Service flow analysis method and device

Abstract

The invention belongs to the technical field of traffic, and discloses a service traffic analysis method and device. The method comprises the following steps: acquiring business logs of a plurality of businesses, and constructing a plurality of levels of time windows corresponding to the plurality of businesses; for any service, according to the system load index, adjusting the window levels of the time windows of the multiple levels; for any service, determining the fluctuation characteristics of the traffic of the service according to the service log, and adjusting the window levels of the multiple levels of time windows according to the fluctuation characteristics; for the time window of any level, determining a service basic index and a service composite index in the time range of the previous time window according to the service log; and for any service, determining whether the service is abnormal or not according to the service basic index and the service composite index of the time window of each level, and if so, outputting an abnormal alarm. By adopting the method, the real-time performance of service detection can be improved by dynamically adjusting and analyzing the size of the time window.

Description

Technical Field

[0001] This application relates to the technical field of traffic, and particularly to a method and device for traffic analysis of services. Background Art

[0002] In Internet applications, traffic analysis of services is a basic and crucial task. In the prior art, the method of traffic analysis is to use a fixed time window to perform statistics and analysis on services. For example, the traffic of services within 1 minute, 5 minutes, or 1 hour is statistically analyzed. However, at a certain moment, the traffic of a service suddenly becomes extremely high. The sudden increase in traffic may cause pressure on the system and result in anomalies. And when sudden traffic is detected, an alarm needs to be issued as soon as possible. If the sudden traffic of the service is missed and no alarm is given, it will cause greater problems. Therefore, there is an urgent need for a method for traffic analysis of services to improve the real-time detection of sudden traffic. Summary of the Invention

[0003] Based on this, in view of the above technical problems, it is necessary to provide a method and device for traffic analysis of services.

[0004] In a first aspect, a method for traffic analysis of services is provided. The method includes: Obtain service logs of multiple services, and construct multiple levels of time windows corresponding to each of the multiple services; For any service, obtain the system load metrics of the service, and adjust the window levels of the multiple levels of time windows according to the system load metrics; For any service, determine the fluctuation characteristics of the traffic of the service according to the service log, and adjust the window levels of the multiple levels of time windows according to the fluctuation characteristics; For any level of time window, within the time range of the time window, determine the service basic metrics and service composite metrics within the time range of the previous time window according to the request data in the service log; For any service, determine whether the service is abnormal according to the service basic metrics and service composite metrics of each level of time window. If the service is abnormal, output an abnormal alarm.

[0005] As an optional implementation, the system load metrics include CPU usage rate, memory usage rate, and number of requests. The obtaining the system load metrics of the service and adjusting the window levels of the multiple levels of time windows according to the system load metrics includes: Obtain the CPU usage rate and the memory usage rate of the service through a system interface, and determine the number of requests of the service according to the service log; When the CPU usage rate is greater than the preset CPU usage rate threshold, the memory usage rate is greater than the preset memory usage rate threshold, or the number of requests is greater than the preset number of requests threshold, reduce the window level of the time windows at multiple levels; When the CPU usage rate is less than or equal to the preset CPU usage rate threshold, the memory usage rate is less than or equal to the preset memory usage rate threshold, and the number of requests is less than or equal to the preset number of requests threshold, increase the window level of the time windows at multiple levels.

[0006] As an alternative implementation, the system load metrics include the CPU usage rate, the memory usage rate, and the number of requests. Adjusting the window level of the time windows at multiple levels according to the system load metrics includes: Determine the sum of the product of the CPU usage rate and the preset CPU usage rate weight coefficient, the product of the memory usage rate and the preset memory usage rate weight coefficient, and the product of the number of requests and the preset number of requests weight coefficient as the target system load metric; If the target system load metric is greater than the preset system load metric threshold, reduce the window level of the time windows at multiple levels; If the target system load metric is less than or equal to the preset system load metric threshold, increase the window level of the time windows at multiple levels.

[0007] As an alternative implementation, the fluctuation characteristics include stable, fluctuating, and sudden. Adjusting the window level of the time windows at multiple levels according to the fluctuation characteristics includes: When the fluctuation characteristic is stable, increase the window level of the time windows at multiple levels; When the fluctuation characteristic is fluctuating or sudden, reduce the window level of the time windows at multiple levels.

[0008] As an alternative implementation, determining whether the service is abnormal according to the service basic metrics and service composite metrics of the time windows at each level includes: Compare the service basic metrics of the time windows at each level with the preset service basic metric threshold, and the service composite metrics with the preset service composite metric threshold to determine whether the service is abnormal.

[0009] As an alternative implementation, determining whether the service is abnormal according to the service basic metrics and service composite metrics of the time windows at each level includes: Set corresponding level weights for the time windows at different levels, and determine the sum of the products of the service basic metrics of the time windows at all levels and the corresponding level weights as the target basic metric; Determine the target composite metric as the sum of the products of the business composite metrics of time windows at all levels and the corresponding level weights; Compare the target basic metric and the preset target basic metric threshold, and the target composite metric and the preset target composite metric threshold, to determine whether the business is abnormal.

[0010] In a second aspect, a device for traffic analysis of a business is provided. The device includes: An acquisition module, configured to acquire business logs of multiple businesses and construct time windows at multiple levels corresponding to each of the multiple businesses; An obtaining module, configured to, for any one business, obtain the system load metric of the business and adjust the window levels of the time windows at the multiple levels according to the system load metric; A first determination module, configured to, for any one business, determine the fluctuation characteristics of the traffic of the business according to the business log and adjust the window levels of the time windows at the multiple levels according to the fluctuation characteristics; A second determination module, configured to, for the time window at any level, determine the business basic metric and the business composite metric within the time range of the previous time window according to the request data in the business log within the time range of the time window; A third determination module, configured to, for any one business, determine whether the business is abnormal according to the business basic metric and the business composite metric of the time windows at each level. If the business is abnormal, an abnormal alarm is output.

[0011] As an optional implementation manner, the system load metric includes CPU usage rate, memory usage rate, and number of requests. The obtaining module is specifically configured to: Obtain the CPU usage rate and the memory usage rate of the business through a system interface, and determine the number of requests of the business according to the business log; When the CPU usage rate is greater than the preset CPU usage rate threshold, the memory usage rate is greater than the preset memory usage rate threshold, or the number of requests is greater than the preset number of requests threshold, reduce the window levels of the time windows at the multiple levels; When the CPU usage rate is less than or equal to the preset CPU usage rate threshold, the memory usage rate is less than or equal to the preset memory usage rate threshold, and the number of requests is less than or equal to the preset number of requests threshold, increase the window levels of the time windows at the multiple levels.

[0012] As an optional implementation manner, the system load metric includes CPU usage rate, memory usage rate, and number of requests. The obtaining module is specifically configured to: Determine the sum of the product of the CPU usage rate and the preset CPU usage rate weight coefficient, the product of the memory usage rate and the preset memory usage rate weight coefficient, and the product of the number of requests and the preset number of requests weight coefficient as the target system load index; If the target system load index is greater than the preset system load index threshold, lower the window level of the time windows at multiple levels; If the target system load index is less than or equal to the preset system load index threshold, raise the window level of the time windows at multiple levels.

[0013] As an optional implementation manner, the fluctuation characteristics include stable, fluctuating, and sudden. The first determination module is specifically configured to: When the fluctuation characteristic is stable, raise the window level of the time windows at multiple levels; When the fluctuation characteristic is fluctuating or sudden, lower the window level of the time windows at multiple levels.

[0014] As an optional implementation manner, the third determination module is specifically configured to: Compare the service basic index and the preset service basic index threshold, and the service composite index and the preset service composite index threshold of the time windows at each level to determine whether the service is abnormal.

[0015] As an optional implementation manner, the third determination module is specifically configured to: Set corresponding level weights for the time windows at different levels, and determine the sum of the products of the service basic indexes of the time windows at all levels and the corresponding level weights as the target basic index; Determine the sum of the products of the service composite indexes of the time windows at all levels and the corresponding level weights as the target composite index; Compare the target basic index and the preset target basic index threshold, and the target composite index and the preset target composite index threshold to determine whether the service is abnormal.

[0016] In a third aspect, a system for traffic analysis of a service is provided. The system for traffic analysis of the service includes: the method for traffic analysis of the service as described in the first aspect and the device for traffic analysis of the service as described in the second aspect.

[0017] In a fourth aspect, a computer device is provided, including a memory and a processor. A computer program that can run on the processor is stored on the memory. When the processor executes the computer program, the method steps as described in the first aspect are implemented.

[0018] Fifth aspect, there is provided a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the method steps described in the first aspect are implemented.

[0019] This application provides a method for traffic analysis of services. The technical solutions provided by the embodiments of this application at least bring the following beneficial effects: obtaining service logs of multiple services, and constructing multiple levels of time windows corresponding to each of the multiple services; for any service, obtaining the system load index of the service, and adjusting the window levels of the multiple levels of time windows according to the system load index; for any service, determining the fluctuation characteristics of the traffic of the service according to the service log, and adjusting the window levels of the multiple levels of time windows according to the fluctuation characteristics; for any level of time window, within the time range of the time window, determining the service basic index and service composite index within the time range of the previous time window according to the request data in the service log; for any service, determining whether the service is abnormal according to the service basic index and service composite index of each level of time window, and if the service is abnormal, outputting an abnormal alarm. In this way, an adaptive time window traffic analysis method according to the system load index and the fluctuation characteristics of the traffic dynamically adjusts the time window size, realizes multi-level traffic monitoring, significantly improves the adaptability and accuracy of traffic analysis, can respond in real time to the dynamic changes of network traffic, and improves the real-time detection of bursty traffic. By dynamically adjusting the time window size, it can adapt to the time granularity requirements of different service scenarios and will not miss bursty abnormal traffic.

[0020] It should be understood that the above general description and the following detailed description are only exemplary and explanatory, and cannot limit this application. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings required for the description of the embodiments or the prior art. Obviously, the drawings in the following description are only some embodiments of the present invention, and those of ordinary skill in the art can obtain other drawings without creative efforts based on these drawings.

[0022] Figure 1 It is a schematic structural diagram of a system for traffic analysis of a service provided by an embodiment of this application; Figure 2 It is a flowchart of a method for traffic analysis of a service provided by an embodiment of this application; Figure 3 It is a schematic structural diagram of a device for traffic analysis of a service provided by an embodiment of this application; Figure 4Schematic diagram of a computer device provided by an embodiment of the present application. Detailed implementation manners

[0023] In order to make the objectives, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application, but not to limit the present application.

[0024] The method for traffic analysis of services provided by an embodiment of the present application can be applied to a traffic analysis system for services. As Figure 1 shown, the traffic analysis system for services includes a server 101 and a client 102. The server 101 is connected to the client 102.

[0025] The server 101 is configured to execute a program corresponding to a service after receiving a service request sent by the client 102. Obtain service logs of multiple services, and construct multiple levels of time windows corresponding to each service among the multiple services. For any service, obtain the system load index of the service, and adjust the window levels of the multiple levels of time windows according to the system load index. For any service, determine the fluctuation characteristics of the traffic of the service according to the service log, and adjust the window levels of the multiple levels of time windows according to the fluctuation characteristics. For any level of time window, within the time range of the time window, determine the service basic index and service composite index within the time range of the previous time window according to the request data in the service log. For any service, determine whether the service is abnormal according to the service basic index and service composite index of each level of time window. If the service is abnormal, output an abnormal alarm.

[0026] The client 102 is configured to send a service request to the server 101.

[0027] Next, a method for traffic analysis of a service provided by an embodiment of the present application will be described in detail in combination with the specific implementation manners. Figure 2 It is a flowchart of a method for traffic analysis of a service provided by an embodiment of the present application. As Figure 2 shown, the specific steps are as follows: Step 201, obtain service logs of multiple services, and construct multiple levels of time windows corresponding to each service among the multiple services.

[0028] In implementation, in the prior art, the traffic of services is statistically analyzed through a fixed time window. However, the fixed time window may miss the sudden abnormal traffic of services. Traffic analysis is to analyze the data collected during the operation of services through a periodic time window. Then, multiple time windows corresponding to each service in multiple services can be constructed. Through the multiple-level time windows, the traffic with different time spans can be detected and analyzed. At the beginning, the smallest statistical time unit needs to be set, and the time unit can be 1 second or 1 minute. Different-level time windows contain different numbers of time units. The higher the level, the more time units are included, that is, the larger the time span. The size of the time range of each level of time window can be a multiple of the size of the time range of the next-level time window. In this way, the traffic monitoring of multi-level time windows can be realized. The subsequent steps can also dynamically adjust the size of the time range of the time window according to service data, realize multi-level traffic monitoring, and improve the accuracy and real-time performance of anomaly detection. Then, it is necessary to obtain the service logs of multiple services, and the service logs contain service data. For example, the time unit is set to 1 minute, and 3 levels of time windows are set: level 1, 1 time unit, corresponding time window is 1 minute; level 2, 5 time units, corresponding time window is 5 minutes; level 3, 30 time units, corresponding time window is 30 minutes.

[0029] Step 202, for any service, obtain the system load index of the service, and adjust the window levels of multiple levels of time windows according to the system load index.

[0030] In implementation, for any one of multiple services, obtain the system load index of the service. Since the system load indexes of services are different, the required time ranges of time windows are different. The size of the time range of the analysis time window can be dynamically adjusted according to the system load index. Since different-level time windows contain different numbers of time units, the window levels of multiple levels of time windows can be adjusted according to the system load index. Among them, the system load index includes CPU usage rate, memory usage rate, and number of requests, etc. Among them, adjusting the window levels of multiple levels of time windows can be an increase or decrease in the number of window levels or a change in the total number of windows. For a certain time window, a change in level means a change in the number of time units it contains.

[0031] Furthermore, the system load index includes CPU usage rate, memory usage rate, and number of requests. Specifically, the specific steps for executing step 202 are as follows: Step 1, obtain the CPU usage rate and memory usage rate of the service through the system interface, and determine the number of requests of the service according to the service log.

[0032] In implementation, since the system load metrics of the service are different, the time ranges of the required time windows are also different. Before adjusting the window levels of the time windows at multiple levels according to the system load metrics, it is necessary to first obtain the system load metrics of the service. The CPU usage rate and memory usage rate of the service can be obtained through the system interface, and the number of requests of the service can be determined based on the service logs.

[0033] Step 2: When the CPU usage rate is greater than the preset CPU usage rate threshold, the memory usage rate is greater than the preset memory usage rate threshold, or the number of requests is greater than the preset number of requests threshold, reduce the window levels of the time windows at multiple levels.

[0034] In implementation, the higher the window level of the time window, the longer the time span, and the greater the resources consumed for traffic analysis. When the system load of the service is too high, it is necessary to reduce the system load. Therefore, when the system load is high, in order to reduce resource consumption and maintain the stability of the system, it is necessary to reduce the window level and shorten the time span of the time window. Therefore, when the CPU usage rate, memory usage rate, and number of requests are obtained, compare the CPU usage rate with the preset CPU usage rate threshold, the memory usage rate with the preset memory usage rate threshold, and the number of requests with the preset number of requests threshold. When the CPU usage rate is greater than the preset CPU usage rate threshold, the memory usage rate is greater than the preset memory usage rate threshold, or the number of requests is greater than the preset number of requests threshold, that is, when one of the system load metrics is too high, it indicates that the system load is high. At this time, the window levels of the time windows at multiple levels can be reduced.

[0035] Step 3: When the CPU usage rate is less than or equal to the preset CPU usage rate threshold, the memory usage rate is less than or equal to the preset memory usage rate threshold, and the number of requests is less than or equal to the preset number of requests threshold, increase the window levels of the time windows at multiple levels.

[0036] In implementation, when the system load of the service is too low, the system load can be appropriately increased. The lower the window level of the time window, the shorter the time span, and the fewer resources consumed for traffic analysis. Therefore, when the system load is low, the resource consumption can be appropriately increased, and it is necessary to increase the window level and increase the time span of the time window. Therefore, when the CPU usage rate, memory usage rate, and number of requests are obtained, compare the CPU usage rate with the preset CPU usage rate threshold, the memory usage rate with the preset memory usage rate threshold, and the number of requests with the preset number of requests threshold. When the CPU usage rate is less than or equal to the preset CPU usage rate threshold, the memory usage rate is less than or equal to the preset memory usage rate threshold, and the number of requests is less than or equal to the preset number of requests threshold, that is, when all system load metrics are low, it indicates that the system load is low. At this time, the window levels of the time windows at multiple levels can be increased.

[0037] Further, according to the system load index, another adjustment step for adjusting the window levels of multiple levels of time windows is as follows: Step 4: Determine the target system load index as the sum of the product of the CPU usage rate and the preset CPU usage rate weight coefficient, the product of the memory usage rate and the preset memory usage rate weight coefficient, and the product of the number of requests and the preset number of requests weight coefficient.

[0038] In implementation, during the execution of multiple services in the server, the CPU usage rate, memory usage rate, and number of requests corresponding to different services are different. The corresponding weight coefficients can be set for the CPU usage rate, memory usage rate, and number of requests according to different services. When adjusting the window levels of multiple levels of time windows according to the system load index, the sum of the product of the CPU usage rate and the preset CPU usage rate weight coefficient, the product of the memory usage rate and the preset memory usage rate weight coefficient, and the product of the number of requests and the preset number of requests weight coefficient can be determined as the target system load index, and then the window size of the time window can be adapted according to the target system load index.

[0039] Step 5: If the target system load index is greater than the preset system load index threshold, lower the window levels of multiple levels of time windows.

[0040] In implementation, compare the target system load index with the preset system load index threshold. If the target system load index is greater than the preset system load index threshold and the system load needs to be reduced, then lower the window levels of multiple levels of time windows.

[0041] Step 6: If the target system load index is less than or equal to the preset system load index threshold, raise the window levels of multiple levels of time windows.

[0042] In implementation, compare the target system load index with the preset system load index threshold. If the target system load index is less than or equal to the preset system load index threshold and the system load can be appropriately increased, then raise the window levels of multiple levels of time windows.

[0043] Step 203: For any service, determine the fluctuation characteristics of the traffic of the service according to the service log, and adjust the window levels of multiple levels of time windows according to the fluctuation characteristics.

[0044] In implementation, for any service, a technical algorithm is used to determine the fluctuation characteristics of the traffic of the service according to the service logs. Among them, the technical algorithm can be the coefficient of variation or the interquartile range, etc. For different services, the fluctuation characteristics of the traffic correspond to different sizes of the time ranges of the required time windows. The fluctuation characteristics include stable, fluctuating, and sudden. When the data of the fluctuation characteristics of the traffic changes from fluctuating or sudden to relatively stable, a coarser-grained analysis can be performed, that is, the number of time units of the time window increases and the level becomes higher. When the data of the fluctuation characteristics of the traffic changes from stable to relatively fluctuating or sudden, a finer-grained analysis can be performed. Therefore, the window levels of multiple levels of time windows can be adjusted according to the fluctuation characteristics. Among them, adjusting the window levels of multiple levels of time windows can be an increase or decrease in the number of window levels or a change in the total number of windows. For a certain time window, a change in level means a change in the number of time units it contains.

[0045] Further, the specific process of executing step 203 is as follows: Step A, when the fluctuation characteristic is stable, increase the window levels of multiple levels of time windows.

[0046] In implementation, for different services, the fluctuation characteristics of the traffic correspond to different sizes of time windows. When the fluctuation characteristic is stable, a coarser-grained analysis can be performed on the service, and the window levels of multiple levels of time windows can be increased.

[0047] Step B, when the fluctuation characteristic is fluctuating or sudden, decrease the window levels of multiple levels of time windows.

[0048] In implementation, for different services, the fluctuation characteristics of the traffic correspond to different sizes of time windows. When the fluctuation characteristic is fluctuating or sudden, a finer-grained analysis can be performed on the service, and the window levels of multiple levels of time windows can be decreased.

[0049] Step 204, for any level of time window, within the time range of this time window, according to the request data in the service logs, determine the service basic indicators and service composite indicators within the time range of the previous time window.

[0050] In implementation, for any level of time window, within the time range of this time window, according to the request data in the service logs, determine the service basic indicators and service composite indicators within the time range of the previous time window. The traffic analysis of the service is to determine the service basic indicators and service composite indicators of the service and analyze the service basic indicators and service composite indicators. Among them, the service basic indicators include the request volume, error rate, response time, and service indicators, etc. The composite indicators are the year-on-year, month-on-month, and change rates of the request volume, error rate, response time, and service indicators. The service basic indicators can also be obtained from the server through an interface.

[0051] Step 205: For any service, determine whether the service is abnormal according to the service basic metrics and service composite metrics of the time windows at each level. If the service is abnormal, output an abnormal alarm.

[0052] In implementation, after determining the service basic metrics and service composite metrics of the time windows at each level, for any service, the traffic of the service can be determined for abnormality according to the service basic metrics and service composite metrics of the time windows at each level. For example, through the request volume, error rate, response time, and service metrics, as well as the year-on-year, month-on-month, and change rate of the request volume, error rate, response time, and service metrics, the traffic of the service is analyzed for abnormality to determine whether the service is abnormal. If the service is abnormal, output an abnormal alarm.

[0053] Further, the process of executing Step 205 is: compare the service basic metrics of the time windows at each level with the preset service basic metric thresholds, and compare the service composite metrics with the preset service composite metric thresholds to determine whether the service is abnormal.

[0054] In implementation, compare the service basic metrics of the time windows at each level with the preset service basic metric thresholds, and compare the service composite metrics with the preset service composite metric thresholds. If the service basic metric is greater than the preset service basic metric threshold, or the service composite metric is greater than the preset service composite metric threshold, then determine that the service is abnormal. Or if the service basic metric is less than or equal to the preset service basic metric threshold, or the service composite metric is less than the preset service composite metric threshold, then determine that the service is abnormal. Specifically, whether it is greater than or equal to or less than needs to be determined according to the specific metrics. For example, when the error rate is greater than the error rate threshold, determine that the service is abnormal; when the year-on-year of the error rate indicates that the error rate becomes smaller and the year-on-year of the error rate is less than the preset year-on-year error rate threshold, determine that the service is abnormal. Among them, the thresholds corresponding to different levels are different. Because the time span corresponding to the time window at the lower level is smaller than the time span corresponding to the time window at the higher level, generally speaking, its quantity is less. At this time, the error rate threshold is different from that of other levels.

[0055] Further, the specific process of determining whether the service is abnormal according to the service basic metrics and service composite metrics of the time windows at each level can also be the following process: Step a: Set corresponding level weights for the time windows at different levels, and determine the target basic metric as the sum of the products of the service basic metrics of the time windows at all levels and the corresponding level weights.

[0056] In implementation, corresponding hierarchical weights can be set for time windows at different levels, and the sum of the products of the business basic indicators of time windows at each level and the corresponding hierarchical weights is determined as the target basic indicator of the business. Among them, the hierarchical weights can be determined according to the size of the time window and the granularity of analysis. For time windows at lower levels with fine-grained analysis, the corresponding hierarchical weights can be set a bit larger; for time windows at higher levels with coarse-grained analysis, the corresponding hierarchical weights can be set a bit smaller. However, there are some levels regarded as core levels, and their weights are the largest. These levels are neither the lowest nor the highest.

[0057] Step b: Determine the target composite indicator as the sum of the products of the business composite indicators of time windows at all levels and the corresponding hierarchical weights.

[0058] In implementation, the sum of all products of the business composite indicators of time windows at each level and the corresponding hierarchical weights is determined as the target composite indicator of the business. Subsequently, only based on the target basic indicator and the target composite indicator, it is determined whether the traffic of the business is abnormal.

[0059] Step c: Compare the target basic indicator with the preset target basic indicator threshold, and the target composite indicator with the preset target composite indicator threshold to determine whether the business is abnormal.

[0060] In implementation, compare the target basic indicator with the preset target basic indicator threshold, and the target composite indicator with the preset target composite indicator threshold. If the target basic indicator is greater than the preset target basic indicator threshold and the target composite indicator is greater than the preset target composite indicator threshold, determine that the business is abnormal. Or if the target basic indicator is less than or equal to the preset target basic indicator threshold and the target composite indicator is less than or equal to the preset target composite indicator threshold, determine that the business is abnormal.

[0061] For example, a) Define the basic time unit as 1 second. b) Set up 5 layers of time windows, and the corresponding time windows are as follows: level 1 window, with a time window of 10 seconds; level 2 window, with a time window of 30 seconds; level 3 window, with a time window of 60 seconds; level 4 window, with a time window of 300 seconds; level 5 window, with a time window of 600 seconds. And so on. c) Set the system load metric thresholds: HIGH_THRESHOLD, LOW_THRESHOLD. d) Obtain the data of the current system load metric through interfaces or other means, and calculate a target system load metric S. When S > HIGH_THRESHOLD, lower the level of the time window; when S < LOW_THRESHOLD, raise the level of the time window. e) Set the window levels of the time windows under different traffic fluctuation characteristics: stable: level 5 window; fluctuating: level 3 window; abrupt change: level 1 window. f) Obtain the current traffic fluctuation characteristics through interfaces or other means, and automatically adjust the window level. g) According to the time range corresponding to the current time window, count the basic service metrics and composite service metrics within the corresponding time range. h) Perform anomaly detection according to the set various thresholds, such as giving an anomaly alarm when the response time exceeds the threshold. Or, perform multi-level data collaborative detection, additionally calculate the data of the upper and lower levels of the current level, and finally obtain the final data through weighted calculation, and compare this data with the threshold. When determining the traffic anomaly of the service, output an anomaly alarm.

[0062] The embodiment of the present application provides a method for traffic analysis of services, which significantly improves the adaptability and accuracy of traffic analysis, can respond to the dynamic changes of network traffic in real time, reduces the consumption of computing resources, and efficiently utilizes resources. The traffic analysis method with an adaptive time window can achieve multi-level traffic monitoring by dynamically adjusting the size of the analysis window, can adapt to the time granularity requirements of different service scenarios, will not miss sudden abnormal traffic, and can dynamically adjust storage and computing resources according to actual needs to balance the requirements of real-time and accuracy.

[0063] It should be understood that although Figure 2 the steps in the flowchart of Figure 2 are shown in sequence according to the indication of the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless there is a clear indication in this article, the execution of these steps has no strict order limit, and these steps can be executed in other orders. Moreover,

[0064] It can be understood that the same / similar parts among the various embodiments of the above methods in this specification can be referred to each other. Each embodiment focuses on the differences from other embodiments. For the relevant parts, refer to the descriptions of other method embodiments.

[0065] The embodiment of the present application also provides a device for traffic analysis of services, as Figure 3 shown. The device includes: An acquisition module 301, configured to acquire service logs of multiple services and construct multiple levels of time windows corresponding to each of the multiple services; An obtaining module 302, configured to, for any one service, obtain the system load index of the service, and adjust the window levels of the multiple levels of time windows according to the system load index; A first determination module 303, configured to, for any one service, determine the fluctuation characteristics of the traffic of the service according to the service log, and adjust the window levels of the multiple levels of time windows according to the fluctuation characteristics; A second determination module 304, configured to, for any level of time window, within the time range of the time window, determine the service basic index and service composite index within the time range of the previous time window according to the request data in the service log; A third determination module 305, configured to, for any one service, determine whether the service is abnormal according to the service basic index and service composite index of each level of time window. If the service is abnormal, an abnormal alarm is output.

[0066] As an optional implementation manner, the system load index includes CPU usage rate, memory usage rate, and number of requests. The obtaining module 302 is specifically configured to: Obtain the CPU usage rate and the memory usage rate of the service through a system interface, and determine the number of requests of the service according to the service log; When the CPU usage rate is greater than a preset CPU usage rate threshold, the memory usage rate is greater than a preset memory usage rate threshold, or the number of requests is greater than a preset number of requests threshold, reduce the window levels of the multiple levels of time windows; When the CPU usage rate is less than or equal to the preset CPU usage rate threshold, the memory usage rate is less than or equal to the preset memory usage rate threshold, and the number of requests is less than or equal to the preset number of requests threshold, increase the window levels of the multiple levels of time windows.

[0067] As an optional implementation manner, the system load index includes CPU usage rate, memory usage rate, and number of requests. The obtaining module 302 is specifically configured to: Determine the sum of the product of the CPU usage rate and the preset CPU usage rate weight coefficient, the product of the memory usage rate and the preset memory usage rate weight coefficient, and the product of the number of requests and the preset number of requests weight coefficient as the target system load indicator; If the target system load indicator is greater than the preset system load indicator threshold, reduce the window level of the time windows at multiple levels; If the target system load indicator is less than or equal to the preset system load indicator threshold, increase the window level of the time windows at multiple levels.

[0068] As an alternative implementation, the fluctuation characteristics include stable, fluctuating, and sudden. The first determination module 303 is specifically configured to: When the fluctuation characteristic is stable, increase the window level of the time windows at multiple levels; When the fluctuation characteristic is fluctuating or sudden, reduce the window level of the time windows at multiple levels.

[0069] As an alternative implementation, the third determination module 305 is specifically configured to: Compare the service basic indicator and the preset service basic indicator threshold of the time windows at each level, and the service composite indicator and the preset service composite indicator threshold, to determine whether the service is abnormal.

[0070] As an alternative implementation, the third determination module 305 is specifically configured to: Set corresponding level weights for the time windows at different levels, and determine the sum of the products of the service basic indicators of the time windows at all levels and the corresponding level weights as the target basic indicator; Determine the sum of the products of the service composite indicators of the time windows at all levels and the corresponding level weights as the target composite indicator; Compare the target basic indicator and the preset target basic indicator threshold, and the target composite indicator and the preset target composite indicator threshold, to determine whether the service is abnormal.

[0071] The embodiment of the present application provides a device for traffic analysis of services, which significantly improves the adaptability and accuracy of traffic analysis, can respond to the dynamic changes of network traffic in real time, reduces the consumption of computing resources, and efficiently utilizes resources. The traffic analysis method with an adaptive time window can realize multi-level traffic monitoring by dynamically adjusting the analysis window size, can adapt to the time granularity requirements of different service scenarios, will not miss sudden abnormal traffic, and can dynamically adjust storage and computing resources according to actual needs to balance the requirements of real-time and accuracy.

[0072] For the specific limitations of the device for traffic analysis of services, reference may be made to the limitations of the method for traffic analysis of services in the foregoing text, which will not be elaborated herein. Each module in the above-mentioned device for traffic analysis of services can be implemented in whole or in part by software, hardware, and their combination. The above-mentioned modules can be embedded in the processor of the computer device in the form of hardware or be independent of it, or can be stored in the memory of the computer device in the form of software, so as to facilitate the processor to call and execute the operations corresponding to each of the above-mentioned modules.

[0073] In one embodiment, a computer device is provided, as Figure 4 shown, including a memory and a processor. A computer program that can run on the processor is stored on the memory. When the processor executes the computer program, the method steps for traffic analysis of the above-mentioned services are implemented.

[0074] In one embodiment, a computer-readable storage medium has a computer program stored thereon. When the computer program is executed by the processor, the steps of the method for traffic analysis of the above-mentioned services are implemented.

[0075] Those of ordinary skill in the art can understand that all or part of the processes in the methods of the above-mentioned embodiments can be completed by instructing relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to a memory, storage, database, or other medium used in the various embodiments provided in the present application can include non-volatile and / or volatile memories. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or an external cache. By way of illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and Rambus dynamic RAM (RDRAM), etc.

[0076] It should be noted that in this text, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements not only includes those elements, but also includes other elements not expressly listed, or also includes elements inherent to such process, method, article or device. Without further limitation, an element defined by the statement "comprising one..." does not exclude the existence of additional identical elements in the process, method, article or device comprising the said element.

[0077] It should also be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for display, data for analysis, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0078] Each embodiment in this specification is described in a related manner. The same or similar parts among the embodiments can be referred to each other, and the differences between each embodiment and other embodiments are emphasized. In particular, for system embodiments, since they are basically similar to method embodiments, the description is relatively simple, and the relevant parts can be referred to the description of the method embodiments.

[0079] The technical features of the above embodiments can be combined arbitrarily. For the sake of brevity of description, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, it should be considered as within the scope described in this specification.

[0080] The above-described embodiments only represent several implementation manners of this application. The description is relatively specific and detailed, but it should not be construed as a limitation on the scope of the invention patent. It should be noted that for those of ordinary skill in the art, without departing from the concept of this application, several modifications and improvements can still be made, and these all belong to the protection scope of this application. Therefore, the protection scope of the patent of this application shall be subject to the appended claims.

Claims

1. A method for analyzing traffic of a service, characterized in that: The method comprises: Obtain business logs of multiple businesses, and construct multiple levels of time windows corresponding to each of the multiple businesses; For any business, a system load indicator of the business is obtained, and according to the system load indicator, the window levels of the multiple levels of time windows are adjusted; For any business, determine the fluctuation characteristics of the traffic of the business according to the business log, and adjust the window levels of the multiple levels of time windows according to the fluctuation characteristics; For a time window at any level, within the time range of the time window, determine the business basic indicators and business composite indicators within the time range of the previous time window according to the request data in the business log; For any business, determine whether the business is abnormal based on the business basic indicators and business composite indicators of the time windows at each level. If the business is abnormal, output an abnormal alarm.

2. The method according to claim 1, characterized in that The system load indicator includes CPU usage, memory usage and number of requests, and obtaining the system load indicator of the service and adjusting the window levels of the multiple levels of time windows according to the system load indicator include: Obtaining the CPU usage and the memory usage of the service through a system interface, and determining the number of requests for the service according to the service log; When the CPU usage is greater than a preset CPU usage threshold, the memory usage is greater than a preset memory usage threshold, or the number of requests is greater than a preset request number threshold, lowering the window level of the multiple levels of time windows; When the CPU usage is less than or equal to the preset CPU usage threshold, the memory usage is less than or equal to the preset memory usage threshold, and the number of requests is less than or equal to the preset request number threshold, the window level of the multiple levels of time windows is increased.

3. The method according to claim 1, characterized in that The system load indicator includes CPU usage, memory usage and number of requests, and adjusting the window levels of the multiple levels of time windows according to the system load indicator includes: The sum of the product of the CPU usage rate and a preset CPU usage rate weight coefficient, the product of the memory usage rate and a preset memory usage rate weight coefficient, and the product of the number of requests and a preset number of requests weight coefficient is determined as the target system load indicator; If the target system load index is greater than a preset system load index threshold, lowering the window level of the multiple levels of time windows; If the target system load index is less than or equal to the preset system load index threshold, the window level of the multiple levels of time windows is increased.

4. The method according to claim 1, characterized in that: The fluctuation characteristics include smoothness, fluctuation and burst, and adjusting the window levels of the multiple levels of time windows according to the fluctuation characteristics includes: When the fluctuation characteristic is the stability, increasing the window level of the multiple levels of time windows; When the fluctuation feature is the fluctuation or the burst, the window level of the multiple levels of time windows is reduced.

5. The method according to claim 1, characterized in that Determining whether the business is abnormal based on the business basic indicators and business composite indicators of the time windows at each level includes: The business basic indicator of each level of the time window is compared with the preset business basic indicator threshold, and the business composite indicator is compared with the preset business composite indicator threshold to determine whether the business is abnormal.

6. The method according to claim 1, characterized in that Determining whether the business is abnormal based on the business basic indicators and business composite indicators of the time windows at each level includes: Set corresponding hierarchical weights for time windows at different levels, and determine the sum of the products of the business basic indicators of time windows at all levels and the corresponding hierarchical weights as the target basic indicators; The sum of the product of the business composite index of the time window of all levels and the corresponding level weight is determined as the target composite index; The target basic indicator is compared with a preset target basic indicator threshold, and the target composite indicator is compared with a preset target composite indicator threshold to determine whether the service is abnormal.

7. A device for analyzing traffic of a service, characterized in that: The device comprises: An acquisition module, used to acquire business logs of multiple businesses and construct multiple levels of time windows corresponding to each of the multiple businesses; An acquisition module, used for acquiring a system load index of any business, and adjusting the window levels of the multiple levels of time windows according to the system load index; A first determination module is used to determine, for any business, the fluctuation characteristics of the traffic of the business according to the business log, and adjust the window levels of the multiple levels of time windows according to the fluctuation characteristics; A second determination module is used to determine, for a time window at any level, within a time range of the time window, a business basic indicator and a business composite indicator within a time range of a previous time window according to the request data in the business log; The third determination module is used to determine whether any business is abnormal according to the business basic indicators and business composite indicators of the time windows at each level, and output an abnormal alarm if the business is abnormal.

8. The device according to claim 7, characterized in that The system load indicators include CPU usage, memory usage and number of requests. The acquisition module is specifically used to: Obtaining the CPU usage and the memory usage of the service through a system interface, and determining the number of requests for the service according to the service log; When the CPU usage is greater than a preset CPU usage threshold, the memory usage is greater than a preset memory usage threshold, or the number of requests is greater than a preset request number threshold, lowering the window level of the multiple levels of time windows; When the CPU usage is less than or equal to the preset CPU usage threshold, the memory usage is less than or equal to the preset memory usage threshold, and the number of requests is less than or equal to the preset request number threshold, the window level of the multiple levels of time windows is increased.

9. The device according to claim 7, characterized in that The system load indicators include CPU usage, memory usage and number of requests. The acquisition module is specifically used to: The sum of the product of the CPU usage rate and a preset CPU usage rate weight coefficient, the product of the memory usage rate and a preset memory usage rate weight coefficient, and the product of the number of requests and a preset number of requests weight coefficient is determined as the target system load indicator; If the target system load index is greater than a preset system load index threshold, lowering the window level of the multiple levels of time windows; If the target system load index is less than or equal to the preset system load index threshold, the window level of the multiple levels of time windows is increased.

10. The device according to claim 7, characterized in that The fluctuation characteristics include stability, fluctuation and suddenness. The first determination module is specifically used to: When the fluctuation characteristic is the stability, increasing the window level of the multiple levels of time windows; When the fluctuation feature is the fluctuation or the burst, the window level of the multiple levels of time windows is reduced.

Images