AI 中文总结
该研究提出无需训练的Incident Memory系统，结合分层速度检索、指纹条件PrefixSpan挖掘等技术，在ITSM事件日志及基准测试中展现出优异的事件响应相关性能，证实精确记忆在该场景下优于语言模型的开放式生成。
AI 中文摘要
事件响应是一个记忆问题：团队积累工单、追踪记录、事后分析报告和维基页面，但下一次事件所需的知识很少能完整保留其顺序、时效性和来源。我们提出了Incident Memory，一种无需模型训练的确定性系统，用于积累运行时知识。它结合了三个核心组件：（i）分层速度检索，以不同速率对结构、行为、上下文和短暂事实进行老化处理；（ii）指纹条件PrefixSpan挖掘，从成功调查中提取有序操作手册；（iii）感知来源的指标定义，通过可执行检查检测冲突定义。在包含24918起事件的141712条事件的UCI ITSM事件日志上，Incident Memory提取了23110条有序追踪记录，挖掘出39本操作手册，覆盖了6934个保留事件的84.3%。在具有已知真实值的受控基准测试中，它实现了99.2%的有序操作手册精度（受控），相比扁平基线的36%过时返回，具备架构时效性保证，冲突检测F1值为0.876。针对19个指纹组的Claude Haiku基线直接达到0.661的有序精度，而PrefixSpan的精度为0.985。核心结论并非语言模型在事件响应中表现较弱，而是一旦以指纹和先前操作为条件，重复的事件历史具有低熵，在该场景下，精确记忆比开放式生成是更强大的基础。
英文摘要
Incident response is a memory problem: teams accumulate tickets, traces, postmortems, and wiki pages, but the knowledge needed for the next incident is rarely stored with its order, freshness, and provenance intact. We present Incident Memory, a deterministic system that accumulates operational knowledge without model training. It combines (i) velocity-stratified retrieval, which ages structural, behavioral, contextual, and ephemeral facts at different rates; (ii) fingerprint-conditioned PrefixSpan mining, which extracts ordered playbooks from successful investigations; and (iii) provenance-aware metric definitions, which detect conflicting definitions through executable checks. On the UCI ITSM event log, containing 141,712 events across 24,918 incidents, Incident Memory extracts 23,110 ordered traces, mines 39 playbooks, and covers 84.3% of 6,934 held-out incidents. On controlled benchmarks with known ground truth, it achieves 99.2% ordered playbook precision (controlled), an architectural staleness guarantee versus 36% stale returns for a flat baseline, and conflict-detection F1 of 0.876. A direct Claude Haiku baseline on 19 fingerprint groups reaches 0.661 ordered precision, compared with 0.985 for PrefixSpan. The central result is not that language models are weak at incident response; it is that repeated incident histories are low-entropy once conditioned on fingerprint and previous action. In that regime, exact memory is a stronger primitive than open-ended generation.
Comments14 pages, 5 figures, 8 tables (main text); includes appendix
