Micro-service full-link gray flow management system and method based on PaaS (Platform as Service)

Abstract

The invention discloses a micro-service full-link gray level traffic management system and method based on PaaS, and relates to the field of traffic management, and the system comprises an intelligent traffic analysis and decision center module, a micro-service arrangement and management platform, a full-link data analysis module, a dynamic safety protection and compliance auditing module, and a distributed configuration center. According to the micro-service full-link gray flow management system and method based on the PaaS, dynamic self-adaptive gray strategy formulation can be carried out, the latest service target, the gray version release plan and the system performance index threshold can be synchronously obtained in cooperation with a distributed configuration center, and the flow management efficiency is improved based on the information and the intelligent screening result of the flow. A routing strategy and a version switching strategy of gray traffic can be dynamically generated, and in the strategy making process, the real-time load condition of a system, the availability of micro-services and key index changes of services are fully considered.

Description

Technical Field

[0001] The present invention relates to the field of traffic management, and in particular to a PaaS-based microservice full-link grayscale traffic management system and method. Background Art

[0002] Grayscale traffic refers to the traffic that is directed from a small number of users or traffic under specific conditions to the new version or new function module for trial and verification in order to reduce risks and ensure a smooth transition during the version update or new function launch of the software system.

[0003] When conducting grayscale traffic management, most of the time, traditional traffic allocation based on factors such as version numbers and user tags is considered, and real-time business risk assessment and user experience prediction factors cannot be combined. As a result, when conducting grayscale testing, the normal business is greatly affected. At the same time, when conducting management, it cannot assist in making more accurate and intelligent decisions, so that the success rate and business value of grayscale releases cannot be guaranteed. It is also impossible to automatically allocate resources and schedule traffic according to business needs and system status, resulting in poor system elasticity and scalability.

[0004] Therefore, it is necessary to propose a PaaS-based microservice full-link grayscale traffic management system and method to solve the above problems. Summary of the invention

[0005] The main purpose of the present invention is to provide a PaaS-based microservice full-link grayscale traffic management system and method, which can effectively solve the problems in the background technology.

[0006] To achieve the above object, the technical solution adopted by the present invention is:

[0007] A PaaS-based microservice full-link grayscale traffic governance system, including an intelligent traffic analysis and decision-making center module, a microservice orchestration and management platform, a full-link data analysis module, a dynamic security protection and compliance audit module, and a distributed configuration center. The intelligent traffic analysis and decision-making center module is used to collect and process data, and classify and identify features of traffic based on convolutional neural networks, while monitoring abnormal fluctuations and behaviors that deviate from normal patterns in traffic data in real time;

[0008] The microservice orchestration and management platform performs fine-grained traffic control and fault isolation on grayscale traffic based on the grayscale release scenario;

[0009] The full-link data analysis module is used to perform real-time data analysis and monitoring on the data within the full link, and to mine the data for formulating reasonable business strategies and plans;

[0010] The dynamic security protection and compliance audit module is used to verify and authorize users and systems accessing the system, and to audit and record the security and compliance of user and system operations;

[0011] The distributed configuration center is used to centrally manage configuration information.

[0012] Preferably, the intelligent traffic analysis and decision-making center module includes a data acquisition and preprocessing module, a data fusion and feature extraction module, a deep learning model and traffic analysis module, and a collaborative strategy generation module. The data acquisition and preprocessing module is used to establish a data acquisition network, based on which various types of traffic-related data are obtained from multiple data sources. The data acquisition and preprocessing module is integrated with external data sources, including a third-party market data platform, to obtain industry trends and competitor dynamic information. The data acquisition and preprocessing module removes format errors, duplications, and obviously abnormal network traffic records in the data based on regular expressions and predefined filtering rules, and standardizes the data;

[0013] The data fusion and feature extraction module performs in-depth processing on the cleaned data based on feature engineering methods to extract representative and discriminative features, including data packet size distribution, burst frequency of traffic, and proportion of protocol types; the data fusion and feature extraction module uses a fusion algorithm based on the attention mechanism to organically integrate features from different data sources, and automatically assign weights to different features based on the importance and relevance of the data.

[0014] Preferably, the deep learning model and traffic analysis module includes a traffic classification model construction module and an abnormal traffic detection and risk assessment module, wherein the traffic classification model construction module is used to construct a convolutional neural network for classifying and identifying features of traffic;

[0015] The abnormal traffic detection and risk assessment module is based on the learning and modeling of normal traffic patterns, and is used to monitor abnormal fluctuations and behaviors that deviate from normal patterns in traffic data in real time.

[0016] Preferably, the collaborative strategy generation module includes a real-time information acquisition and synchronization module and a strategy optimization module, wherein the real-time information acquisition and synchronization module is used to obtain the latest business configuration information, gray version details, system constraints and performance indicator thresholds in real time through a subscription-publishing mode;

[0017] The strategy optimization module generates and optimizes the routing strategy of gray traffic based on a genetic algorithm, and represents the routing strategy of gray traffic as a chromosome code, where each gene represents a decision variable, and defines a fitness function to evaluate the pros and cons of each strategy based on the obtained traffic classification results, risk assessment, business configuration information and system constraints, where the fitness function includes business target factors, system performance factors and risk factors, where the formula for the business target factor is:

[0018] Ys=w UR ×UR i ;

[0019] Where Ys is the contribution of the business objective factor to the fitness function, w UR is the weight of user retention rate, UR i The predicted user retention rate under the current individual strategy;

[0020] The formula for the system performance factor is:

[0021] Xs=-w RT ×RT i -w RU ×RU i ;

[0022] Where Xs is the contribution of system performance factors to the fitness function, w RT is the weight of response time, w RU is the weight of resource utilization, RT i is the predicted response time under the current individual strategy, RU i is the resource utilization predicted under the current individual strategy;

[0023] The formula for the risk factor is:

[0024] F s =-w UCR ×UCR i -w SFP ×SFP i ;

[0025] where F s is the contribution of risk factors to the fitness function, UCR i is the predicted user complaint rate under the current individual strategy, SFP i is the predicted system failure probability under the current individual strategy, w UCR is the weight of user complaint rate, w SFP is the weight of the system failure probability;

[0026] Based on the above factors, the comprehensive fitness function is obtained, the formula is:

[0027] F(i)=wUR ×UR i -w RT ×RT i -w RU ×RU i -w UCR ×UCR i -w SFP ×SFP i

[0029] Where i represents the i-th individual in the population, and F(i) is the fitness value of the individual. Based on the calculation of the fitness value of each individual, the pros and cons of the grayscale traffic strategy are evaluated and decisions are made. The higher F(i), the better the current individual strategy.

[0030] Preferably, the microservice orchestration and management platform is used to perform fine-grained traffic control and fault isolation on grayscale traffic in a grayscale release scenario according to the routing strategy formulated by ITADH, ensuring that the communication between the grayscale version of the microservice instance and the normal version does not interfere with each other, while achieving full-link tracking and monitoring of grayscale traffic for rapid location and resolution of problems.

[0031] Preferably, the full-link data analysis module includes a data collection module, a data storage and preprocessing module, a data analysis and insight module, and a data visualization and reporting module. The data collection module is used to collect microservice internal data: including method execution data, resource usage data, and service call data; network traffic data: including data packet level information and application layer traffic details; user behavior data collection: including page browsing behavior, interactive operation behavior, and user feedback data;

[0032] The data storage and preprocessing module is used to preprocess and clean the data, and store real-time data and offline data;

[0033] The data analysis and insight module includes a real-time data analysis and monitoring module and an offline data analysis and mining module, wherein the real-time data analysis and monitoring module performs real-time analysis and monitoring on real-time data stored in the memory database and message queue based on the real-time stream processing engine, continuously calculates and monitors the key performance indicators of the microservices, including response time, throughput, error rate, and system resource utilization indicators, pre-sets the threshold of the key performance indicators, compares the monitored key performance indicators with the pre-set threshold, and immediately notifies the relevant operation and maintenance personnel and business managers via email, SMS, or system pop-up window when the key performance indicators exceed the threshold range; the offline data analysis and mining module uses big data processing tools and data mining algorithms to perform in-depth analysis and mining on offline data stored in the data warehouse and distributed file system, uses time series analysis and regression analysis to perform trend analysis and prediction on historical business data, and formulates reasonable business strategies and plans based on this, and also includes in-depth analysis of the historical operation data and resource usage data of the microservices, mining potential performance bottlenecks and resource waste, and modeling and analyzing the relationship between the CPU, memory, and other resource utilization of the microservices and the business load in different time periods, finding out the key points where the resource utilization rate rises sharply with the growth of the business load, and determining the performance bottleneck of the system;

[0034] The data visualization and reporting module uses a combination of visualization tools and open source visualization libraries to create visualization charts and dashboards based on different analysis scenarios and requirements.

[0035] Preferably, the dynamic security protection and compliance audit module includes an identity authentication and authorization module, a real-time intrusion detection and defense module, a data encryption and desensitization module, and a compliance audit module. The identity authentication and authorization module includes a multi-factor authentication process, including user and system verification, wherein the user verification includes user name and password verification, and biometric identification; wherein the verification between systems adopts an authentication method based on digital certificates, and the identity authentication and authorization module also includes authorization verification, which grants corresponding predefined permission sets according to the roles of users and systems, and at the same time, introduces an attribute access control mechanism, and the attributes considered include the user's geographical location, access time, device type, and user behavior characteristics;

[0036] The real-time intrusion detection and defense module includes traffic monitoring and feature analysis and behavior analysis and anomaly monitoring. Traffic monitoring and feature analysis is based on IDS / IPS sensors deployed at key network nodes to continuously monitor network traffic flowing into and out of the microservice system, and is used to perform in-depth analysis on each data packet, match and analyze the traffic based on the attack feature library, and defend against it based on the analysis results. Behavior analysis and anomaly monitoring use behavior analysis technology to identify potential abnormal behaviors and unknown attacks.

[0037] Preferably, the data encryption and desensitization module is used to perform desensitization processing on the user's sensitive data, and the desensitization processing is performed in real time when the data is extracted from the production environment to the test environment, the development environment, and when the data is displayed and shared externally;

[0038] The compliance audit module includes an audit log record, which is used to record in detail all operation information related to security and compliance. The audit log includes the timestamp of the operation, the operation subject, the operation object, the operation type, the operation result and detailed operation parameters.

[0039] A PaaS-based microservice full-link grayscale traffic management method includes the following steps:

[0040] S1: Collect data from network devices, microservice instances, and front-end applications, including network traffic data, business log data, user behavior data, and system performance indicator data. Clean, convert, and pre-process these data, and integrate them with third-party market data platforms.

[0041] S2: Security protection strategy, including setting identity authentication and authorization rules, importing attack feature libraries for intrusion detection and defense, establishing data encryption and desensitization rules and key systems, and defining the scope and standards of compliance audits;

[0042] S3: Determine the business objectives of the grayscale release based on business development needs and market conditions, including testing the user acceptance of new features, evaluating the effectiveness of performance optimization measures, and verifying the stability of system architecture upgrades. Combined with business objectives and system status, formulate a preliminary grayscale release strategy, including the scope of grayscale versions, expected grayscale release time window, selection criteria for target user groups, and setting of key performance indicators.

[0043] S4: Based on the intelligent traffic analysis and decision-making center module, the traffic flowing into the system is classified and feature-identified, and divided into high-value grayscale traffic, low-value grayscale traffic, and normal business traffic. Based on the user's historical behavior data, business risk assessment, and the current system load, the user traffic with high activity, who may be more interested in new functions and will not have a significant impact on system stability is selected as high-value grayscale traffic, and it is guided to participate in grayscale testing first to obtain more representative and influential user feedback;

[0044] S5: Generate and optimize the routing strategy of grayscale traffic using genetic algorithms. By simulating the biological evolution process, the initial set of strategies are selected, crossed, and mutated. After multiple generations of evolutionary iterations, the optimal and near-optimal grayscale strategies are gradually found.

[0045] S6: Based on the microservice orchestration and management platform, the microservice instances are automatically deployed, elastically scaled, and traffic managed. The corresponding computing resources are allocated to the gray version of the microservice instances. Accurate traffic routing rules are configured in the service grid to accurately guide the filtered gray traffic to the target gray version of the microservice instances. At the same time, the isolation and non-interference between normal business traffic and gray traffic are ensured to ensure the overall stability and availability of the system.

[0046] S7: Perform strict identity authentication and authorization checks on all traffic to prevent illegal access and data leakage risks. Monitor and analyze network traffic based on real-time intrusion detection and defense modules to promptly detect and prevent potential attacks.

[0047] S8: Build a full-link data view to comprehensively monitor and analyze system performance and business indicators during the grayscale release process. Through real-time monitoring and analysis of microservice response time, throughput, error rate, business process conversion rate, user retention rate, and user satisfaction, timely discover possible performance bottlenecks, business anomalies, and user experience issues in the system, and use visualization tools and dashboards to display these data.

[0048] Compared with the prior art, the present invention provides a PaaS-based microservice full-link grayscale traffic management system and method, which has the following beneficial effects:

[0049] 1. The PaaS-based microservice full-link grayscale traffic governance system and method can carry out dynamic and adaptive grayscale strategy formulation, and cooperate with the distributed configuration center to synchronously obtain the latest business goals, grayscale version release plans, and system performance indicator thresholds. Based on this information and intelligent screening results of traffic, it can dynamically generate grayscale traffic routing strategies and version switching strategies. In the process of strategy formulation, it fully considers the real-time load of the system, the availability of microservices, and changes in key business indicators.

[0050] 2. The PaaS-based microservice full-link grayscale traffic governance system and method can provide a more comprehensive and in-depth understanding and analysis of traffic, make more accurate and intelligent decisions, effectively improve the success rate and business value of grayscale releases, and achieve efficient management of microservice instances and refined control of grayscale traffic. It can automatically allocate resources and schedule traffic according to business needs and system status, greatly improving the elasticity and scalability of the overall system.

[0051] 3. This PaaS-based microservice full-link grayscale traffic management system and method has built a full-link data processing system from data collection to analysis, and uses big data and machine learning technology to conduct in-depth business insights and user behavior analysis. It can not only promptly discover and solve system performance problems, but also provide data-driven optimization suggestions for business decisions. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 It is a system block diagram of the present invention. DETAILED DESCRIPTION

[0053] In order to make the technical means, creative features, objectives and effects achieved by the present invention easy to understand, the present invention is further explained below in conjunction with specific implementation methods.

[0054] Embodiment 1:

[0055] like Figure 1 As shown, a PaaS-based microservice full-link grayscale traffic governance system includes an intelligent traffic analysis and decision-making center module, a microservice orchestration and management platform, a full-link data analysis module, a dynamic security protection and compliance audit module, and a distributed configuration center. The intelligent traffic analysis and decision-making center module is used to collect and process data, and classify and identify features of traffic based on convolutional neural networks, while monitoring abnormal fluctuations and behaviors that deviate from normal patterns in real time in traffic data;

[0056] The microservice orchestration and management platform performs fine-grained traffic control and fault isolation on grayscale traffic in grayscale release scenarios.

[0057] The full-link data analysis module is used to perform real-time data analysis and monitoring on the data within the full link, and to mine the data to formulate reasonable business strategies and plans;

[0058] The dynamic security protection and compliance audit module is used to verify and authorize users and systems that access the system, and to audit and record the security and compliance of user and system operations;

[0059] The distributed configuration center is used to centrally manage configuration information.

[0060] The intelligent traffic analysis and decision-making center module includes a data collection and preprocessing module, a data fusion and feature extraction module, a deep learning model and traffic analysis module, and a collaborative strategy generation module. The data collection and preprocessing module is used to establish a data collection network, based on which various types of traffic-related data are obtained from multiple data sources. The data sources include traffic logs of network devices, network protocols, port numbers, source IP and destination IP information extracted through deep packet inspection technology; business logs generated by service instances, covering user operation records, service call details, and error messages; system performance indicators collected by application performance monitoring tools, such as CPU usage, memory usage, response time, and throughput; and user behavior data collected through JavaScript code and SDK embedded in front-end pages and mobile applications. The data collection and preprocessing module integrates with external data sources, including third-party market data platforms, to obtain industry trends and competitor dynamics information. The data collection and preprocessing module removes format errors, duplications, and obviously abnormal network traffic records in the data based on regular expressions and predefined filtering rules, and standardizes the data.

[0061] The data fusion and feature extraction module processes the cleaned data in depth based on feature engineering methods to extract representative and distinguishing features, including data packet size distribution, burst frequency of traffic, and proportion of protocol types. For business logs, text mining technology is used to extract key business events, operation frequencies, and business entities involved to gain insights into the execution of business processes and user behavior patterns. In terms of user behavior data, a user behavior sequence model is constructed to extract the user's operation path, function usage frequency, and interaction depth over a period of time to identify changes in user activity, preferences, and behavioral habits. The data fusion and feature extraction module uses a fusion algorithm based on the attention mechanism to combine features from different data sources. It is organically integrated to automatically assign weights to different features based on the importance and relevance of the data. When evaluating the grayscale test of a platform's shopping process, the traffic analysis of user order operations will give higher weights to the order amount, product category, user's historical purchase record and related business features. At the same time, combined with the connection stability characteristics and system performance characteristics of the network layer, it is comprehensively judged whether the traffic is suitable for inclusion in the grayscale test scope, thereby achieving a comprehensive and accurate evaluation of the traffic; the deep learning model and traffic analysis module includes a traffic classification model construction module and an abnormal traffic detection and risk assessment module. The traffic classification model construction module is used to build a convolutional neural network for traffic classification and feature recognition;

[0062] The abnormal traffic detection and risk assessment module is based on the learning and modeling of normal traffic patterns, and is used to monitor abnormal fluctuations and behaviors that deviate from normal patterns in real time in traffic data; the collaborative strategy generation module includes a real-time information acquisition and synchronization module and a strategy optimization module. The real-time information acquisition and synchronization module is used to obtain the latest business configuration information, gray version details, system constraints, and performance indicator thresholds in real time through a subscription-publishing model, to ensure that traffic decisions are consistent with current business goals and system status, and to respond to configuration updates and changes in a timely manner and dynamically adjust gray strategies;

[0063] The strategy optimization module generates and optimizes the routing strategy of gray traffic based on genetic algorithms. The routing strategy of gray traffic is represented as a chromosome code, where each gene represents a decision variable. Based on the obtained traffic classification results, risk assessment, business configuration information and system constraints, a fitness function is defined to evaluate the pros and cons of each strategy. The fitness function includes business target factors, system performance factors and risk factors. The formula for business target factors is:

[0064] Ys=w UR ×UR i ;

[0065] Where Ys is the contribution of the business objective factor to the fitness function, w UR is the weight of user retention rate, UR i The predicted user retention rate under the current individual strategy;

[0066] The formula for the system performance factor is:

[0067] Xs=-w RT ×RT i -w RU ×RU i ;

[0068] Where Xs is the contribution of system performance factors to the fitness function, w RT is the weight of response time, w RU is the weight of resource utilization, RT i is the predicted response time under the current individual strategy, RU i is the resource utilization predicted under the current individual strategy;

[0069] The formula for the risk factor is:

[0070] F s =-w UCR ×UCR i -w SFR ×SFP i ;

[0071] where Fs is the contribution of risk factors to the fitness function, UCR i is the predicted user complaint rate under the current individual strategy, SFP i is the predicted system failure probability under the current individual strategy, w UCR is the weight of user complaint rate, w SFP is the weight of the system failure probability;

[0072] Based on the above factors, the comprehensive fitness function is obtained, the formula is:

[0073] F(i)=w UR ×UR i -w RT ×RT i -w RU ×RU i -w UCR ×UCR i -w SFP ×SFP i

[0075] Where i represents the i-th individual in the population, and F(i) is the fitness value of the individual. Based on the calculation of the fitness value of each individual, the pros and cons of the grayscale traffic strategy are evaluated and decisions are made. The higher F(i), the better the current individual strategy.

[0076] The microservice orchestration and management platform is used to perform fine-grained traffic control and fault isolation on grayscale traffic in grayscale release scenarios according to the routing strategy formulated by ITADH, ensuring that the communication between the grayscale version of microservice instances and the normal version does not interfere with each other. At the same time, it realizes full-link tracking and monitoring of grayscale traffic to quickly locate and solve problems.

[0077] The full-link data analysis module includes a data collection module, a data storage and preprocessing module, a data analysis and insight module, and a data visualization and reporting module. The data collection module is used to collect microservice internal data: including method execution data (recording the call time, execution time, input parameters and return value of each method, used to analyze the execution efficiency and potential problems of the business logic within the microservice), resource usage data (monitoring the CPU usage, memory usage, disk I / O operations and number of network connections of the microservice instance, and real-time understanding of the resource consumption of the microservice, which is used to provide a basis for subsequent resource optimization and capacity planning), service call data (recording the call relationship, call frequency, response time and error information between microservices, building a microservice call chain, and analyzing the system's architectural rationality and potential performance bottlenecks); network traffic data: including packet level information (including source IP address, destination IP address, protocol type, port number, packet size and the transmission timestamp of the data packet, which is used to analyze the traffic pattern, traffic source and destination of the network layer, and detect potential network attacks), application layer traffic details (for HTTP traffic, further parse the URL, request method, request header information and response status code to gain an in-depth understanding of the interaction between users and applications and the execution of business processes); user behavior data collection: including page browsing behavior (recording the sequence of pages visited by users, page dwell time, page jump path, building a user browsing behavior model, and analyzing users' interest preferences and behavior habits), interactive operation behavior (capturing users' clicks, inputs, slides, zooms on the page, and the time and location information of the operation, to gain an in-depth understanding of the details of the interaction between users and applications), user feedback data (collecting feedback information actively submitted by users, and correlating it with user behavior data for analysis, so as to more accurately understand users' needs and dissatisfactions and improve products and services in a timely manner);

[0078] The data storage and preprocessing module is used to preprocess and clean the data, and store real-time data and offline data;

[0079] The data analysis and insight module includes a real-time data analysis and monitoring module and an offline data analysis and mining module. The real-time data analysis and monitoring module analyzes and monitors the real-time data stored in the memory database and message queue based on the real-time stream processing engine, continuously calculates and monitors the key performance indicators of microservices, including response time, throughput, error rate, and system resource utilization indicators, pre-sets the thresholds of key performance indicators, compares the monitored key performance indicators with the pre-set thresholds, and immediately notifies the relevant operation and maintenance personnel and business managers via email, SMS, and system pop-up windows when the key performance indicators exceed the threshold range; the offline data analysis and mining module uses big data processing tools and data mining algorithms to conduct in-depth analysis and mining of offline data stored in data warehouses and distributed file systems, and builds detailed user portraits and user behavior models by performing cluster analysis and association rule mining on a large amount of user behavior data, dividing users with similar browsing behaviors, purchasing preferences, and operating habits into different user groups, analyzing the characteristics and needs of each group, and providing a basis for precision marketing, personalized recommendations, and user experience optimization. When it is found that a certain user group often purchases high-end electronic products and browses technology news websites, Then, when making product recommendations, we can specifically recommend the latest high-end electronic products and related accessories to them, improve the accuracy of recommendations and users' willingness to buy, use time series analysis and regression analysis to analyze and predict the trend of historical business data, and formulate reasonable business strategies and plans based on this, such as: by analyzing the monthly sales data of the past year, establishing an ARIMA time series prediction model, predicting the sales trend in the next few months, and adjusting inventory levels, arranging marketing activities and resource investment in advance based on the prediction results to cope with market changes and business growth needs. It also includes in-depth analysis of the historical operation data and resource usage data of microservices to explore potential performance bottlenecks and resource waste. By modeling and analyzing the relationship between the CPU, memory and other resource utilization of microservices and business load in different time periods, we can find out the key points where resource utilization increases sharply with the growth of business load, and determine the performance bottleneck of the system, which may be caused by the high time complexity of a certain algorithm and the inefficiency of database query statements. Based on the analysis results, we put forward targeted optimization suggestions, such as algorithm optimization, database index optimization, and resource expansion strategy, for system performance and resource utilization, and reduce operating costs;

[0080] The data visualization and reporting module combines visualization tools and open source visualization libraries to create visualization charts and dashboards based on different analysis scenarios and needs.

[0081] The dynamic security protection and compliance audit module includes an identity authentication and authorization module, a real-time intrusion detection and defense module, a data encryption and desensitization module, and a compliance audit module. The identity authentication and authorization module includes a multi-factor authentication process, including user and system verification, wherein user verification includes username and password verification, and biometric identification; wherein verification between systems adopts an authentication method based on digital certificates. The identity authentication and authorization module also includes authorization verification, which grants corresponding predefined permission sets according to the roles of users and systems. At the same time, an attribute access control mechanism is introduced, and the attributes considered include the user's geographic location, access time, device type, and user behavior characteristics; when the user verifies, he first enters the password. If the password verification is successful, the multi-factor authentication process is immediately started, combined with biometric identification technology, including fingerprint recognition and facial recognition. The user scans the fingerprint and takes a facial photo on the terminal device, and the collected biometric data is compared with the pre-stored feature template. Further access operations are allowed only after the comparison is successful; when the system verifies, the service provider and service consumer each hold a certificate issued by an authoritative certificate issuing authority The digital certificate of the microservice is used. When establishing a connection, both parties exchange certificates and verify the validity, integrity and identity information of the certificate holder to ensure that only legally authorized systems can communicate and access microservice resources. After the user and system are authenticated, the authorization stage is entered. Based on the access of roles and systems, the corresponding predefined permission sets are granted according to the roles of the user and system. The administrator role has the authority to modify the microservice configuration parameters, view all user data and manage the gray version release process. Ordinary users are only allowed to perform basic business operations, including querying personal information and executing regular business processes. At the same time, an attribute access control mechanism is introduced. The attributes considered include the user's geographic location, access time, device type, and user behavior characteristics. When a user tries to access sensitive gray functions from an unfamiliar geographic location, some of their operation permissions are temporarily restricted and additional identity authentication steps are triggered, including requiring users to answer pre-set security questions. For employees who try to access specific gray test functions during non-working hours, their permission level is reduced according to the company's security policy, and they are only allowed to perform read-only operations.

[0082] The real-time intrusion detection and defense module includes traffic monitoring and feature analysis and behavior analysis and anomaly monitoring. Traffic monitoring and feature analysis is based on IDS / IPS sensors deployed at key network nodes to continuously monitor network traffic flowing into and out of the microservice system. It is used to deeply analyze each data packet, match and analyze the traffic based on the attack feature library, defend it according to the analysis results, and extract key information, including source IP address, destination IP address, port number, protocol type, data packet content characteristics, and an established attack feature library. The pre-established attack feature library is used to match and analyze the traffic. This feature library contains feature patterns of various known attack methods, such as common network attacks, malware communication features, and attack features against microservice architectures. When a pattern matching an attack feature in the feature library is detected in the traffic, the corresponding alarm mechanism is immediately triggered, and actions are taken according to the pre-set defense strategy, including blocking the connection and recording the attack source information. Behavior analysis and anomaly monitoring are adopted. Use behavioral analysis technology to identify potential abnormal behaviors and unknown attacks, learn and model historical network traffic data, and establish a baseline model of normal traffic behavior, including traffic size distribution, connection time pattern, protocol usage frequency, and traffic characteristics of specific business operations. When the real-time monitored traffic behavior deviates from the baseline model and exceeds the preset threshold, it is marked as abnormal behavior and further analyzed and verified. When an IP address initiates a large number of connection requests to multiple microservice instances in a short period of time, and the request frequency and pattern do not match the behavior pattern of normal business traffic, it is preliminarily determined to be an abnormal behavior and a more in-depth detection mechanism is implemented, including a detailed analysis of the request content of the IP address and checking whether there is a forged source IP address. Based on this, corresponding defense measures are taken, including limiting the access speed of the IP address and directly blocking all its connections. At the same time, detailed alarm information is sent to the security administrator, including a description of the characteristics of the abnormal behavior, possible attack types, and the scope of the affected microservices.

[0083] The data encryption and desensitization module is used to desensitize the user's sensitive data. The desensitization process is carried out in real time when the data is extracted from the production environment to the test environment, development environment, and when the data is displayed and shared externally. For the user's ID number, a partial hiding method is adopted, only the first and last few digits are retained, and the middle part is replaced with asterisks; for the name, anonymization is adopted, and the real name is replaced with a randomly generated pseudonym; for financial transaction data, such as bank card numbers, only the bank card issuing bank logo and the last few digits are retained, and the middle part is fuzzy. In order to ensure that the desensitized data can still be used for testing and development purposes, some key features and statistical information of the data are retained, including the format of the data, the distribution range of the data, and the relationship between the data;

[0084] The compliance audit module includes audit log records, which are used to record in detail all operation information related to security and compliance. The audit log includes the timestamp of the operation, the operation subject, the operation object, the operation type, the operation result and detailed operation parameters. When a user successfully logs into the system, the audit log will record the login time, the user's account information, the IP address used for login, and whether multi-factor authentication is passed; when a user modifies an order data, the audit log will record the modification time, user ID, the modified order number, and the order data content before and after the modification, which will be used for subsequent audit analysis and tracing of operation history. According to the industry standards, laws and regulations followed by the enterprise, as well as the internal security policies and compliance requirements of the enterprise, the audit log is regularly checked for compliance. Based on the results of the compliance check, a detailed compliance audit report is generated. The report content includes the scope of the compliance check, the time period of the check, the list of compliance issues found, a detailed description of each issue, and the recommended rectification measures and rectification period for each issue. The compliance audit report is regularly submitted to the enterprise's management, security department and relevant regulatory agencies for the management to understand the current status and existing problems of the enterprise in terms of security and compliance, and take timely measures to rectify and optimize.

[0085] Embodiment 2:

[0086] A PaaS-based microservice full-link grayscale traffic management method, using any PaaS-based microservice full-link grayscale traffic management system of claims 1-8, comprising the following steps:

[0087] S1: Collect data from network devices, microservice instances, and front-end applications, including network traffic data, business log data, user behavior data, and system performance indicator data. Clean, convert, and pre-process these data, and integrate them with third-party market data platforms.

[0088] S2: Security protection strategy, including setting identity authentication and authorization rules, importing attack feature libraries for intrusion detection and defense, establishing data encryption and desensitization rules and key systems, and defining the scope and standards of compliance audits;

[0089] S3: Determine the business objectives of the grayscale release based on business development needs and market conditions, including testing the user acceptance of new features, evaluating the effectiveness of performance optimization measures, and verifying the stability of system architecture upgrades. Combined with business objectives and system status, formulate a preliminary grayscale release strategy, including the scope of grayscale versions, expected grayscale release time window, selection criteria for target user groups, and setting of key performance indicators.

[0090] S4: Based on the intelligent traffic analysis and decision-making center module, the traffic flowing into the system is classified and feature-identified, and divided into high-value grayscale traffic, low-value grayscale traffic, and normal business traffic. Based on the user's historical behavior data, business risk assessment, and the current system load, the user traffic with high activity, who may be more interested in new functions and will not have a significant impact on system stability is selected as high-value grayscale traffic, and it is guided to participate in grayscale testing first to obtain more representative and influential user feedback;

[0091] S5: Generate and optimize the routing strategy of grayscale traffic using genetic algorithms. By simulating the biological evolution process, the initial set of strategies are selected, crossed, and mutated. After multiple generations of evolutionary iterations, the optimal and near-optimal grayscale strategies are gradually found.

[0092] S6: Based on the microservice orchestration and management platform, the microservice instances are automatically deployed, elastically scaled, and traffic managed. The corresponding computing resources are allocated to the gray version of the microservice instances. Accurate traffic routing rules are configured in the service grid to accurately guide the filtered gray traffic to the target gray version of the microservice instances. At the same time, the isolation and non-interference between normal business traffic and gray traffic are ensured to ensure the overall stability and availability of the system.

[0093] S7: Perform strict identity authentication and authorization checks on all traffic to prevent illegal access and data leakage risks. Monitor and analyze network traffic based on real-time intrusion detection and defense modules to promptly detect and prevent potential attacks.

[0094] S8: Build a full-link data view to comprehensively monitor and analyze system performance and business indicators during the grayscale release process. Through real-time monitoring and analysis of microservice response time, throughput, error rate, business process conversion rate, user retention rate, and user satisfaction, timely discover possible performance bottlenecks, business anomalies, and user experience issues in the system, and use visualization tools and dashboards to display these data.

[0095] The above shows and describes the basic principles and main features of the present invention and the advantages of the present invention. It should be understood by those skilled in the art that the present invention is not limited to the above embodiments. The above embodiments and descriptions are only for explaining the principles of the present invention. Without departing from the spirit and scope of the present invention, the present invention may have various changes and improvements, which fall within the scope of the present invention to be protected. The scope of protection of the present invention is defined by the attached claims and their equivalents.

Claims

1. A PaaS-based microservice full-link grayscale traffic management system, including an intelligent traffic analysis and decision-making center module, a microservice orchestration and management platform, a full-link data analysis module, a dynamic security protection and compliance audit module, and a distributed configuration center, characterized by: The intelligent traffic analysis and decision-making center module is used to collect and process data, classify and identify traffic based on convolutional neural networks, and monitor abnormal fluctuations and behaviors that deviate from normal patterns in traffic data in real time; The microservice orchestration and management platform performs fine-grained traffic control and fault isolation on grayscale traffic based on the grayscale release scenario; The full-link data analysis module is used to perform real-time data analysis and monitoring on the data within the full link, and to mine the data for formulating reasonable business strategies and plans; The dynamic security protection and compliance audit module is used to verify and authorize users and systems accessing the system, and to audit and record the security and compliance of user and system operations; The distributed configuration center is used to centrally manage configuration information.

2. According to a PaaS-based microservice full-link grayscale traffic management system according to claim 1, it is characterized by: The intelligent traffic analysis and decision-making center module includes a data collection and preprocessing module, a data fusion and feature extraction module, a deep learning model and traffic analysis module, and a collaborative strategy generation module. The data collection and preprocessing module is used to establish a data collection network, based on which various types of traffic-related data are obtained from multiple data sources. The data collection and preprocessing module is integrated with external data sources, including a third-party market data platform, to obtain industry trends and competitor dynamic information. The data collection and preprocessing module is based on regular expressions and predefined filtering rules to eliminate format errors, duplications, and obviously abnormal network traffic records in the data, and standardize the data; The data fusion and feature extraction module performs in-depth processing on the cleaned data based on feature engineering methods to extract representative and discriminative features, including data packet size distribution, burst frequency of traffic, and proportion of protocol types; the data fusion and feature extraction module uses a fusion algorithm based on the attention mechanism to organically integrate features from different data sources, and automatically assign weights to different features based on the importance and relevance of the data.

3. According to a PaaS-based microservice full-link grayscale traffic management system according to claim 2, it is characterized by: The deep learning model and traffic analysis module includes a traffic classification model construction module and an abnormal traffic detection and risk assessment module. The traffic classification model construction module is used to construct a convolutional neural network for classifying and identifying features of traffic; The abnormal traffic detection and risk assessment module is based on the learning and modeling of normal traffic patterns, and is used to monitor abnormal fluctuations and behaviors that deviate from normal patterns in traffic data in real time.

4. According to a PaaS-based microservice full-link grayscale traffic management system according to claim 2, it is characterized by: The collaborative strategy generation module includes a real-time information acquisition and synchronization module and a strategy optimization module. The real-time information acquisition and synchronization module is used to obtain the latest business configuration information, gray version details, system constraints and performance indicator thresholds in real time through a subscription-publishing mode; The strategy optimization module generates and optimizes the routing strategy of gray traffic based on a genetic algorithm, and represents the routing strategy of gray traffic as a chromosome code, where each gene represents a decision variable, and defines a fitness function to evaluate the pros and cons of each strategy based on the obtained traffic classification results, risk assessment, business configuration information and system constraints, where the fitness function includes business target factors, system performance factors and risk factors, where the formula for the business target factor is: Ys=w UR ×UR i ; Where Ys is the contribution of the business objective factor to the fitness function, w UR is the weight of user retention rate, UR i The predicted user retention rate under the current individual strategy; The formula for the system performance factor is: Xs=-w RT ×RT i -w RU ×RU i ; Where Xs is the contribution of system performance factors to the fitness function, w RT is the weight of response time, w RU is the weight of resource utilization, RT i is the predicted response time under the current individual strategy, RU i is the resource utilization predicted under the current individual strategy; The formula for the risk factor is: F s =-w UCR ×UCR i -w SFR ×SFP i ; where F s is the contribution of risk factors to the fitness function, UCR i is the predicted user complaint rate under the current individual strategy, SFP i is the predicted system failure probability under the current individual strategy, w UCR is the weight of user complaint rate, w SFP is the weight of the system failure probability; Based on the above factors, the comprehensive fitness function is obtained, the formula is: F(i)=w UR ×UR i -w RT ×RT i -w RU ×RU i -w UCR ×UCR i -w SFP ×SFP i ; Where i represents the i-th individual in the population, and F(i) is the fitness value of the individual. Based on the calculation of the fitness value of each individual, the pros and cons of the grayscale traffic strategy are evaluated and decisions are made. The higher F(i), the better the current individual strategy.

5. According to a PaaS-based microservice full-link grayscale traffic management system according to claim 1, it is characterized by: The microservice orchestration and management platform is used to perform fine-grained traffic control and fault isolation on grayscale traffic in grayscale release scenarios according to the routing strategy formulated by ITADH, ensuring that the communication between the grayscale version of microservice instances and the normal version does not interfere with each other, while achieving full-link tracking and monitoring of grayscale traffic for rapid location and resolution of problems.

6. According to a PaaS-based microservice full-link grayscale traffic management system according to claim 1, it is characterized by: The full-link data analysis module includes a data collection module, a data storage and preprocessing module, a data analysis and insight module, and a data visualization and reporting module. The data collection module is used to collect microservice internal data: including method execution data, resource usage data, and service call data; network traffic data: including data packet level information and application layer traffic details; user behavior data collection: including page browsing behavior, interactive operation behavior, and user feedback data; The data storage and preprocessing module is used to preprocess and clean the data, and store real-time data and offline data; The data analysis and insight module includes a real-time data analysis and monitoring module and an offline data analysis and mining module, wherein the real-time data analysis and monitoring module performs real-time analysis and monitoring on real-time data stored in the memory database and message queue based on the real-time stream processing engine, continuously calculates and monitors the key performance indicators of the microservices, including response time, throughput, error rate, and system resource utilization indicators, pre-sets the threshold of the key performance indicators, compares the monitored key performance indicators with the pre-set threshold, and immediately notifies the relevant operation and maintenance personnel and business managers via email, SMS, or system pop-up window when the key performance indicators exceed the threshold range; the offline data analysis and mining module uses big data processing tools and data mining algorithms to perform in-depth analysis and mining on offline data stored in the data warehouse and distributed file system, uses time series analysis and regression analysis to perform trend analysis and prediction on historical business data, and formulates reasonable business strategies and plans based on this, and also includes in-depth analysis of the historical operation data and resource usage data of the microservices, mining potential performance bottlenecks and resource waste, and modeling and analyzing the relationship between the CPU, memory, and other resource utilization of the microservices and the business load in different time periods, finding out the key points where the resource utilization rate rises sharply with the growth of the business load, and determining the performance bottleneck of the system; The data visualization and reporting module uses a combination of visualization tools and open source visualization libraries to create visualization charts and dashboards based on different analysis scenarios and requirements.

7. According to a PaaS-based microservice full-link grayscale traffic management system according to claim 1, it is characterized by: The dynamic security protection and compliance audit module includes an identity authentication and authorization module, a real-time intrusion detection and defense module, a data encryption and desensitization module, and a compliance audit module. The identity authentication and authorization module includes a multi-factor authentication process, including user and system verification, wherein user verification includes user name and password verification and biometric identification; wherein verification between systems adopts an authentication method based on digital certificates. The identity authentication and authorization module also includes authorization verification, which grants corresponding predefined permission sets according to the roles of users and systems. At the same time, an attribute access control mechanism is introduced, and the attributes considered include the user's geographical location, access time, device type, and user behavior characteristics; The real-time intrusion detection and defense module includes traffic monitoring and feature analysis and behavior analysis and anomaly monitoring. The traffic monitoring and feature analysis is based on IDS / IPS sensors deployed at key network nodes to continuously monitor the network traffic flowing into and out of the microservice system, and is used to perform in-depth analysis on each data packet, match and analyze the traffic based on the attack feature library, and defend against it according to the analysis results. Among them, behavioral analysis and anomaly monitoring use behavioral analysis technology to identify potential abnormal behaviors and unknown attacks.

8. According to the PaaS-based microservice full-link grayscale traffic management system of claim 7, it is characterized by: The data encryption and desensitization module is used to desensitize the user's sensitive data. The desensitization process is performed in real time when the data is extracted from the production environment to the test environment, the development environment, and when the data is displayed and shared externally; The compliance audit module includes an audit log record, which is used to record in detail all operation information related to security and compliance. The audit log includes the timestamp of the operation, the operation subject, the operation object, the operation type, the operation result and detailed operation parameters.

9. A PaaS-based microservice full-link grayscale traffic management method, using a PaaS-based microservice full-link grayscale traffic management system as described in any of claims 1-8, characterized in that: The steps include: S1: Collect data from network devices, microservice instances, and front-end applications, including network traffic data, business log data, user behavior data, and system performance indicator data. Clean, convert, and pre-process these data, and integrate them with third-party market data platforms. S2: Security protection strategy, including setting identity authentication and authorization rules, importing attack feature libraries for intrusion detection and defense, establishing data encryption and desensitization rules and key systems, and defining the scope and standards of compliance audits; S3: Determine the business objectives of the grayscale release based on business development needs and market conditions, including testing the user acceptance of new features, evaluating the effectiveness of performance optimization measures, and verifying the stability of system architecture upgrades. Combined with business objectives and system status, formulate a preliminary grayscale release strategy, including the scope of grayscale versions, expected grayscale release time window, selection criteria for target user groups, and setting of key performance indicators. S4: Based on the intelligent traffic analysis and decision-making center module, the traffic flowing into the system is classified and feature-identified, and divided into high-value grayscale traffic, low-value grayscale traffic, and normal business traffic. Based on the user's historical behavior data, business risk assessment, and the current system load, the user traffic with high activity, who may be more interested in new functions and will not have a significant impact on system stability is selected as high-value grayscale traffic, and it is guided to participate in grayscale testing first to obtain more representative and influential user feedback; S5: Generate and optimize the routing strategy of grayscale traffic using genetic algorithms. By simulating the biological evolution process, the initial set of strategies are selected, crossed, and mutated. After multiple generations of evolutionary iterations, the optimal and near-optimal grayscale strategies are gradually found. S6: Based on the microservice orchestration and management platform, the microservice instances are automatically deployed, elastically scaled, and traffic managed. The corresponding computing resources are allocated to the gray version of the microservice instances. Accurate traffic routing rules are configured in the service grid to accurately guide the filtered gray traffic to the target gray version of the microservice instances. At the same time, the isolation and non-interference between normal business traffic and gray traffic are ensured to ensure the overall stability and availability of the system. S7: Perform strict identity authentication and authorization checks on all traffic to prevent illegal access and data leakage risks. Monitor and analyze network traffic based on real-time intrusion detection and defense modules to promptly detect and prevent potential attacks. S8: Build a full-link data view to comprehensively monitor and analyze system performance and business indicators during the grayscale release process. Through real-time monitoring and analysis of microservice response time, throughput, error rate, business process conversion rate, user retention rate, and user satisfaction, timely discover possible performance bottlenecks, business anomalies, and user experience issues in the system, and use visualization tools and dashboards to display these data.

Images