the large language model may generate a pre-training converter (Chat Generative Pre-trained Transformer, chatGPT) for chat, and of course, the large language model may be another model capable of performing semantic parsing and text summarization tasks, which is not limited in this embodiment of the present application.

Semantic analysis refers to analyzing the semantics of the target alarm information to obtain alarm semantics.

For example, the alert semantics may include a system to which the target alert information belongs and/or an alert category of the target alert information, and of course, the alert semantics may also include other information related to an alert cause, which is not limited in the embodiments of the present application. The system to which the target alarm information belongs is a system for generating an alarm.

Because the pre-trained large language model learns a great deal of priori knowledge, the semantic analysis is carried out on the target alarm information through the large language model, and more accurate alarm semantics can be obtained.

In some cases, the computer device may generate input information in a first preset input format that includes the targeted alert information. Then, inputting the input information into the large language model to carry out semantic analysis on the target alarm information through the large language model, and obtaining the output information of the large language model, wherein the output information is the alarm semantic.

The first preset input format may be preset. For example, the first preset input format may be set as: please summarize the system and the alarm category to which the "target alarm information" belongs within 20 words, of course, the first preset input format may be other input formats, which is not limited in the embodiment of the present application.

By way of example, assume that the target alert information is "alert category: operation and maintenance alarm/machine alarm/CPU alarm. Key information: CPU rate high, top, php 70%, superviser10%. Additional information: window (Windows) system "), then the input information to the large language model may be: please summarize the "alarm categories" within 20 words: operation and maintenance alarm/machine alarm/CPU alarm. Key information: CPU rate high, top, php 70%, superviser10%. Additional information: window (Windows) system "belongs to the category of systems and alarms.

Step 203: the computer device searches for a solution corresponding to the alarm semantics in a first corresponding relation, wherein the first corresponding relation is a corresponding relation between the alarm semantics and the solution.

The first correspondence includes a plurality of alert semantics and one or more solutions corresponding to each of the plurality of alert semantics. The first correspondence relationship may be preset. Alternatively, the first correspondence may be stored in a relational database, which is not limited in this embodiment of the present application, although the first correspondence may be stored in other forms.

In some embodiments, the first correspondence may be a correspondence between alert semantics, solutions, validity values.

The validity value is used for indicating the probability that the solution corresponding to the alarm semantics can successfully solve the alarm. That is, the higher the validity value corresponding to a certain alarm semantic and a certain solution, the greater the probability that the solution can successfully resolve the alarm corresponding to the alarm semantic. The lower the validity value corresponding to a certain alarm semantic and a certain solution, the lower the probability that the solution can successfully solve the alarm corresponding to the alarm semantic. Therefore, the success rate of the solution for solving the alarm can be intuitively known.

Optionally, the validity value has an initial value. The initial value may be set in advance, for example, the initial value may be set to 0. For example, when an alert semantics and a corresponding one of the solutions are newly added in the first correspondence, the validity value of the alert semantics and the corresponding one of the solutions may be set to the initial value.

For example, the solutions corresponding to the alarm semantics of the alarm A are a solution A, a solution B, a solution C and a solution D. The validity value corresponding to the alarm semantic and the solution A is 7, the validity value corresponding to the alarm semantic and the solution B is 11, the validity value corresponding to the alarm semantic and the solution C is 3, and the validity value corresponding to the alarm semantic and the solution D is 0. It follows that the probability that solution B can successfully resolve alarm a is the greatest.

The validity value may be increased or decreased. In some cases, where a solution is executed and valid (i.e., successfully resolving an alarm), the alarm semantics and the corresponding validity value of this solution may be increased; in the event that a solution is executed and is invalid (i.e., an alarm is not successfully resolved), the alarm semantics and the validity value corresponding to this solution may be reduced.

Continuing with the above example, assuming solution B is valid after execution, the validity value corresponding to alarm semantics and solution B may be increased by 1, where the validity value corresponding to alarm semantics and solution B is 12. And assuming that the solution D is invalid after execution, the validity value corresponding to the alarm semantic and the solution D can be subtracted by 1, and at the moment, the validity value corresponding to the alarm semantic and the solution D is minus 1.

In some embodiments, if the computer device finds a solution corresponding to the alert semantics in the first correspondence, then the following step 204 is performed. If the computer device does not find the solution corresponding to the alarm semantics in the first correspondence relationship, the following step 205 is executed.

Step 204: the computer equipment searches a solution corresponding to the alarm semantics in the first corresponding relation.

In some embodiments, the computer device may find one or more solutions corresponding to the alert semantics in the first correspondence. In this case, the computer device may rank the one or more solutions according to the corresponding validity value of each of the one or more solutions in the first correspondence.

In some embodiments, the computer device may order the one or more solutions in order of the validity value from greater to lesser.

In other embodiments, the computer device may order the one or more solutions according to the validity value corresponding to each of the one or more solutions in the first correspondence, including steps (1) through (3) as follows:

(1) The computer device obtains a correlation value between the alert semantics and each of the one or more solutions.

The relevance value may represent a degree of relevance between the alert semantics and the solution. The higher the correlation value between an alarm semantic and a solution, the higher the correlation degree between the alarm semantic and the solution is; the lower the correlation value between an alert semantic and a solution, the lower the degree of correlation of the alert semantic with the solution.

In some embodiments, the computer device may search for solutions to the alert semantics through a search engine, and after obtaining the search results, obtain a relevance value (also referred to as a relevance score) for each of a plurality of solutions provided in the search results. For any one of the one or more solutions corresponding to the alert semantics found from the first correspondence, if the one of the first correspondence is the same as the one of the search results, a relevance value for the one of the search results may be determined as a relevance value between the alert semantics and the one of the first correspondence.

By way of example, the search engine may be a search analysis engine (elastic search), a full text search engine, a directory search engine, a meta search engine, a vertical search engine, etc., as embodiments of the present application are not limited in this regard.

(2) The computer device determines a recommended value for each solution based on the relevance value and the validity value for each solution of the one or more solutions.

The higher the recommended value of a solution, the greater the success rate of the solution in resolving alarms is explained to some extent. The lower the recommended value of a solution, the smaller the success rate of the solution in resolving alarms is explained to some extent.

In some embodiments, the computer device may add the relevance value of a solution to the validity value of the solution to obtain a recommended value for the solution.

(3) The computer device ranks the one or more solutions in order of the recommended value from greater to lesser.

The greater the success rate at which the top-ranked solution can resolve the alarm after being executed, the less the top-ranked solution can resolve the alarm after being executed.

In some embodiments, if a solution corresponding to the alarm semantics is found in the first correspondence, the validity values of the alarm semantics and the solution corresponding to the first correspondence are increased if the solution is valid after execution. In the event that the solution is not valid after execution, the alert semantics and the corresponding validity value of the solution in the first correspondence are reduced.

If the solution is valid after execution, the solution is indicated to be capable of solving the alarm corresponding to the alarm semantics, i.e. the solution is a valid solution, so that the alarm semantics and the validity value corresponding to the solution can be increased. If the solution is invalid after execution, the solution is not capable of solving the alarm corresponding to the alarm semantics, namely the solution is an invalid solution, so that the validity value of the alarm semantics and the corresponding solution can be reduced. In this way, accuracy in recommending solutions based on the validity value can be ensured.

Step 205: if the computer equipment does not find the solution corresponding to the alarm semantics in the first corresponding relation, generating the solution corresponding to the alarm semantics through the large language model.

It should be noted that, in the embodiment of the present application, one or more solutions corresponding to the alert semantics may be generated through the large language model, which is not limited in the embodiment of the present application.

Because the large language model learns a great deal of priori knowledge, the related field is wider, and therefore, the solution corresponding to the alarm semantics can be generated through the large language model under the condition that the solution corresponding to the alarm semantics is not found in the first corresponding relation. Thus, for newly-appearing alarms, the embodiment of the application can also generate more accurate solutions.

In some cases, the computer device may generate input information in a second preset input format that includes the alert semantics. And then inputting the input information into the large language model to generate a solution corresponding to the alarm semantics through the large language model, and obtaining the output information of the large language model, wherein the output information is the solution.

The second preset input format may be preset. For example, the second preset input format may be set as: how to solve the alarm corresponding to the "alarm semantics", of course, the second preset input format may also be other input formats, which is not limited in the embodiment of the present application.

In some embodiments, after the computer device generates the solution corresponding to the alert semantics through the large language model, if the solution is valid after execution, the alert semantics and the solution are stored in the first correspondence, and the large language model is updated according to the alert semantics and the solution.

If a solution is valid after execution, it is stated that the solution can resolve the corresponding alarm, i.e., the solution is a valid solution. The computer device may store the alert semantics in the first correspondence corresponding to the solution to automatically update the first correspondence. In this case, when the computer device re-resolves the same alarm semantics next time, the solution corresponding to the alarm semantics can be directly found from the first correspondence relationship, so that the alarm resolution efficiency can be improved.

According to the embodiment of the application, the large language model is updated according to the alarm semantics and the solution, so that the large language model can be automatically updated, and the updated large language model can generate the alarm solution more accurately.

Alternatively, embodiments of the present application may update the large language model by way of fine tuning. In this case, the output layer of the large language model has a bypass network. The computer device freezes weights in the large language model other than the weights of the bypass network when updating the large language model, only updating the weights of the bypass network.

The input of the bypass network of the output layer of the large language model is the same as the input of the output layer. The output of the output layer is summed with the output of the bypass network of the output layer as the output of the output layer. For example, the bypass network may be a Low-Rank Adaptation (LoRA) network.

Illustratively, as shown in FIG. 3, the bypass network of the output layer includes a dimension reduction layer and a dimension increase layer. The bypass network performs first dimension reduction and then dimension increase on the input characteristics and then outputs the input characteristics. Optionally, after the weight matrix of the dimension reduction layer is initialized, the weight matrix of the dimension increase layer is subjected to Gaussian distribution, and after the weight matrix of the dimension increase layer is initialized, the weight matrix is a zero matrix.

Let the input feature be a feature matrix of mxd. The weight matrix of the output layer is a d×k matrix. The weight matrix of the dimension reduction layer in the bypass network may be a d×r matrix. The weight matrix of the up-scaling layer in the bypass network may be a matrix of r x k. Wherein m, d, r, k are positive integers, r is smaller than d, and r is smaller than k.

In this case, the input features are multiplied by the weight matrix of the output layer to obtain an mxk matrix. The input characteristics are multiplied by the weight matrix of the dimension reduction layer in the bypass network to obtain an mxr matrix, the mxr matrix is output to the dimension increase layer in the bypass network, and the mxr matrix is multiplied by the weight matrix of the dimension increase layer in the bypass network to obtain an mxk matrix. And adding the m multiplied by k matrix output by the output layer and the m multiplied by k matrix output by the dimension lifting layer in the bypass network to obtain the m multiplied by k matrix as output characteristic output.

For example, the computer device may treat the alert semantics as sample data in a training sample and treat the solution as a sample tag in the training sample to obtain the training sample. Then, the large language model can be trained by using the training sample to update the large language model; wherein the weights in the large language model other than the weights of the bypass network are frozen during training, and only the weights of the bypass network are updated.

Since only the weight of the bypass network needs to be adjusted during the training process, the weight that needs to be adjusted during the model training process can be reduced. In this way, the time and effort required for model training can be reduced, and thus the model training cost can be reduced.

In some embodiments, when the computer device trains the large language model using the training sample, sample data in the training sample can be input into the large language model to obtain output data; determining a loss value between the output data and a sample marker in the training sample by a loss function; and adjusting the weight of the bypass network in the large language model according to the loss value to obtain an updated large language model.

The operation of the computer device to adjust the weight of the bypass network in the large language model according to the loss value is similar to the operation of adjusting the weight of a layer in the neural network model according to the loss value in the related art, which is not described in detail in the embodiments of the present application.

For example, the computer device may be represented by the formulaTo adjust any one of the weights in the bypass network in the large language model. Wherein (1)>Is the adjusted weight. w is the weight before adjustment. Alpha is learning rate, alpha can be preset, such as alphaMay be 0.001, 0.000001, etc., to which the embodiments of the present application are not limited. dw is the partial derivative of the loss function with respect to w and can be derived from the loss value.

In other embodiments, after the computer device generates the solution corresponding to the alert semantics through the large language model, if the solution is invalid after execution, solution modification information is obtained, a target solution is generated according to the solution and the solution modification information, the alert semantics and the target solution are stored in a first corresponding relationship, and the large language model is updated according to the alert semantics and the target solution.

The solution modification information is modification information of a solution that is not valid after execution in order to modify the solution to be valid. The target solution is a solution obtained by modifying the solution by the solution modification information, and the target solution is an effective solution with a high probability.

If the solution is invalid after execution, the solution is not capable of solving the alarm corresponding to the alarm semantics, namely the solution is an invalid solution. In this case, the computer device first modifies the solution according to the solution modification information to obtain the target solution. And then, storing the alarm semantics and the target solution in the first corresponding relation in a corresponding way so as to automatically update the first corresponding relation. When the same alarm semantics are analyzed by the computer equipment next time, the target solution corresponding to the alarm semantics can be directly searched from the first corresponding relation, so that the alarm solving efficiency can be improved.

The operation of updating the large language model by the computer device according to the alarm semantics and the target solution is similar to the operation of updating the large language model by the computer device according to the alarm semantics and the solution, which is not described in detail in the embodiment of the present application.

Further, after one or more solutions are found in the first correspondence in step 204, or after one or more solutions are generated by the large language model in step 205, the one or more solutions may also be displayed on the target interface.

It should be noted that, if the one or more solutions are found from the first correspondence, the one or more solutions after being ranked in step 204 may be displayed on the target interface. In this way, the user can be facilitated to quickly learn the success rate of the one or more solutions to address the alert.

In some embodiments, the computer device displays a target interface, the target interface displaying a solution view button, an effect feedback button, and an information feedback button, the solution view button for viewing the solution, the effect feedback button for feeding back whether the solution is valid or invalid after execution, the information feedback button for feeding back the solution modification information.

In other embodiments, the computer device may send the one or more solutions to the alert-generating device for display. In this case, the apparatus may also display a target interface including a scheme view button, an effect feedback button, and an information feedback button.

For example, the target interface may include a plurality of display areas, each for displaying one solution. Specifically, the display area of one solution is used for displaying a solution view button, an effect feedback button and an information feedback button corresponding to the solution; a solution view button in the display area is used to view the solution, an effect feedback button in the display area is used to feedback whether the solution is active or inactive after execution, and an information feedback button in the display area is used to feedback solution modification information for the solution.

Illustratively, the solution view button is used to view the execution steps of the solution.

For example, the effect feedback buttons may include an active feedback button and an inactive feedback button. If the solution is valid after execution, the user may trigger a valid feedback button, at which point the computer device may determine that the solution is a valid solution. If the solution is not valid after execution, the user may trigger a not valid feedback button, at which point the computer device may determine that the solution is a not valid solution.

In some cases, if the solution is automatically executable, the target interface may also display a solution execution button. The solution execution button is used to automatically execute the solution.

For example, after the computer device displays the target interface, the user may view the execution steps of the solution by triggering a solution view button. In the case that the target interface displays a solution execution button, the user can automatically execute the solution by triggering the solution execution button; in the case where the target interface does not display a solution execution button, the user can execute the solution manually. After executing the solution, if the alert is successfully resolved, the user may indicate that the solution is valid by triggering an active feedback button; if the alert is not successfully resolved, the user may indicate that the solution is invalid by triggering an invalid feedback button and enter solution modification information by triggering an information feedback button.

In the embodiment of the application, after executing the solution, the user can simply and conveniently mark the solution through the effect feedback button and the information feedback button. Compared with the method of labeling the solution by operation and maintenance personnel, the embodiment of the application not only can improve the labeling accuracy, but also can reduce the operation and maintenance cost.

Optionally, if the number of solutions corresponding to the alert semantics is greater, the computer device may display a preset number of solutions, for example, a preset number of solutions that are ranked first may be displayed. The preset number may be set in advance. For example, the preset number may be set to 4, 5, 6, etc., which is not limited in the embodiment of the present application.

In some cases, the computer device may summarize and output the effect feedback and the solution modification information of the statistical solution at intervals of a preset time, so that the operation and maintenance personnel can know the overall performance of the recommendation system.

The preset time may be preset. For example, the preset time may be set to 1 week, 1 month, 3 months, etc., which is not limited in the embodiment of the present application.

In the embodiment of the application, the target alarm information is acquired, and semantic analysis is carried out on the target alarm information through a pre-trained large language model, so that alarm semantics are obtained. And then searching a solution corresponding to the alarm semantics in the first corresponding relation. If the solution corresponding to the alarm semantics is not found in the first corresponding relation, generating the solution corresponding to the alarm semantics through the large language model. Because the large language model learns a great deal of priori knowledge, the related field is wider, and more accurate alarm semantics can be obtained by carrying out semantic analysis on the target alarm information through the large language model. In addition, for the newly-appearing alarm, the embodiment of the application can also generate a more accurate solution through the large language model.

Fig. 4 is a schematic structural diagram of an alarm solution generating device according to an embodiment of the present application. The apparatus may be implemented by software, hardware, or a combination of both as part or all of a computer device, which may be the computer device shown in fig. 5 below. Referring to fig. 4, the apparatus includes: a first acquisition module 401, a semantic parsing module 402, a search module 403, and a first generation module 404.

A first obtaining module 401, configured to obtain target alarm information;

the semantic analysis module 402 is configured to perform semantic analysis on the target alarm information through a pre-trained large language model to obtain alarm semantics;

the searching module 403 is configured to search for a solution corresponding to the alarm semantics in a first correspondence, where the first correspondence is a correspondence between the alarm semantics and the solution;

the first generating module 404 is configured to generate, if a solution corresponding to the alert semantics is not found in the first correspondence, a solution corresponding to the alert semantics through the large language model.

Optionally, the obtaining module 401 is configured to:

receiving original alarm information, wherein the original alarm information comprises an alarm identifier and alarm content;

under the condition that the original alarm information is not empty alarm information or repeated alarm information, acquiring the alarm category of the original alarm information according to the alarm identifier and acquiring key information in alarm content;

And generating target alarm information according to the alarm category and the key information of the original alarm information.

Optionally, the alert semantics include a system to which the target alert information belongs and/or an alert category of the target alert information.

Optionally, the apparatus further comprises:

and the first storage module is used for storing the alarm semantics and the solution in the first corresponding relation correspondingly if the solution is effective after being executed, and updating the large language model according to the alarm semantics and the solution.

Optionally, the apparatus further comprises:

the second acquisition module is used for acquiring scheme modification information if the solution is invalid after execution;

the second generation module is used for generating a target solution according to the solution and the solution modification information;

and the second storage module is used for storing the alarm semantics and the target solution in the first corresponding relation correspondingly and updating the large language model according to the alarm semantics and the target solution.

Optionally, the first correspondence is a correspondence between alarm semantics, a solution, and a validity value, and the apparatus further includes:

and the sequencing module is used for sequencing the one or more solutions according to the validity value corresponding to each solution in the first corresponding relation if the one or more solutions corresponding to the alarm semantics are found in the first corresponding relation.

Optionally, the sorting module is configured to:

acquiring a correlation value between the alarm semantics and each of the one or more solutions;

determining a recommended value for each solution based on the relevance value and the validity value for each solution of the one or more solutions;

the one or more solutions are ordered in order of the recommended value from big to small.

Optionally, the apparatus further comprises:

the increasing module is used for increasing the validity value of the alarm semantics and the corresponding solutions in the first corresponding relation under the condition that the solutions are valid after being executed if the solutions corresponding to the alarm semantics are found in the first corresponding relation;

and the reducing module is used for reducing the alarm semantics and the validity value corresponding to the solution in the first corresponding relation under the condition that the solution is invalid after being executed.

Optionally, the apparatus further comprises:

the display module is used for displaying a target interface, the target interface is displayed with a scheme viewing button, an effect feedback button and an information feedback button, the scheme viewing button is used for viewing a solution corresponding to the warning semantics, the effect feedback button is used for feeding back whether the solution is effective or ineffective after execution, and the information feedback button is used for feeding back scheme modification information.

In the embodiment of the application, the target alarm information is acquired, and semantic analysis is carried out on the target alarm information through a pre-trained large language model, so that alarm semantics are obtained. And then searching a solution corresponding to the alarm semantics in the first corresponding relation. If the solution corresponding to the alarm semantics is not found in the first corresponding relation, generating the solution corresponding to the alarm semantics through the large language model. Because the large language model learns a great deal of priori knowledge, the related field is wider, and more accurate alarm semantics can be obtained by carrying out semantic analysis on the target alarm information through the large language model. In addition, for the newly-appearing alarm, the embodiment of the application can also generate a more accurate solution through the large language model.

It should be noted that: the alarm solution generating apparatus provided in the above embodiment only illustrates the division of the above functional modules when generating an alarm solution, and in practical application, the above functional allocation may be performed by different functional modules according to needs, that is, the internal structure of the apparatus is divided into different functional modules to perform all or part of the functions described above.

The functional units and modules in the above embodiments may be integrated in one processing unit, or each unit may exist alone physically, or two or more units may be integrated in one unit, where the integrated units may be implemented in a form of hardware or a form of a software functional unit. In addition, specific names of the functional units and modules are only for convenience of distinguishing from each other, and are not used for limiting the protection scope of the embodiments of the present application.

The alarm solution generating device and the alarm solution generating method provided in the foregoing embodiments belong to the same concept, and specific working processes and technical effects brought by units and modules in the foregoing embodiments may be referred to a method embodiment part, which is not repeated herein.

Fig. 5 is a schematic structural diagram of a computer device according to an embodiment of the present application. As shown in fig. 5, the computer device 5 includes: a processor 50, a memory 51 and a computer program 52 stored in the memory 51 and executable on the processor 50, the processor 50 implementing the steps in the alert solution generating method in the above-described embodiments when executing the computer program 52.

The computer device 5 may be a general purpose computer device or a special purpose computer device. In a specific implementation, the computer device 5 may be a desktop, a portable computer, a network server, a palmtop, a mobile phone, a tablet, a wireless terminal device, a communication device, or an embedded device, and the embodiments of the present application are not limited to the type of computer device 5. It will be appreciated by those skilled in the art that fig. 5 is merely an example of the computer device 5 and is not meant to be limiting as the computer device 5 may include more or fewer components than shown, or may combine certain components, or may include different components, such as may also include input-output devices, network access devices, etc.

The processor 50 may be a CPU, and the processor 50 may also be other general purpose processors, digital signal processors (Digital Signal Processor, DSPs), application specific integrated circuits (Application Specific Integrated Circuit, ASICs), off-the-shelf programmable gate arrays (Field-Programmable Gate Array, FPGAs) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or the like. The general purpose processor may be a microprocessor or may be any conventional processor.

The memory 51 may in some embodiments be an internal storage unit of the computer device 5, such as a hard disk or a memory of the computer device 5. The memory 51 may also be an external storage device of the computer device 5 in other embodiments, such as a plug-in hard disk, a Smart Media Card (SMC), a Secure Digital (SD) Card, a Flash memory Card (Flash Card) or the like, which are provided on the computer device 5. Further, the memory 51 may also include both an internal storage unit and an external storage device of the computer device 5. The memory 51 is used to store an operating system, application programs, boot Loader (Boot Loader), data, and other programs. The memory 51 may also be used to temporarily store data that has been output or is to be output.

The embodiment of the application also provides a computer device, which comprises: at least one processor, a memory, and a computer program stored in the memory and executable on the at least one processor, which when executed by the processor performs the steps of any of the various method embodiments described above.

The present application also provides a computer readable storage medium storing a computer program which, when executed by a processor, implements the steps of the respective method embodiments described above.

The present embodiments provide a computer program product which, when run on a computer, causes the computer to perform the steps of the various method embodiments described above.

The integrated units, if implemented in the form of software functional units and sold or used as stand-alone products, may be stored in a computer readable storage medium. With such understanding, the present application implements all or part of the flow of the above-described method embodiments, and may be implemented by a computer program to instruct related hardware, where the computer program may be stored in a computer readable storage medium, and when the computer program is executed by a processor, may implement the steps of the above-described method embodiments. Wherein the computer program comprises computer program code which may be in the form of source code, object code, executable files or in some intermediate form, etc. The computer readable medium may include at least: any entity or device capable of carrying computer program code to a photographing apparatus/terminal device, recording medium, computer Memory, ROM (Read-Only Memory), RAM (Random Access Memory ), CD-ROM (Compact Disc Read-Only Memory), magnetic tape, floppy disk, optical data storage device, and so forth. The computer readable storage medium mentioned in the present application may be a non-volatile storage medium, in other words, a non-transitory storage medium.

It should be understood that all or part of the steps to implement the above-described embodiments may be implemented by software, hardware, firmware, or any combination thereof. When implemented in software, may be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. The computer instructions may be stored in the computer-readable storage medium described above.

In the foregoing embodiments, the descriptions of the embodiments are emphasized, and in part, not described or illustrated in any particular embodiment, reference is made to the related descriptions of other embodiments.

Those of ordinary skill in the art will appreciate that the various illustrative elements and algorithm steps described in connection with the embodiments disclosed herein may be implemented as electronic hardware, or combinations of computer software and electronic hardware. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the solution. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present application.

In the embodiments provided in this application, it should be understood that the disclosed apparatus/computer device and method may be implemented in other ways. For example, the apparatus/computer device embodiments described above are merely illustrative, e.g., the division of modules or units is merely a logical functional division, and there may be additional divisions when actually implemented, e.g., multiple units or components may be combined or integrated into another system, or some features may be omitted or not performed. Alternatively, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection via interfaces, devices or units, which may be in electrical, mechanical or other forms.

The units described as separate units may or may not be physically separate, and units shown as units may or may not be physical units, may be located in one place, or may be distributed over a plurality of network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

The above embodiments are only for illustrating the technical solution of the present application, and are not limiting; although the present application has been described in detail with reference to the foregoing embodiments, it should be understood by those of ordinary skill in the art that: the technical scheme described in the foregoing embodiments can be modified or some technical features thereof can be replaced by equivalents; such modifications and substitutions do not depart from the spirit and scope of the technical solutions of the embodiments of the present application, and are intended to be included in the scope of the present application.

Claims (10)

1. A method of alert solution generation, the method comprising:

acquiring target alarm information;

carrying out semantic analysis on the target alarm information through a pre-trained large language model to obtain alarm semantics;

Searching a solution corresponding to the alarm semantics in a first corresponding relation, wherein the first corresponding relation is the corresponding relation between the alarm semantics and the solution;

if the solution corresponding to the alarm semantics is not found in the first corresponding relation, generating the solution corresponding to the alarm semantics through the large language model.

2. The method of claim 1, wherein the obtaining the target alert information comprises:

receiving original alarm information, wherein the original alarm information comprises an alarm identifier and alarm content;

under the condition that the original alarm information is not empty alarm information or repeated alarm information, acquiring the alarm category of the original alarm information according to the alarm identifier and acquiring key information in the alarm content;

and generating the target alarm information according to the alarm category of the original alarm information and the key information.

3. The method of claim 1, wherein the alert semantics include a system to which the target alert information belongs and/or an alert category of the target alert information.

4. The method of claim 1, wherein after the generating the solution corresponding to the alert semantics by the large language model, further comprising:

And if the solution is effective after execution, storing the alarm semantics and the solution into the first corresponding relation, and updating the large language model according to the alarm semantics and the solution.

5. The method of claim 1, wherein after the generating the solution corresponding to the alert semantics by the large language model, further comprising:

if the solution is invalid after execution, acquiring solution modification information;

generating a target solution according to the solution and the solution modification information;

storing the alarm semantics and the target solution in the first corresponding relation correspondingly, and updating the large language model according to the alarm semantics and the target solution.

6. The method according to any one of claims 1 to 5, wherein the first correspondence is a correspondence between alert semantics, solutions, validity values;

after searching the solution corresponding to the alarm semantics in the first corresponding relation, the method further comprises:

and if one or more solutions corresponding to the alarm semantics are found in the first corresponding relation, sequencing the one or more solutions according to the validity value corresponding to each solution in the first corresponding relation.

7. The method of claim 6, wherein the ordering the one or more solutions according to the corresponding validity value of each of the one or more solutions in the first correspondence comprises:

acquiring a correlation value between the alarm semantics and each of the one or more solutions;

determining a recommended value for each of the one or more solutions based on the relevance value and the validity value for each solution;

the one or more solutions are ordered in order of the recommended value from big to small.

8. The method of claim 6, wherein after searching for the solution corresponding to the alert semantics in the first correspondence, further comprising:

if a solution corresponding to the alarm semantics is found in the first corresponding relation, increasing validity values of the alarm semantics and the solution corresponding to the first corresponding relation under the condition that the solution is valid after execution;

and in the case that the solution is invalid after execution, reducing the alarm semantics and the validity value corresponding to the solution in the first corresponding relation.

9. The method of claim 1, 4, 5 or 8, wherein the method further comprises:

the method comprises the steps of displaying a target interface, wherein a scheme viewing button, an effect feedback button and an information feedback button are displayed on the target interface, the scheme viewing button is used for viewing a solution corresponding to the alarm semantics, the effect feedback button is used for feeding back whether the solution is effective or ineffective after execution, and the information feedback button is used for feeding back scheme modification information.

10. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, which computer program, when executed by the processor, implements the method according to any of claims 1 to 9.