Abnormal resource processing method, device, system, electronic device and storage medium

Abstract

The present application relates to an abnormal resource processing method, device, system, electronic device and storage medium, wherein the abnormal resource processing method includes: obtaining abnormal resource data, and storing the abnormal resource data in a preset time series database; wherein the time series in the time series database matches the abnormal resource data; obtaining the first abnormal resource data of the current time series from the time series database, inputting the first abnormal resource data into a fully trained LSTM neural network model, and outputting the momentum threshold prediction result of the current time; comparing the first abnormal resource data with the momentum threshold prediction result of the current time, and performing a firewall operation on the first abnormal resource data according to the comparison result. Through the present application, the problem of low accuracy and efficiency in abnormal resource processing is solved, and the rapid and effective processing of abnormal resources is achieved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to an abnormal resource processing method, device, system, electronic device and storage medium. Background Art

[0002] In the application system, due to the continuous alternation or parallel operation of different applications, it is easy to cause abnormal space resource occupation of the application system CPU, memory, disk, etc. At present, in the relevant technology, in order to solve the resource occupation problem, the abnormal resources are generally released based on the generated static threshold. For example, a fixed static alarm threshold is set for each monitored indicator at the beginning of the system establishment. When the monitored value exceeds the alarm threshold, an alarm message is generated; however, if the threshold setting range is too large, it will cause the system to fail to monitor certain faults, resulting in missed alarms; if the threshold setting range is too small, the system will frequently send alarm messages, resulting in a large number of false alarms. At the same time, a large number of false alarms may also drown out the alarm information that really needs attention, resulting in low accuracy and efficiency in abnormal resource processing.

[0003] There is currently no effective solution to the problems of low accuracy and efficiency in abnormal resource processing in related technologies. Summary of the invention

[0004] In this embodiment, a method, device, system, electronic device and storage medium for processing abnormal resources are provided to solve the problems of low accuracy and efficiency in abnormal resource processing in related technologies.

[0005] In a first aspect, a method for handling abnormal resources is provided in this embodiment, and the method includes:

[0006] Acquire abnormal resource data, and store the abnormal resource data in a preset time series database; wherein the time series in the time series database matches the abnormal resource data;

[0007] Acquire first abnormal resource data whose time series is the current moment from the time series database, input the first abnormal resource data into a well-trained long short-term memory (LSTM) neural network model, and output a momentum threshold prediction result at the current moment;

[0008] The first abnormal resource data is compared with the momentum threshold prediction result at the current moment, and a firewall operation is performed on the first abnormal resource data according to the comparison result.

[0009] In some embodiments, the time series database is stored on a hardware storage device, and storing the abnormal resource data in the preset time series database includes:

[0010] Writing the abnormal resource data into a memory within a preset time period;

[0011] When the current moment exceeds the preset time period, or when the data occupied space in the memory is greater than or equal to a preset memory space threshold, the abnormal resource data is sent to the hardware storage device and stored in the time series database.

[0012] In some embodiments, the first abnormal resource data is input into a well-trained LSTM neural network model, and the output is a current moment momentum threshold prediction result, including:

[0013] Input the first abnormal resource data and the momentum threshold prediction result of the previous moment read from the time series database into the forget gate of the LSTM neural network model, and output the forget gate result; wherein the momentum threshold prediction result of the previous moment is obtained by obtaining the abnormal resource data of the previous moment when the time series is the previous moment from the time series database, inputting the abnormal resource data of the previous moment into the LSTM neural network model and outputting it; the momentum threshold prediction result of the previous moment is stored in the time series database;

[0014] Inputting the first abnormal resource data, the momentum threshold prediction result at the previous moment and the forget gate result into the input gate of the LSTM neural network model, and outputting the input gate result;

[0015] Adding the input gate result and the momentum threshold prediction result at the previous moment point by point to obtain an addition result;

[0016] The first abnormal resource data and the addition result are input into the output gate of the LSTM neural network model, the momentum threshold prediction result at the current moment is output, and the momentum threshold prediction result at the current moment is stored in the time series database.

[0017] In some embodiments, the acquired abnormal resource data includes:

[0018] Acquiring system resource data, and comparing the system resource data with a preset usage threshold;

[0019] When the comparison result indicates that the system resource data is greater than or equal to the usage threshold, the abnormal resource data is acquired according to the system resource data.

[0020] In some embodiments, obtaining system resource data includes:

[0021] detecting an operating system instruction, and acquiring the system resource data in response to the operating system instruction; or,

[0022] A system file path is obtained, and the system resource data is obtained based on the system file path.

[0023] In some of the embodiments, the system resource data includes: CPU running time, CPU occupancy data, total memory, available memory, memory usage, used memory, free memory data, disk information, disk usage data and disk I / O data.

[0024] In a second aspect, an abnormal resource processing device is provided in this embodiment, the device comprising: an acquisition module, a prediction module and a processing module;

[0025] The acquisition module is used to acquire abnormal resource data and store the abnormal resource data in a preset time series database; wherein the time series in the time series database matches the abnormal resource data;

[0026] The prediction module is used to obtain the first abnormal resource data of the time series at the current moment from the time series database, input the first abnormal resource data into the well-trained LSTM neural network model, and output the momentum threshold prediction result at the current moment;

[0027] The processing module is used to compare the first abnormal resource data with the momentum threshold prediction result at the current moment, and perform a firewall operation on the first abnormal resource data according to the comparison result.

[0028] In a third aspect, an abnormal resource processing system is provided in this embodiment, the system comprising: a terminal device, a transmission device and a server device; wherein the terminal device is connected to the server device via the transmission device;

[0029] The terminal device is used to obtain an abnormal resource data query instruction;

[0030] The transmission device is used to obtain the abnormal resource data query instruction from the terminal device, and transmit the abnormal resource data to the server device;

[0031] The server device is used to execute the abnormal resource processing method described in the first aspect above.

[0032] In a fourth aspect, an electronic device is provided in this embodiment, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the abnormal resource processing method described in the first aspect when executing the computer program.

[0033] In a fifth aspect, a storage medium is provided in this embodiment, on which a computer program is stored, and when the program is executed by a processor, the abnormal resource processing method described in the first aspect is implemented.

[0034] Compared with the related art, the abnormal resource processing method, device, system, electronic device and storage medium provided in the present embodiment obtain abnormal resource data and store the abnormal resource data in a preset time series database; wherein the time series in the time series database matches the abnormal resource data; obtain the first abnormal resource data whose time series is the current moment from the time series database, input the first abnormal resource data into a fully trained LSTM neural network model, and output the momentum threshold prediction result at the current moment; compare the first abnormal resource data with the momentum threshold prediction result at the current moment, and perform a firewall operation on the first abnormal resource data according to the comparison result, thereby solving the problem of low accuracy and efficiency in abnormal resource processing and realizing fast and effective processing of abnormal resources.

[0035] Details of one or more embodiments of the present application are set forth in the following drawings and description to make other features, objects, and advantages of the present application more readily apparent. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0037] Figure 1 This is an application scenario diagram of an abnormal resource processing method in an embodiment;

[0038] Figure 2 A schematic diagram of a process flow of an abnormal resource processing method in one embodiment;

[0039] Figure 3 A schematic diagram of a process flow of an LSTM neural network model prediction step in one embodiment;

[0040] Figure 4 A schematic diagram of a flow chart of a method for handling abnormal resources in another embodiment;

[0041] Figure 5 is a structural block diagram of an abnormal resource processing device in an embodiment;

[0042] Figure 6 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0043] In order to more clearly understand the purpose, technical solutions and advantages of the present application, the present application is described and illustrated below in conjunction with the accompanying drawings and embodiments.

[0044] Unless otherwise defined, the technical terms or scientific terms involved in this application shall have the general meaning understood by people with ordinary skills in the technical field to which this application belongs. The words "one", "a", "a", "the", "these" and the like in this application do not represent quantitative restrictions, and they can be singular or plural. The terms "include", "comprise", "have" and any variants thereof involved in this application are intended to cover non-exclusive inclusions; for example, a process, method and system, product or device comprising a series of steps or modules (units) is not limited to the listed steps or modules (units), but may include unlisted steps or modules (units), or may include other steps or modules (units) inherent to these processes, methods, products or devices. The words "connect", "connected", "coupled" and the like involved in this application are not limited to physical or mechanical connections, but may include electrical connections, whether directly or indirectly. The "multiple" involved in this application refers to two or more. "And / or" describes the association relationship of associated objects, indicating that there may be three relationships. For example, "A and / or B" can mean: A exists alone, A and B exist at the same time, and B exists alone. The terms "first", "second", "third", etc. involved in this application are only used to distinguish similar objects, and do not represent a specific ordering of objects.

[0045] The abnormal resource processing method provided in this application can be applied to Figure 1 In the application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. The terminal 102 obtains the detection operating system instruction or system file path, communicates with the server 104 through the network, and the server 104 obtains the abnormal resource data and stores the abnormal resource data in a preset time series database; wherein the time series in the time series database matches the abnormal resource data; the server 104 obtains the first abnormal resource data of the current moment from the time series database, and inputs the first abnormal resource data into the well-trained LSTM neural network model, and outputs the momentum threshold prediction result at the current moment; the server 104 compares the first abnormal resource data with the momentum threshold prediction result at the current moment, and performs a firewall operation for the first abnormal resource data according to the comparison result. Among them, the terminal 102 can be, but is not limited to, various personal computers, laptops, smart phones, tablet computers and portable wearable devices, and the server 104 can be implemented with an independent server or a server cluster composed of multiple servers.

[0046] Among them, the momentum threshold prediction result is the maximum allowable value of the abnormal space resource occupancy rate that changes dynamically at different times, which is predicted by the LSTM neural network model based on the abnormal resource data at the corresponding time and is stored in the time series database according to the time series label.

[0047] In this embodiment, a method for handling abnormal resources is provided. Figure 2 is a flowchart of the abnormal resource processing method of this embodiment. Figure 2 As shown, this method is applied to Figure 1 Taking the server in as an example, the process includes the following steps:

[0048] Step S202, acquiring abnormal resource data, and storing the abnormal resource data in a preset time series database; wherein the time series in the time series database matches the abnormal resource data.

[0049] It should be noted that the above-mentioned abnormal resource data refers to data used to indicate the constantly changing abnormal space resource occupancy rate during the operation of servers, firewalls and other devices over a period of time, which may include: CPU running time, CPU occupancy rate data, total memory, available memory, memory usage, used memory, free memory data, disk information, disk usage data and disk I / O data, etc.; the above-mentioned abnormal resource data can be directly obtained by the above-mentioned server from the analysis data of the relevant abnormal resources of hardware devices such as CPU or memory, or the abnormal resource can also be obtained by: the user sends an acquisition instruction through interaction with the terminal device, and obtains it based on the acquisition instruction. The acquired abnormal resource data can be stored in the above-mentioned time series database (TSDB), which refers to a database that stores time series data, and needs to support basic functions such as fast writing, persistence, and multi-dimensional aggregation query of time series data.

[0050] Step S204, obtaining the first abnormal resource data of the time series at the current moment from the time series database, inputting the first abnormal resource data into the trained LSTM neural network model, and outputting the momentum threshold prediction result at the current moment.

[0051] Specifically, after executing the above step S204, the abnormal resource data at the current moment, that is, the above first abnormal resource data, can be read from the above time series database based on the time series label of each data; for example, the current moment is 8:51, then the first abnormal resource data with the time series label of 8:51 is read from the time series database. Then the first abnormal resource data is input into the above LSTM neural network model, and finally the above momentum threshold prediction result at the current moment is obtained. Among them, the current moment momentum threshold prediction result refers to the maximum allowable value of abnormal space resource occupancy rate dynamically changed to the current moment obtained by predicting the abnormal resource data at the current moment through the LSTM neural network model. It can be understood that the LSTM neural network model is pre-trained, and the training method can be: the acquired historical abnormal resource data is used as a training sample, and the training sample is divided into a training set and a test set according to a certain ratio, such as 8:2, and the training set is input into the LSTM neural network for training to obtain the LSTM neural network model, and the prediction performance of the LSTM neural network model can be tested using the test set, which will not be repeated here.

[0052] Step S206: compare the first abnormal resource data with the momentum threshold prediction result at the current moment, and perform a firewall operation on the first abnormal resource data according to the comparison result.

[0053] It is understandable that the first abnormal resource data is compared with the momentum threshold prediction result at the current moment. If the comparison result indicates that the first abnormal resource data exceeds the momentum threshold prediction result at the current moment, it means that the abnormal resource occupies too much space at this moment, and it is necessary to release or block the first abnormal resource data at the current moment; for example, a firewall operation is performed for the first abnormal resource data, and the firewall operation can be to stop the execution of abnormal resources exceeding the threshold by using the firewall. The firewall can be one or a combination of filtering firewalls, application proxy firewalls, and composite firewalls.

[0054] In the related art, in order to solve the problem of resource occupation, abnormal resources are generally released based on the generated static threshold. For example, a fixed static alarm threshold is set for each monitored indicator in the early stage of system establishment. When the monitored value exceeds the alarm threshold, an alarm message is generated; however, if the threshold setting range is too large, certain faults in the system cannot be detected, resulting in missed alarms; if the threshold setting range is too small, the system will frequently send alarm messages, resulting in a large number of false alarms. At the same time, a large number of false alarms may also drown out the alarm information that really needs attention, resulting in low accuracy and efficiency in abnormal resource processing.

[0055] Compared with the related art, the abnormal resource processing method, device, system, electronic device and storage medium provided in this embodiment, through the above steps, the acquired abnormal resource data will be stored in the time series database, each abnormal resource data has a time series label, when the abnormal resource data is input into the LSTM neural network for prediction, the method can retain the prediction result of the previous moment as the input of the current moment prediction according to the time series label, the prediction result of the previous moment retains the historical change law, and does not need to re-acquire historical data, has the function of selecting to save information or forget information, can solve the long-term dependence problem, thereby improving the efficiency of abnormal resource processing; at the same time, the method generates a momentum threshold that changes according to the change of the first abnormal resource data, can accurately limit the abnormal resources, will not cause the omission and false alarm of abnormal resources, has the advantages of fitting authenticity and dynamic prediction, so the method solves the problem of low accuracy and efficiency of abnormal resource processing, and realizes the rapid and effective processing of abnormal resources.

[0056] In one embodiment, the above-mentioned time series database is stored on a hardware storage device, and the above-mentioned storing the abnormal resource data in the preset time series database also includes the following steps: writing the abnormal resource data into the memory within a preset time period; when the current moment exceeds the preset time period, or when the data occupied space in the memory is greater than or equal to a preset memory space threshold, sending the abnormal resource data to the hardware storage device and storing it in the time series database.

[0057] Among them, the above-mentioned preset time period and preset memory space threshold can be pre-set by the user, for example, the preset time period can be set to 0 to 10 minutes, and the preset memory space threshold can be set to 1024KB. Within 0 to 10 minutes, the server obtains system resource data and compares the system resource data with the preset usage threshold. When the comparison result indicates that the system resource data is greater than or equal to the usage threshold, the abnormal resource data is obtained according to the system resource data, and after the timer exceeds 10 minutes, the abnormal resource data obtained within 10 minutes is written into the memory; at the same time, after the timer exceeds 10 minutes, or after the memory space occupied by the abnormal resource data is greater than or equal to 1024KB, the abnormal resource data is sent to the hardware storage device and stored in the time series database; finally, the timer and the occupied space counter need to be refreshed to restart timing or counting.

[0058] In one embodiment, a method for handling abnormal resources is provided. Figure 3 : is a flow chart of the LSTM neural network model prediction steps of this embodiment, such as Figure 3 As shown, in addition to steps S202 to S206, the process also includes the following steps:

[0059] Step S302: input the first abnormal resource data and the momentum threshold prediction result of the previous moment read from the time series database into the forget gate of the LSTM neural network model, and output the forget gate result.

[0060] Among them, the momentum threshold prediction result of the previous moment is obtained by obtaining the abnormal resource data of the previous moment when the time series is the previous moment from the time series database, inputting the abnormal resource data of the previous moment into the LSTM neural network model and outputting it; the momentum threshold prediction result of the previous moment is stored in the time series database.

[0061] It should be noted that the LSTM neural network model consists of several nodes and several operations. The operations act as input gates, output gates and forget gates, providing information with node states, and the node states are responsible for recording the prediction results of the previous moment in the network. The first stage is the forget gate, which uses the prediction results of the previous moment and the first abnormal resource data as input data to the first activation function, and the output value range is between [0,1], indicating the probability that the prediction results of the previous moment are forgotten. The closer the probability value is to 0, the more the data should be deleted, and the closer it is to 1, the more the data should be retained and enter the next stage; the first activation function is the sigmoid activation function in the LSTM neural network, which has the properties of monotonically increasing and inverse monotonically increasing, and the value range is (0,1), which can map a real number to the interval of (0,1).

[0062] Step S304: input the first abnormal resource data, the momentum threshold prediction result at the previous moment and the forget gate result into the input gate of the LSTM neural network model, and output the input gate result.

[0063] It should be noted that the input gate is the second stage of the LSTM neural network model prediction process. The input gate obtains the first abnormal resource data, the momentum threshold prediction result of the previous moment, and the forget gate result, and inputs the first abnormal resource data and the momentum threshold prediction result of the previous moment into the second activation function, and then multiplies them point by point with the forget gate result to obtain the input gate result. Among them, the second activation function is the tanh activation function in the LSTM neural network. The tanh activation function is one of the hyperbolic functions. Tanh is a hyperbolic tangent. Its graph is approximately linear near the domain 0 and is differentiable in the entire domain.

[0064] Step S306: Add the input gate result and the momentum threshold prediction result at the previous moment point by point to obtain an addition result.

[0065] Step S308: Input the first abnormal resource data and the point-by-point addition result into the output gate of the LSTM neural network model, output the momentum threshold prediction result at the current moment, and store the momentum threshold prediction result at the current moment into the time series database.

[0066] It should be noted that the output gate is the third stage of the LSTM neural network model prediction process. The output gate obtains the point-by-point addition result of the first abnormal resource data and the input gate, inputs the point-by-point addition result of the first abnormal resource data and the input gate into the first activation function, and then inputs the point-by-point addition result of the input gate into the second activation function. Finally, the values ​​of the first activation function and the second activation function are multiplied point by point to obtain the output gate result.

[0067] Through the above steps, the abnormal resource data at different times are cyclically input into the forget gate, input gate and output gate of the LSTM neural network model in sequence, thereby combining the time series database and the LSTM model to realize dynamic threshold prediction based on the abnormal resource data at each time, further improving the accuracy and efficiency of abnormal resource processing.

[0068] In one embodiment, a method for abnormal resource processing is provided. In addition to all the above steps, the method also includes: obtaining system resource data, and comparing the system resource data with a preset usage threshold; when the comparison result indicates that the system resource data is greater than or equal to the usage threshold, obtaining the abnormal resource data based on the system resource data.

[0069] The usage threshold is an initially set threshold used to filter system resource data as abnormal resource data. The value of the usage threshold can be determined by technicians in the relevant field through experience.

[0070] Through the above steps, the system resource data is compared with the preset usage threshold, and the system resource data that may be abnormal is preliminarily screened out. Subsequently, it is cyclically input into the LSTM neural network model to predict the momentum threshold, and then the abnormal resource data is further compared with the momentum threshold, so as to combine the preset threshold with the predicted momentum threshold, and realize dynamic threshold prediction based on the abnormal resource data after preliminary screening, which further improves the accuracy and efficiency of abnormal resource processing.

[0071] In one embodiment, a method for abnormal resource processing is provided. In addition to all the above steps, the method also includes: detecting operating system instructions and obtaining the system resource data in response to the operating system instructions; or obtaining a system file path and obtaining the system resource data based on the system file path.

[0072] The operating system may be a Windows system or a Linux system; in a Windows system, the method of obtaining system resource data through operating system instructions includes: obtaining CPU idle, kernel, and user usage time through GetSystemTimes, obtaining the kernel and user usage time of the process, as well as the creation and exit time through GetProcessTimes, and obtaining detailed memory-related information through GlobalMemoryStatusEx. In a Linux system, the method of obtaining system resource data through operating system instructions includes: obtaining CPU data through perf, obtaining memory information through free, and obtaining disk information through fdisk; or, the method of obtaining system resource data through the system file path includes: obtaining CPU data through stat in the proc directory, obtaining memory information through meminfo in the proc directory, and obtaining disk information through diskstats in the proc directory.

[0073] Through the above steps, the corresponding system resource data can be obtained from different acquisition methods of different operating systems, and then input into the abnormal resource processing method, device, system, electronic device and storage medium to obtain dynamic threshold prediction of abnormal resource data under different operating systems, thereby further improving the accuracy and efficiency of abnormal resource processing.

[0074] In one embodiment, a method for abnormal resource processing is provided. In addition to all the above steps, the method also includes system resource data, and the system resource data includes: CPU running time, CPU occupancy data, total memory, available memory, memory usage, used memory, free memory data, disk information, disk usage data and disk I / O data.

[0075] The present embodiment is described and illustrated below through preferred embodiments.

[0076] Figure 4 This is a flowchart of an abnormal resource processing method in another embodiment. First, the system resource data is obtained through the resource acquisition tool in Linux, including: CPU running time, CPU occupancy data, total memory, available memory, memory usage, used memory, free memory data, disk information, disk usage data and disk I / O data; the obtained system resource data is compared with the set usage threshold, if it is greater than the threshold, it is an abnormal resource;

[0077] Secondly, obtain the abnormal resource data and store it in the time series database; input the first abnormal resource data and the momentum threshold prediction result of the previous moment read from the time series database into the LSTM neural network model composed of several nodes and several operations, where the operation acts as the input gate, output gate and forget gate, and provides information with the node state. The node state is responsible for recording the prediction result of the previous moment in the network. The first stage of the LSTM neural network model is the forget gate. The forget gate uses the prediction result of the previous moment and the first abnormal resource data as input data to the first activation function, and the output value range is between [0,1], indicating the probability that the prediction result of the previous moment is forgotten. The closer the probability value is to 0, the more the data should be deleted, and the closer it is to 1, the more the data should be retained. The forget gate result is output and the next stage is entered; the second stage is the input gate. The input gate obtains the first abnormal resource data, the momentum threshold prediction result of the previous moment and the forget gate result, and the first abnormal resource data is stored in the time series database. The result of momentum threshold prediction at the previous moment is input into the second activation function, and then multiplied point by point with the forget gate result to obtain the input gate result; the input gate result is added point by point with the result of momentum threshold prediction at the previous moment to obtain the addition result; the third stage is the output gate, the output gate obtains the point-by-point addition result of the first abnormal resource data and the input gate, inputs the point-by-point addition result of the first abnormal resource data and the input gate into the first activation function, and then inputs the point-by-point addition result of the input gate into the second activation function, and finally multiplies the value of the first activation function by the value of the second activation function point by point to obtain the output gate result;

[0078] Finally, the momentum threshold obtained by the LSTM algorithm is used to analyze the changes in abnormal resource data. When the abnormal resource data exceeds the momentum threshold, the web application firewall can stop executing the abnormal resources that exceed the threshold.

[0079] Among them, the momentum threshold prediction result of the previous moment is obtained by obtaining the abnormal resource data of the previous moment when the time series is the previous moment from the time series database, inputting the abnormal resource data of the previous moment into the LSTM neural network model and outputting it; the momentum threshold prediction result of the previous moment is stored in the time series database.

[0080] It should be understood that although Figure 1-4 The steps in the flowchart are shown in sequence as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders. Moreover, Figure 1-4At least part of the steps may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least part of the sub-steps or stages of other steps.

[0081] Through the above steps, the acquired abnormal resource data will be stored in the time series database, and each abnormal resource data has a time series label. When the abnormal resource data is input into the LSTM neural network for prediction, the method can retain the prediction result of the previous moment as the input of the current moment prediction based on the time series label. The prediction result of the previous moment retains the historical change law, and there is no need to re-acquire historical data. It has the function of being able to choose to save information or forget information, which can solve the long-term dependency problem, thereby improving the efficiency of abnormal resource processing; at the same time, the method generates a momentum threshold that changes according to the change of the first abnormal resource data, which can accurately limit the abnormal resources, and will not cause the omission and false alarm of abnormal resources. It has the advantages of fitting authenticity and dynamic prediction. Therefore, this method solves the problem of low accuracy and efficiency in abnormal resource processing, and realizes rapid and effective processing of abnormal resources.

[0082] In this embodiment, an abnormal resource processing device is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. The terms "module", "unit", "subunit", etc. used below can implement a combination of software and / or hardware of predetermined functions. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0083] Figure 5 is a structural block diagram of the abnormal resource processing device of this embodiment, such as Figure 5 As shown, the device includes: an acquisition module, a prediction module and a processing module;

[0084] The acquisition module is used to acquire abnormal resource data and store the abnormal resource data in a preset time series database; wherein the time series in the time series database matches the abnormal resource data;

[0085] The prediction module is used to obtain the first abnormal resource data of the time series at the current moment from the time series database, input the first abnormal resource data into the well-trained LSTM neural network model, and output the momentum threshold prediction result at the current moment;

[0086] The processing module is used to compare the first abnormal resource data with the momentum threshold prediction result at the current moment, and perform a firewall operation on the first abnormal resource data according to the comparison result.

[0087] In one embodiment, the above-mentioned acquisition module is also used to write the abnormal resource data into the memory within a preset time period; when the current moment exceeds the preset time period, or when the data occupied space in the memory is greater than or equal to a preset memory space threshold, the acquisition module sends the abnormal resource data to the hardware storage device and stores it in the time series database.

[0088] It should be noted that the above modules can be functional modules or program modules, and can be implemented by software or hardware. For modules implemented by hardware, the above modules can be located in the same processor; or the above modules can be located in different processors in any combination.

[0089] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 6 As shown. The computer device includes a processor, a memory, a network interface and a database connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store time series data. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, an abnormal resource processing method is implemented.

[0090] Those skilled in the art will understand that Figure 6 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0091] In this embodiment, an abnormal resource processing system is also provided, which is composed of the above modules and is used to execute the above abnormal resource processing method. The system includes a terminal device, a transmission device and a server device; wherein the terminal device is connected to the server device through the transmission device; the terminal device is used to obtain an abnormal resource data query instruction; the transmission device is used to obtain the abnormal resource data query instruction from the terminal device and transmit the abnormal resource data to the server device; the server device is used to execute the steps in any of the above method embodiments.

[0092] In this embodiment, an electronic device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0093] Optionally, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0094] It should be noted that the specific examples in this embodiment can refer to the examples described in the above embodiments and optional implementation modes, and will not be repeated in this embodiment.

[0095] In addition, in combination with the abnormal resource processing method provided in the above embodiments, a storage medium may be provided in this embodiment to implement the abnormal resource processing method. The storage medium stores a computer program; when the computer program is executed by a processor, any abnormal resource processing method in the above embodiments is implemented.

[0096] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing related hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0097] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0098] It should be understood that the specific embodiments described herein are only used to explain the application, rather than to limit it. Based on the embodiments provided in this application, all other embodiments obtained by ordinary technicians in this field without creative work are within the protection scope of this application.

[0099] Obviously, the drawings are only some examples or embodiments of the present application. For ordinary technicians in the field, the present application can also be applied to other similar situations based on these drawings without creative work. In addition, it is understandable that although the work done in this development process may be complicated and lengthy, for ordinary technicians in the field, certain changes in design, manufacturing or production based on the technical content disclosed in this application are only conventional technical means and should not be regarded as insufficient content disclosed in this application.

[0100] The term "embodiment" in this application refers to a specific feature, structure or characteristic described in conjunction with the embodiment that can be included in at least one embodiment of the present application. The appearance of this phrase in various locations in the specification does not necessarily mean the same embodiment, nor does it mean that it is mutually exclusive with other embodiments and is independent or optional. It is clearly or implicitly understood by those of ordinary skill in the art that the embodiments described in this application can be combined with other embodiments without conflict.

[0101] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of patent protection. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the scope of protection of the present application. Therefore, the scope of protection of the present application shall be subject to the attached claims.

Claims

1. A method for handling abnormal resources, It is characterized in that include: Acquire abnormal resource data, and store the abnormal resource data in a preset time series database; wherein the time series in the time series database matches the abnormal resource data; Acquire the first abnormal resource data whose time series is the current moment from the time series database, input the first abnormal resource data into a well-trained LSTM neural network model, and output the momentum threshold prediction result at the current moment; Comparing the first abnormal resource data with the current moment momentum threshold prediction result, and performing a firewall operation on the first abnormal resource data according to the comparison result; The step of inputting the first abnormal resource data into a well-trained LSTM neural network model and outputting a prediction result of the momentum threshold at the current moment includes: Input the first abnormal resource data and the momentum threshold prediction result of the previous moment read from the time series database into the forget gate of the LSTM neural network model, and output the forget gate result; wherein the momentum threshold prediction result of the previous moment is obtained by obtaining the abnormal resource data of the previous moment when the time series is the previous moment from the time series database, inputting the abnormal resource data of the previous moment into the LSTM neural network model and outputting it; the momentum threshold prediction result of the previous moment is stored in the time series database; Inputting the first abnormal resource data, the momentum threshold prediction result at the previous moment and the forget gate result into the input gate of the LSTM neural network model, and outputting the input gate result; Adding the input gate result and the momentum threshold prediction result at the previous moment point by point to obtain an addition result; The first abnormal resource data and the addition result are input into the output gate of the LSTM neural network model, the momentum threshold prediction result at the current moment is output, and the momentum threshold prediction result at the current moment is stored in the time series database.

2. The abnormal resource processing method according to claim 1, It is characterized in that The time series database is stored on a hardware storage device, and storing the abnormal resource data in the preset time series database includes: Writing the abnormal resource data into a memory within a preset time period; When the current moment exceeds the preset time period, or when the data occupied space in the memory is greater than or equal to a preset memory space threshold, the abnormal resource data is sent to the hardware storage device and stored in the time series database.

3. The abnormal resource processing method according to any one of claims 1 to 2, It is characterized in that The acquired abnormal resource data includes: Acquiring system resource data, and comparing the system resource data with a preset usage threshold; When the comparison result indicates that the system resource data is greater than or equal to the usage threshold, the abnormal resource data is acquired according to the system resource data.

4. The method according to claim 3, It is characterized in that The obtaining of system resource data comprises: detecting an operating system instruction, and acquiring the system resource data in response to the operating system instruction; or, A system file path is obtained, and the system resource data is obtained based on the system file path.

5. The method according to claim 3, It is characterized in that The system resource data includes: CPU running time, CPU occupancy data, total memory, available memory, memory usage, used memory, free memory data, disk information, disk usage data and disk I / O data.

6. An abnormal resource processing device, It is characterized in that The device comprises: an acquisition module, a prediction module and a processing module; The acquisition module is used to acquire abnormal resource data and store the abnormal resource data in a preset time series database; wherein the time series in the time series database matches the abnormal resource data; The prediction module is used to obtain the first abnormal resource data of the time series at the current moment from the time series database, input the first abnormal resource data into the well-trained LSTM neural network model, and output the momentum threshold prediction result at the current moment; wherein, the inputting the first abnormal resource data into the well-trained LSTM neural network model and outputting the momentum threshold prediction result at the current moment includes: Input the first abnormal resource data and the momentum threshold prediction result of the previous moment read from the time series database into the forget gate of the LSTM neural network model, and output the forget gate result; wherein the momentum threshold prediction result of the previous moment is obtained by obtaining the abnormal resource data of the previous moment when the time series is the previous moment from the time series database, inputting the abnormal resource data of the previous moment into the LSTM neural network model and outputting it; the momentum threshold prediction result of the previous moment is stored in the time series database; Inputting the first abnormal resource data, the momentum threshold prediction result at the previous moment and the forget gate result into the input gate of the LSTM neural network model, and outputting the input gate result; Adding the input gate result and the momentum threshold prediction result at the previous moment point by point to obtain an addition result; Inputting the first abnormal resource data and the addition result into the output gate of the LSTM neural network model, outputting the current moment momentum threshold prediction result, and storing the current moment momentum threshold prediction result into the time series database; The processing module is used to compare the first abnormal resource data with the momentum threshold prediction result at the current moment, and perform a firewall operation on the first abnormal resource data according to the comparison result.

7. An abnormal resource processing system, It is characterized in that include: Terminal equipment, transmission equipment and server equipment; wherein the terminal equipment is connected to the server equipment via the transmission equipment; The terminal device is used to obtain an abnormal resource data query instruction; The transmission device is used to obtain the abnormal resource data query instruction from the terminal device, and transmit the abnormal resource data to the server device; The server device is used to execute the abnormal resource processing method according to any one of claims 1 to 5.

8. An electronic device comprising a memory and a processor, It is characterized in that A computer program is stored in the memory, and the processor is configured to run the computer program to execute the abnormal resource processing method according to any one of claims 1 to 5.

9. A computer-readable storage medium having a computer program stored thereon, It is characterized in that When the computer program is executed by a processor, the steps of the abnormal resource processing method according to any one of claims 1 to 5 are implemented.

Images