376 lines
13 KiB
Python
376 lines
13 KiB
Python
"""结果融合器 (MVP-3 / D30)
|
|
|
|
将 YOLO 候选事件 (含规则引擎产出的 ``AlertEvent``) 与 LLM 分析结果
|
|
按指定策略融合，产出最终对外发出的 ``AlertEvent``。
|
|
|
|
策略说明
|
|
--------
|
|
|
|
1. ``weighted`` (加权平均):
|
|
final_conf = yolo_weight * yolo_conf + llm_weight * llm_conf
|
|
- LLM 明确否决时 (confirmed=False) 同样适用，但置信度向 0 收敛
|
|
- LLM 不确定 (confirmed=None) 时，若 ``fallback_to_yolo`` 为 True
|
|
直接保留 YOLO 结果
|
|
|
|
2. ``conservative`` (保守):
|
|
- LLM 否决 + ``suppress_on_llm_negative`` -> 抑制预警 (返回 None)
|
|
- LLM 确认 -> 取 ``min(yolo_conf, llm_conf)`` 与原值的最小值
|
|
- LLM 不确定 -> 抑制 (除非 ``fallback_to_yolo``)
|
|
|
|
3. ``llm_priority`` (LLM 优先):
|
|
- LLM 确认 -> 直接使用 LLM 置信度
|
|
- LLM 否决 -> 抑制
|
|
- LLM 不确定 -> 回退到 YOLO 置信度 (若 ``fallback_to_yolo``)
|
|
|
|
融合后会在 ``AlertEvent.metadata`` 中写入 ``llm`` 子对象，便于审计。
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import logging
|
|
import time
|
|
from dataclasses import dataclass, field
|
|
from typing import Any, Dict, Optional
|
|
|
|
from models.event_schemas import AlertEvent, SeverityLevel
|
|
from services.llm_analysis_service import LLMAnalysisResult
|
|
|
|
logger = logging.getLogger(__name__)
|
|
|
|
|
|
SUPPORTED_STRATEGIES = ("weighted", "conservative", "llm_priority")
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# 融合输出
|
|
# ---------------------------------------------------------------------------
|
|
|
|
|
|
@dataclass
|
|
class FusionOutcome:
|
|
"""融合结果。"""
|
|
|
|
alert: Optional[AlertEvent]
|
|
suppressed: bool = False
|
|
reason: str = ""
|
|
final_confidence: float = 0.0
|
|
yolo_confidence: float = 0.0
|
|
llm_confidence: float = 0.0
|
|
strategy: str = ""
|
|
metadata: Dict[str, Any] = field(default_factory=dict)
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# ResultFusion
|
|
# ---------------------------------------------------------------------------
|
|
|
|
|
|
class ResultFusion:
|
|
"""YOLO + LLM 结果融合器。
|
|
|
|
Args:
|
|
strategy: 融合策略，见模块 docstring
|
|
yolo_weight: weighted 策略下 YOLO 权重
|
|
llm_weight: weighted 策略下 LLM 权重
|
|
suppress_on_llm_negative: LLM 明确否决时是否抑制预警
|
|
fallback_to_yolo: LLM 未确认 / 不可用时是否回退到 YOLO 结果
|
|
promote_severity_on_high_confidence: 高融合置信度是否提升严重性
|
|
"""
|
|
|
|
def __init__(
|
|
self,
|
|
strategy: str = "weighted",
|
|
yolo_weight: float = 0.4,
|
|
llm_weight: float = 0.6,
|
|
suppress_on_llm_negative: bool = True,
|
|
fallback_to_yolo: bool = True,
|
|
promote_severity_on_high_confidence: bool = False,
|
|
high_confidence_threshold: float = 0.85,
|
|
) -> None:
|
|
if strategy not in SUPPORTED_STRATEGIES:
|
|
raise ValueError(
|
|
f"不支持的融合策略: {strategy}, 支持: {SUPPORTED_STRATEGIES}"
|
|
)
|
|
if not 0.0 <= yolo_weight <= 1.0:
|
|
raise ValueError("yolo_weight 必须在 [0, 1]")
|
|
if not 0.0 <= llm_weight <= 1.0:
|
|
raise ValueError("llm_weight 必须在 [0, 1]")
|
|
total = yolo_weight + llm_weight
|
|
if total <= 0:
|
|
raise ValueError("yolo_weight + llm_weight 必须 > 0")
|
|
|
|
self.strategy = strategy
|
|
self.yolo_weight = yolo_weight / total
|
|
self.llm_weight = llm_weight / total
|
|
self.suppress_on_llm_negative = suppress_on_llm_negative
|
|
self.fallback_to_yolo = fallback_to_yolo
|
|
self.promote_severity_on_high_confidence = promote_severity_on_high_confidence
|
|
self.high_confidence_threshold = high_confidence_threshold
|
|
|
|
# ------------------------------------------------------------------
|
|
# 主入口
|
|
# ------------------------------------------------------------------
|
|
|
|
def fuse(
|
|
self,
|
|
alert: AlertEvent,
|
|
llm_result: Optional[LLMAnalysisResult],
|
|
) -> FusionOutcome:
|
|
"""融合单条预警事件与 LLM 结果。
|
|
|
|
Args:
|
|
alert: 规则引擎/聚合器产出的预警事件 (尚未发布)
|
|
llm_result: LLM 分析结果，None 表示未触发 LLM
|
|
"""
|
|
|
|
yolo_conf = float(alert.confidence)
|
|
|
|
# 未调用 LLM 或 LLM 不可用
|
|
if llm_result is None:
|
|
return self._fallback_outcome(
|
|
alert,
|
|
yolo_conf=yolo_conf,
|
|
reason="llm_skipped",
|
|
)
|
|
|
|
if llm_result.error or llm_result.confirmed is None:
|
|
return self._fallback_outcome(
|
|
alert,
|
|
yolo_conf=yolo_conf,
|
|
llm_conf=llm_result.confidence,
|
|
reason=f"llm_unavailable:{llm_result.error or 'unknown'}",
|
|
llm_metadata=self._llm_metadata(llm_result),
|
|
)
|
|
|
|
# 至此 LLM 给出明确判定
|
|
if self.strategy == "weighted":
|
|
outcome = self._fuse_weighted(alert, yolo_conf, llm_result)
|
|
elif self.strategy == "conservative":
|
|
outcome = self._fuse_conservative(alert, yolo_conf, llm_result)
|
|
else: # llm_priority
|
|
outcome = self._fuse_llm_priority(alert, yolo_conf, llm_result)
|
|
|
|
if outcome.alert is not None:
|
|
self._apply_metadata(outcome.alert, llm_result, outcome)
|
|
if self.promote_severity_on_high_confidence:
|
|
self._maybe_promote_severity(outcome.alert, outcome.final_confidence)
|
|
|
|
return outcome
|
|
|
|
# ------------------------------------------------------------------
|
|
# 策略实现
|
|
# ------------------------------------------------------------------
|
|
|
|
def _fuse_weighted(
|
|
self,
|
|
alert: AlertEvent,
|
|
yolo_conf: float,
|
|
llm_result: LLMAnalysisResult,
|
|
) -> FusionOutcome:
|
|
# 否决降权: confirmed=False 时 LLM 置信度按 1-conf 反转
|
|
llm_conf = (
|
|
float(llm_result.confidence)
|
|
if llm_result.confirmed
|
|
else max(0.0, 1.0 - float(llm_result.confidence))
|
|
)
|
|
# confirmed=False 直接将 LLM 端贡献当作"反对票"
|
|
if not llm_result.confirmed:
|
|
# 反转后 llm 端置信度越高代表越反对，因此对最终值取 (yolo*w_y) - llm*w_l
|
|
final = self.yolo_weight * yolo_conf - self.llm_weight * llm_conf
|
|
final = max(0.0, min(1.0, final))
|
|
else:
|
|
final = self.yolo_weight * yolo_conf + self.llm_weight * llm_conf
|
|
final = max(0.0, min(1.0, final))
|
|
|
|
# 反对足够强且策略允许时抑制
|
|
if (
|
|
not llm_result.confirmed
|
|
and self.suppress_on_llm_negative
|
|
and final < 0.2
|
|
):
|
|
return FusionOutcome(
|
|
alert=None,
|
|
suppressed=True,
|
|
reason="weighted_suppressed_by_llm_negative",
|
|
final_confidence=final,
|
|
yolo_confidence=yolo_conf,
|
|
llm_confidence=float(llm_result.confidence),
|
|
strategy=self.strategy,
|
|
metadata=self._llm_metadata(llm_result),
|
|
)
|
|
|
|
alert.confidence = round(final, 4)
|
|
return FusionOutcome(
|
|
alert=alert,
|
|
suppressed=False,
|
|
reason="weighted",
|
|
final_confidence=final,
|
|
yolo_confidence=yolo_conf,
|
|
llm_confidence=float(llm_result.confidence),
|
|
strategy=self.strategy,
|
|
metadata=self._llm_metadata(llm_result),
|
|
)
|
|
|
|
def _fuse_conservative(
|
|
self,
|
|
alert: AlertEvent,
|
|
yolo_conf: float,
|
|
llm_result: LLMAnalysisResult,
|
|
) -> FusionOutcome:
|
|
if not llm_result.confirmed:
|
|
if self.suppress_on_llm_negative:
|
|
return FusionOutcome(
|
|
alert=None,
|
|
suppressed=True,
|
|
reason="conservative_llm_negative",
|
|
final_confidence=0.0,
|
|
yolo_confidence=yolo_conf,
|
|
llm_confidence=float(llm_result.confidence),
|
|
strategy=self.strategy,
|
|
metadata=self._llm_metadata(llm_result),
|
|
)
|
|
# 不抑制时也大幅降权
|
|
final = min(yolo_conf, 1.0 - float(llm_result.confidence))
|
|
else:
|
|
# 双方都确认: 取较小者，体现保守
|
|
final = min(yolo_conf, float(llm_result.confidence))
|
|
|
|
final = max(0.0, min(1.0, final))
|
|
alert.confidence = round(final, 4)
|
|
return FusionOutcome(
|
|
alert=alert,
|
|
suppressed=False,
|
|
reason="conservative",
|
|
final_confidence=final,
|
|
yolo_confidence=yolo_conf,
|
|
llm_confidence=float(llm_result.confidence),
|
|
strategy=self.strategy,
|
|
metadata=self._llm_metadata(llm_result),
|
|
)
|
|
|
|
def _fuse_llm_priority(
|
|
self,
|
|
alert: AlertEvent,
|
|
yolo_conf: float,
|
|
llm_result: LLMAnalysisResult,
|
|
) -> FusionOutcome:
|
|
if not llm_result.confirmed:
|
|
if self.suppress_on_llm_negative:
|
|
return FusionOutcome(
|
|
alert=None,
|
|
suppressed=True,
|
|
reason="llm_priority_negative",
|
|
final_confidence=0.0,
|
|
yolo_confidence=yolo_conf,
|
|
llm_confidence=float(llm_result.confidence),
|
|
strategy=self.strategy,
|
|
metadata=self._llm_metadata(llm_result),
|
|
)
|
|
final = max(0.0, 1.0 - float(llm_result.confidence))
|
|
else:
|
|
final = float(llm_result.confidence)
|
|
|
|
final = max(0.0, min(1.0, final))
|
|
alert.confidence = round(final, 4)
|
|
return FusionOutcome(
|
|
alert=alert,
|
|
suppressed=False,
|
|
reason="llm_priority",
|
|
final_confidence=final,
|
|
yolo_confidence=yolo_conf,
|
|
llm_confidence=float(llm_result.confidence),
|
|
strategy=self.strategy,
|
|
metadata=self._llm_metadata(llm_result),
|
|
)
|
|
|
|
# ------------------------------------------------------------------
|
|
# 降级
|
|
# ------------------------------------------------------------------
|
|
|
|
def _fallback_outcome(
|
|
self,
|
|
alert: AlertEvent,
|
|
yolo_conf: float,
|
|
llm_conf: float = 0.0,
|
|
reason: str = "fallback",
|
|
llm_metadata: Optional[Dict[str, Any]] = None,
|
|
) -> FusionOutcome:
|
|
if not self.fallback_to_yolo:
|
|
return FusionOutcome(
|
|
alert=None,
|
|
suppressed=True,
|
|
reason=f"{reason}:fallback_disabled",
|
|
final_confidence=0.0,
|
|
yolo_confidence=yolo_conf,
|
|
llm_confidence=llm_conf,
|
|
strategy=self.strategy,
|
|
metadata=llm_metadata or {},
|
|
)
|
|
|
|
alert.metadata.setdefault("llm", {})
|
|
if llm_metadata:
|
|
alert.metadata["llm"].update(llm_metadata)
|
|
alert.metadata["llm"]["fusion_reason"] = reason
|
|
return FusionOutcome(
|
|
alert=alert,
|
|
suppressed=False,
|
|
reason=reason,
|
|
final_confidence=yolo_conf,
|
|
yolo_confidence=yolo_conf,
|
|
llm_confidence=llm_conf,
|
|
strategy=self.strategy,
|
|
metadata=llm_metadata or {},
|
|
)
|
|
|
|
# ------------------------------------------------------------------
|
|
# 元数据 / 严重性
|
|
# ------------------------------------------------------------------
|
|
|
|
@staticmethod
|
|
def _llm_metadata(llm_result: LLMAnalysisResult) -> Dict[str, Any]:
|
|
return {
|
|
"provider": llm_result.provider,
|
|
"model": llm_result.model,
|
|
"confirmed": llm_result.confirmed,
|
|
"confidence": round(float(llm_result.confidence), 4),
|
|
"reasoning": llm_result.reasoning,
|
|
"latency_ms": round(llm_result.latency_ms, 2),
|
|
"error": llm_result.error,
|
|
"evaluated_at": time.time(),
|
|
}
|
|
|
|
def _apply_metadata(
|
|
self,
|
|
alert: AlertEvent,
|
|
llm_result: LLMAnalysisResult,
|
|
outcome: FusionOutcome,
|
|
) -> None:
|
|
alert.metadata.setdefault("llm", {})
|
|
alert.metadata["llm"].update(self._llm_metadata(llm_result))
|
|
alert.metadata["llm"]["fusion_strategy"] = self.strategy
|
|
alert.metadata["llm"]["fusion_reason"] = outcome.reason
|
|
alert.metadata["llm"]["final_confidence"] = round(
|
|
outcome.final_confidence, 4
|
|
)
|
|
|
|
@staticmethod
|
|
def _maybe_promote_severity(alert: AlertEvent, final_confidence: float) -> None:
|
|
order = [
|
|
SeverityLevel.INFO,
|
|
SeverityLevel.LOW,
|
|
SeverityLevel.MEDIUM,
|
|
SeverityLevel.HIGH,
|
|
SeverityLevel.CRITICAL,
|
|
]
|
|
try:
|
|
idx = order.index(alert.severity)
|
|
except ValueError:
|
|
return
|
|
if final_confidence >= 0.95 and idx < len(order) - 1:
|
|
alert.severity = order[idx + 1]
|
|
|
|
|
|
__all__ = ["ResultFusion", "FusionOutcome", "SUPPORTED_STRATEGIES"]
|
|
|
|
|