Memory recycling anomaly detection method, device, equipment and medium

Abstract

The present disclosure provides a memory recycling anomaly detection method, device, equipment, medium and program product, which can be applied to the field of big data technology and the financial field. The memory recycling anomaly detection method includes: obtaining first time series feature data and second time series feature data, wherein the first time series feature data includes memory space occupancy data, time length data consumed by recycling data, and frequency data of first type data being recycled; the second time series feature data includes frequency data of second type data being recycled; inputting the first time series feature data and the second time series feature data into a preset model, outputting a first correlation feature of the first time series feature data and the second time series feature data; calculating a first change trend of the first time series feature data; and outputting a warning message for characterizing that memory recycling will be abnormal when the first change trend of the first time series feature data meets the first correlation feature.

Description

Technical Field

[0001] The present disclosure relates to the field of big data technology, and in particular to a memory recycling anomaly detection method, device, equipment, medium and program product. Background Art

[0002] Memory recycling generally refers to the process / thread of a program returning the memory to the system immediately after the memory is used, thereby realizing shared and circular use of memory. The system is responsible for managing memory recycling for automatic memory recycling, and the application only needs to consider memory application, not release. It can reduce the complexity of the code and reduce memory leaks caused by untimely memory recycling, or program operation abnormalities caused by repeated memory recycling. However, automatic memory recycling will also bring additional problems: 1) The program often needs to be suspended during recycling, resulting in increased request processing latency and affecting user experience 2) Frequent garbage collection (referred to as frequent GC) will greatly consume system resources, causing program performance to deteriorate and even cause program crashes, seriously affecting business stability.

[0003] Related technologies mainly use a fixed threshold method to detect whether frequent garbage collection has occurred. However, this method can only be detected after frequent garbage collection occurs, and at this time, frequent garbage collection has an impact on the business. Therefore, it is necessary to warn of memory collection anomalies before the business is affected. Summary of the invention

[0004] In view of the above problems, the present disclosure provides a memory recycling anomaly detection method, apparatus, device, medium and program product.

[0005] According to a first aspect of the present disclosure, a method for detecting anomalies in memory recycling is provided, comprising:

[0006] Acquire first time series characteristic data and second time series characteristic data, wherein the first time series characteristic data includes any one of the following: memory space occupancy data, time length data consumed for data recycling, and frequency data of first type data being recycled; the second time series characteristic data includes frequency data of second type data being recycled; wherein the frequency of first type data being recycled is greater than the frequency of second type data being recycled;

[0007] Inputting the first time series feature data and the second time series feature data into a preset model, and outputting a first correlation feature between the first time series feature data and the second time series feature data;

[0008] Calculating a first change trend of the first time series feature data; and

[0009] When the first change trend of the first time series feature data meets the first correlation feature, warning information for indicating that an abnormality may occur in memory recycling is output.

[0010] According to an embodiment of the present disclosure, the memory space occupancy data includes any of the following:

[0011] The amount of memory space occupied before the data is recycled, the amount of memory space occupied after the data is recycled, and the amount of memory space occupied after the data is recycled; the time data consumed to recycle data includes the time data consumed to recycle the first type of data and / or the time data consumed to recycle the second type of data.

[0012] According to an embodiment of the present disclosure, when the first change trend of the first time series feature data meets the first correlation feature, outputting warning information for indicating that memory recycling will be abnormal includes:

[0013] When the first correlation feature is positively correlated and the first change trend of the first time series feature data is an upward trend, the first change trend of the first time series feature data meets the first correlation feature, and warning information indicating that memory recycling may be abnormal is output.

[0014] According to an embodiment of the present disclosure, when the first change trend of the first time series feature data meets the first correlation feature, outputting warning information for indicating that memory recycling will be abnormal includes:

[0015] When the first correlation feature is negatively correlated and the first change trend of the first time series feature data is a downward trend, the first change trend of the first time series feature data meets the first correlation feature, and warning information indicating that memory recycling may be abnormal is output.

[0016] According to an embodiment of the present disclosure, the memory recycling anomaly detection method further includes:

[0017] Extracting first data from the memory recycling log according to the first sliding window;

[0018] Extracting second data from the memory recovery log according to the second sliding window, wherein the first data and the second data have the same data type;

[0019] Calculating characteristic values ​​of the first data and the second data respectively to obtain first characteristic data and second characteristic data;

[0020] The preset time of the first sliding window and the preset time of the second sliding window are marked on the first characteristic data and the second characteristic data respectively to obtain the first time series characteristic data.

[0021] According to an embodiment of the present disclosure, the preset time includes any one of the following: a start time and an end time.

[0022] According to an embodiment of the present disclosure, the characteristic value includes any one of the following: an average value, a maximum value, and a minimum value.

[0023] According to an embodiment of the present disclosure, the memory abnormal recovery detection method further includes:

[0024] Extracting third time series feature data and fourth time series feature data from the historical abnormal memory log, wherein the fourth time series feature data includes data showing abnormal frequency of recycling of the second type of data, and the third time series feature data has the same data type as the first time series feature data;

[0025] Analyze a second change trend of the third time series characteristic data within a preset time before the fourth time series characteristic data appears;

[0026] Determine a second correlation feature between the third time series feature data and the fourth time series feature data according to the second change trend;

[0027] Determine, according to the second correlation feature and the second change trend, condition information for triggering an abnormality in memory reclaiming.

[0028] The second aspect of the present disclosure provides a memory recovery anomaly detection device, including: an acquisition module, a detection module, a calculation module, and an early warning module. The acquisition module is used to acquire first time series feature data and second time series feature data, wherein the first time series feature data includes any one of the following: memory space occupancy data, time length data consumed for data recovery, and frequency data of first type data being recovered; the second time series feature data includes frequency data of second type data being recovered, and the frequency of first type data being recovered is greater than the frequency of second type data being recovered. The detection module is used to input the first time series feature data and the second time series feature data into a preset model, and output a first correlation feature of the first time series feature data and the second time series feature data. The calculation module is used to calculate a first change trend of the first time series feature data. The early warning module is used to output early warning information for characterizing that memory recovery will be abnormal when the first change trend of the first time series feature data meets the first correlation feature.

[0029] According to an embodiment of the present disclosure, the early warning module includes a first early warning unit and a second early warning unit. The first early warning unit is used to output early warning information for characterizing that an abnormality will occur in memory recycling when the correlation feature is positively correlated and the changing trend of the first time series feature data is an upward trend, and the changing trend of the first time series feature data meets the correlation feature. The second early warning unit is used to output early warning information for characterizing that an abnormality will occur in memory recycling when the correlation feature is negatively correlated and the changing trend of the first time series feature data is a downward trend, and the changing trend of the first time series feature data meets the correlation feature.

[0030] According to an embodiment of the present disclosure, the acquisition module includes a first extraction unit, a second extraction unit, a calculation unit, and a marking unit. The first extraction unit is used to extract first data from the memory recovery log according to the first sliding window. The second extraction unit is used to extract second data from the memory recovery log according to the second sliding window, wherein the data type of the first data and the second data are the same. The calculation unit is used to calculate the characteristic values ​​of the first data and the second data, respectively, to obtain the first characteristic data and the second characteristic data. The marking unit is used to mark the preset time of the first sliding window and the preset time of the second sliding window on the first characteristic data and the second characteristic data, respectively, to obtain the first time series characteristic data.

[0031] According to an embodiment of the present disclosure, the memory recovery anomaly detection device also includes an extraction module, an analysis module, a first determination module, and a second determination module. The extraction module is used to extract third time series feature data and fourth time series feature data from the historical abnormal memory log, wherein the fourth time series feature data includes data on the frequency of abnormal recovery of the second type of data, and the third time series feature data has the same data type as the first time series feature data. The analysis module is used to analyze the second change trend of the third time series feature data within a preset time before the fourth time series feature data appears. The first determination module is used to determine the second correlation feature of the third time series feature data and the fourth time series feature data based on the second change trend. The second determination module determines the conditional information for triggering the abnormality of memory recovery based on the second correlation feature and the second change trend.

[0032] A third aspect of the present disclosure provides an electronic device, comprising: one or more processors; and a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors execute the above-mentioned memory recovery anomaly detection method.

[0033] A fourth aspect of the present disclosure further provides a computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, causes the processor to execute the above-mentioned memory recycling anomaly detection method.

[0034] The fifth aspect of the present disclosure also provides a computer program product, including a computer program, which implements the above-mentioned memory recycling anomaly detection method when executed by a processor.

[0035] According to an embodiment of the present disclosure, by acquiring multiple groups of time series feature data, when it is determined that the time series feature data is correlated with the frequent occurrence of garbage collection data, and the changing trend of the time series feature data conforms to the correlation characteristics of the frequent occurrence of garbage collection data, warning information for characterizing that abnormalities will occur in memory collection is output, thereby realizing automatic warning of real-time memory collection data. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] The above contents and other purposes, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0037] Figure 1 The application scenario diagram of the memory recycling anomaly detection method, apparatus, device, medium and program product according to the embodiment of the present disclosure is schematically shown;

[0038] Figure 2 A flowchart of a method for detecting anomalies in memory recycling according to an embodiment of the present disclosure is schematically shown;

[0039] Figure 3 A flowchart of a method for acquiring time series feature data according to an embodiment of the present disclosure is schematically shown;

[0040] Figure 4 A flowchart of a method for determining conditions for triggering memory recycling exceptions from historical abnormal memory logs according to an embodiment of the present disclosure is schematically shown;

[0041] Figure 5a-1 and Figure 5a-2 The diagram schematically shows the frequency change curve of the new generation data and the old generation data being recycled at the same time when an abnormality occurs in memory recycling, and the change curve of the memory space occupied by the new generation data in the same period;

[0042] Figure 5b-1 and Figure 5b-2 The diagram schematically shows the frequency change curve of the new generation data and the old generation data being recovered simultaneously and the change curve of the time taken to recover the data when an abnormality occurs in memory recovery;

[0043] Figure 5c The diagram schematically shows the frequency change curve of new generation data being recycled when an abnormality occurs in memory recycling;

[0044] Figure 6 A flowchart schematically shows a method for detecting memory recycling anomalies according to an embodiment of the present disclosure;

[0045] Figure 7a-7d A diagram schematically shows a comparison of the effects of detection performed using the memory recycling anomaly detection method according to an embodiment of the present disclosure;

[0046] Figure 8 The structure block diagram of the memory recycling anomaly detection device according to an embodiment of the present disclosure is schematically shown;

[0047] Fig. 9 A structural block diagram of a memory recycling anomaly detection device according to some other embodiments of the present disclosure is schematically shown; and

[0048] Fig.10 A block diagram of an electronic device suitable for implementing a memory recycling anomaly detection method according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0049] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0050] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0051] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification, and should not be interpreted in an idealized or overly rigid manner.

[0052] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0053] It should be noted that the memory recycling anomaly detection method and device of the embodiments of the present disclosure can be used in the financial field, and can also be used in any field other than the financial field. The application field of the memory recycling anomaly detection method and device of the embodiments of the present disclosure is not limited.

[0054] Figure 1 The application scenario diagram of the memory recycling anomaly detection method according to an embodiment of the present disclosure is schematically shown.

[0055] like Figure 1As shown, the application scenario 100 according to this embodiment may include terminal devices 101, 102, 103, a network 104, and a server 105. The network 104 is used to provide a medium for a communication link between the terminal devices 101, 102, 103 and the server 105. The network 104 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0056] Users can use terminal devices 101, 102, 103 to interact with server 105 through network 104 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 101, 102, 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only examples).

[0057] The terminal devices 101 , 102 , and 103 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, and desktop computers.

[0058] The server 105 may be a server that provides various services, such as a background management server (only an example) that provides support for websites browsed by users using the terminal devices 101, 102, and 103. The background management server may analyze and process the received data such as user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal device.

[0059] It should be noted that the memory recovery anomaly detection method provided in the embodiment of the present disclosure can generally be executed by the server 105. Accordingly, the memory recovery anomaly detection device provided in the embodiment of the present disclosure can generally be set in the server 105. The memory recovery anomaly detection method provided in the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the terminal devices 101, 102, 103 and / or the server 105. Accordingly, the memory recovery anomaly detection device provided in the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the terminal devices 101, 102, 103 and / or the server 105.

[0060] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0061] The following will be based on Figure 1 The scene described by Figure 2 to Figure 4 The memory recycling anomaly detection method of the disclosed embodiment is described in detail.

[0062] Figure 2 The flowchart of the memory recycling anomaly detection method according to an embodiment of the present disclosure is schematically shown.

[0063] like Figure 2 As shown, the memory recycling anomaly detection method of this embodiment includes operations S210 to S240.

[0064] In operation S210, first timing characteristic data and second timing characteristic data are obtained, wherein the first timing characteristic data includes any one of the following: memory space occupancy data, time data consumed for data recycling, and frequency data of first type data being recycled; the second timing characteristic data includes frequency data of second type data being recycled; wherein the frequency of first type data being recycled is greater than the frequency of second type data being recycled.

[0065] According to the embodiment of the present disclosure, the first type of data may be an object with a short life cycle in an application, which is stored in the new generation area and can be frequently garbage collected. The second type of data includes objects with a short life cycle in the application and objects with a long life cycle in the application. Generally, objects in the application with a life cycle longer than that of the first type of data will not be frequently garbage collected. After the objects stored in the new generation area are garbage collected, they can be stored in the old generation area. When the space in the old generation area is insufficient, garbage collection of data in the entire memory space will be triggered. The data in the entire memory space may include objects with a short life cycle in the application (referred to as new generation data) and objects with a long life cycle in the application (referred to as old generation data), and may also include metadata in the permanent storage area of ​​the memory. When the frequency of garbage collection in the new generation area and the old generation area at the same time (referred to as Full GC) exceeds the threshold, memory recovery is abnormal. In the related art, a fixed threshold is set by expert experience to detect whether memory recovery abnormality occurs. However, this fixed threshold method can only be detected when memory recovery has been abnormal, and it is impossible to warn of memory recovery abnormality.

[0066] In operation S220, the first time series feature data and the second time series feature data are input into a preset model, and a first correlation feature between the first time series feature data and the second time series feature data is output.

[0067] According to the embodiment of the present disclosure, the preset model can adopt the PCMCI causal detection model. PCMCI is a method for analyzing the causal correlation between variables, and is composed of two stage algorithms, PC and MCI. The PC algorithm is used to learn the Bayesian network structure between multiple random variables. The MCI (momentary conditional independence) detection algorithm is responsible for controlling false positives for highly interdependent time series situations. The PCMCI algorithm is used to test the causal relationship between each first time series feature data and the second time series feature data. The test is performed according to the following requirements:

[0068] a. Execute according to a fixed cycle, it is recommended to execute once every 24 hours;

[0069] b. When executing, obtain data from the most recent period of time. The sliding time window must cover the execution cycle. For example, if the execution cycle is 24 hours, the sliding time window for obtaining time series data can be set to 36 hours;

[0070] c. In order to achieve the prediction effect, the first time series feature data must have a certain delay relative to the second time series feature data. Multiple different delays can be set for separate tests, as long as there is a delay value that makes the two correlated. The delay value can be selected from 10 minutes to 60 minutes.

[0071] d. Output the first correlation feature between the first time series feature data and the second time series feature data. The first correlation feature may include positive correlation, negative correlation, and no correlation.

[0072] In operation S230 , a first change trend of the first time series feature data is calculated.

[0073] According to an embodiment of the present disclosure, the Mann-Kendall algorithm may be used to detect the first change trend of the first time series feature data, and the specific steps are as follows:

[0074] a) Let x i 、x j For the i-th and j-th values ​​of the characteristic variable x, calculate the characteristic value S of the trend. The calculation formula of the S value is as follows:

[0075]

[0076] Where f is a symbolic function, defined as follows:

[0077]

[0078] b) Calculate the test value Z according to formula (III) mk

[0079]

[0080] Where VAR(S) is the variance of S and is defined as follows:

[0081]

[0082] Where p is the number of repeated numbers, g is the number of unique numbers (number of knots), t p The number of repetitions for each repetition number.

[0083] c) Result determination

[0084] If Z MK ≥Z 1-α , then the original data is judged to have a trend, otherwise it is judged to have no trend. 1-α is 100(1-α) in the standard normal distribution lookup table th Percentile corresponding data. Under the premise of determining that the original data has a trend, when Z MK When it is greater than 0, the original data is judged to be in an upward trend, otherwise it is judged to be in a downward trend.

[0085] In operation S240, when the first change trend of the first time series feature data meets the first correlation feature, warning information for indicating that memory recycling may be abnormal is output.

[0086] According to the embodiments of the present disclosure, for example, when the first correlation feature is positively correlated, that is, the dependent variable increases as the independent variable increases, and at this time the first change trend of the first time series feature data is increasing, then the first change trend of the first time series feature data conforms to the first correlation feature, indicating that as the first time series feature data increases, the second time series feature data will also increase, indicating that the frequency of garbage collection in the new generation area and the old generation area at the same time will increase, and output a warning message of abnormal memory recovery.

[0087] According to an embodiment of the present disclosure, by acquiring multiple groups of time series feature data, when it is determined that the time series feature data is correlated with the frequent occurrence of garbage collection data, and the changing trend of the time series feature data conforms to the correlation characteristics of the frequent occurrence of garbage collection data, warning information for characterizing that abnormalities will occur in memory recovery is output, thereby realizing automatic warning of real-time memory recovery data.

[0088] According to an embodiment of the present disclosure, the memory space occupancy data includes any one of the following: the memory space occupancy before the data is recycled, the memory space occupancy after the data is recycled, and the memory space occupancy after the data is recycled; the time data consumed to recycle data includes the time data consumed to recycle the first type of data and / or the time data consumed to recycle the second type of data.

[0089] According to an embodiment of the present disclosure, the memory space occupied before the data is recycled may include the memory space occupied before the new generation data is recycled, the memory space occupied before the old generation data is recycled, and the memory space occupied before the metadata is recycled. The memory space occupied after the data is recycled may include the memory space occupied after the new generation data is recycled, the memory space occupied after the old generation data is recycled, and the memory space occupied after the metadata is recycled. The memory space occupied by the recycled data may be the difference between the memory space occupied by the same type of data before recycling and the memory space occupied after recycling. The time consumed to recycle the data may be the time consumed to recycle the new generation data, or it may be the time consumed for the new generation data and the old generation data to be recycled at the same time.

[0090] According to the embodiments of the present disclosure, the memory space occupancy data and the time consumed for data recovery are both conditional data that may trigger memory recovery anomalies. The correlation between the memory space occupancy data, the time consumed for data recovery and the memory recovery anomalies is analyzed to determine the specific conditions that trigger the memory recovery anomaly, which is used to issue an early warning for the memory recovery anomaly.

[0091] According to an embodiment of the present disclosure, when the first change trend of the first time series feature data meets the first correlation feature, outputting warning information for indicating that memory recycling will be abnormal includes:

[0092] When the first correlation feature is positively correlated and the first change trend of the first time series feature data is an upward trend, the first change trend of the first time series feature data meets the first correlation feature, and warning information indicating that memory recycling may be abnormal is output.

[0093] According to the embodiment of the present disclosure, for example, the first correlation feature is positively correlated, that is, the dependent variable increases as the independent variable increases, and the dependent variable decreases as the independent variable decreases. According to the embodiment of the present disclosure, the change trend of the first time series feature data is the independent variable, and the change trend of the second time series feature data is the dependent variable. When the change trend of the first time series feature data is an upward trend, the independent variable increases, and the dependent variable also increases, that is, the change trend of the second time series feature data is also an upward trend, indicating that the frequency of garbage collection in the new generation area and the old generation area at the same time will increase, and the warning information of abnormal memory recovery will be output.

[0094] According to the embodiments of the present disclosure, the possibility of memory recovery anomalies occurring is predicted by determining the changing trend of time series feature data that is correlated with memory recovery anomalies, thereby realizing the function of automatic early warning, and solving the problem in related technologies that a fixed threshold value set by relying on expert experience can only be detected after the memory recovery anomaly occurs.

[0095] According to an embodiment of the present disclosure, when the first change trend of the first time series feature data meets the first correlation feature, outputting warning information for indicating that memory recycling will be abnormal includes:

[0096] When the first correlation feature is negatively correlated and the first change trend of the first time series feature data is a downward trend, the first change trend of the first time series feature data meets the first correlation feature, and warning information indicating that memory recycling may be abnormal is output.

[0097] According to the embodiment of the present disclosure, for example, the first correlation feature is negatively correlated, that is, the dependent variable increases as the independent variable decreases, and the dependent variable decreases as the independent variable increases. According to the embodiment of the present disclosure, the change trend of the first time series feature data is the independent variable, and the change trend of the second time series feature data is the dependent variable. When the change trend of the first time series feature data is a downward trend, the independent variable decreases, and the dependent variable will increase, that is, the change trend of the second time series feature data is an upward trend, indicating that the frequency of garbage collection in the new generation area and the old generation area at the same time will increase, and the warning information of abnormal memory recovery will be output.

[0098] According to the embodiments of the present disclosure, the possibility of memory recovery anomalies occurring is predicted by determining the changing trend of time series feature data that is correlated with memory recovery anomalies, thereby realizing the function of automatic early warning, and solving the problem in related technologies that a fixed threshold value set by relying on expert experience can only be detected after the memory recovery anomaly occurs.

[0099] Figure 3 The flowchart of the method for acquiring time series characteristic data according to an embodiment of the present disclosure is schematically shown.

[0100] like Figure 3 As shown, the method for acquiring time series feature data in this embodiment includes operations S310 to S340.

[0101] In operation S310, first data is extracted from a memory recycling log according to a first sliding window.

[0102] In operation S320, second data is extracted from the memory recycling log according to the second sliding window, wherein the first data and the second data have the same data type.

[0103] According to the embodiment of the present disclosure, the first sliding window and the second sliding window can both be fixed time windows, for example, if the fixed time window is 5 seconds, data is extracted from the memory recovery log every 5 seconds. The method for extracting data can use regular expressions for template matching to extract data information.

[0104] According to an embodiment of the present disclosure, the first data and the second data are of the same type. For example, the first data and the second data may both be the memory space occupied by the new generation data before being recycled.

[0105] According to an embodiment of the present disclosure, the following is an exemplary description of using a regular expression to obtain data information from a memory recovery log:

[0106] The memory recycling log is as follows:

[0107] 2021-08-09T10:39:53.244+0800:225010.501:[Full GC(Ergonomics)[PSYoungGen:1311744K->1173345K(1354752K)][ParOldGen:2796430K->2796430K(2796544K)]4108174K->396 9776K(4151296K),[Metaspace:180752K->180752K(1212416K)],1.7781550secs][Times:user=6.29sys=0.01, real=1.78secs]

[0108] The regular expression used to obtain data and the data information obtained from the above memory recycling log are shown in the following table:

[0109]

[0110]

[0111] In operation S330 , characteristic values ​​of the first data and the second data are calculated respectively to obtain first characteristic data and second characteristic data.

[0112] According to an embodiment of the present disclosure, the characteristic value includes any one of the following: an average value, a maximum value, and a minimum value.

[0113] According to the embodiment of the present disclosure, there may be three first data of the same type extracted from the first sliding window, for example, the time taken to recycle the three new generation data is 1s, 1.2s, and 1.1s, then the first characteristic data may be the average value of the first data, 1.1, or the maximum value of the first data, 1.2, or the minimum value of the first data, 1. In the same way, there may be three second data of the same type as the first data extracted from the second sliding window, for example, the time taken to recycle the three new generation data is 1.1s, 1.2s, and 1.3s, then the second characteristic data may be the average value of the second data, 1.2, or the minimum value of the second data, 1.1, or the maximum value of the second data, 1.3.

[0114] According to the embodiment of the present disclosure, the calculation method of the characteristic values ​​of the first characteristic data and the second characteristic data is the same. For example, when the first characteristic data selects the average value 1.1 of the first data, the second characteristic data also selects the average value 1.2 of the second data.

[0115] In operation S340, the preset time of the first sliding window and the preset time of the second sliding window are marked on the first characteristic data and the second characteristic data respectively to obtain the first time series characteristic data.

[0116] According to an embodiment of the present disclosure, the preset time includes any one of the following: a start time and an end time.

[0117] According to an embodiment of the present disclosure, the preset time may be the start time or end time of each sliding window. It should be noted that when the first feature data is marked with the start time of the first sliding window, the second feature data also needs to be marked with the start time of the second sliding window. The preset time can be extracted from the memory recovery log by a regular expression representing a timestamp. For example, if the start time of the first sliding window is t1, the start time of the second sliding window is t2, the first feature data is 1.1, and the second feature data is 1.2, then the first time series feature data is 1.1 (t1), 1.2 (t2).

[0118] According to an embodiment of the present disclosure, by extracting variable data with physical meaning from the memory recovery log and marking the time when the variable data is generated, time series feature data is obtained, so that a preset model can be used to verify the correlation between the time series feature data and memory recovery anomalies.

[0119] Figure 4 A flowchart of a method for determining conditions for triggering memory recycling exceptions from historical abnormal memory logs according to an embodiment of the present disclosure is schematically shown.

[0120] like Figure 4 As shown, the method of determining the condition for triggering the abnormality of memory recycling from the historical abnormal memory log of this embodiment includes operations S410 to S440.

[0121] In operation S410, third time series feature data and fourth time series feature data are extracted from the historical abnormal memory log, wherein the fourth time series feature data includes data showing an abnormal frequency of recycling the second type of data, and the third time series feature data has the same data type as the first time series feature data.

[0122] In operation S420, a second change trend of the third time series feature data within a preset time before the fourth time series feature data appears is analyzed.

[0123] In operation S430, a second correlation feature between the third time series feature data and the fourth time series feature data is determined according to the second change trend.

[0124] In operation S440, condition information for triggering an abnormality in memory reclaiming is determined according to the second correlation feature and the second change trend.

[0125] According to an embodiment of the present disclosure, the fourth time series feature data may be a frequency range in which new generation data and old generation data are simultaneously recycled when memory recycling is abnormal in a historical abnormal memory log. The third time series feature data may include memory space occupancy data, data on the time taken to recycle data, frequency data on the recycling of new generation data, etc. in a historical abnormal memory log.

[0126] According to an embodiment of the present disclosure, the second change trend of the third time series characteristic data can be obtained by analyzing a change curve graph of the third time series characteristic data before an abnormality occurs in memory recycling.

[0127] Figure 5a-1 and Figure 5a-2 The diagram schematically shows the frequency change curve of the new generation data and the old generation data being recovered simultaneously when an abnormality occurs in memory recovery, and the change curve of the memory space occupied by the new generation data in the same period.

[0128] like Figure 5a-1 As shown, Figure 5a-1 The horizontal axis represents time, and the vertical axis represents the number of times the new generation data and the old generation data are recycled at the same time per minute. When an abnormality occurs in memory recycling, the frequency of the new generation data and the old generation data being recycled at the same time increases rapidly. Figure 5a-2 As shown, Figure 5a-2 In the figure, the horizontal axis represents time, and the vertical axis represents the memory space occupied by the new generation data being recycled in a single time. When an exception occurs in memory recycling, the memory space curve occupied by the new generation data continues to decrease.

[0129] According to the embodiment of the present disclosure, when the frequency of the new generation data and the old generation data being recycled simultaneously rises rapidly and exceeds a preset fixed threshold, it indicates that memory recycling is abnormal. Taking the memory space occupied by the new generation data as an example, Figure 5a-2 As shown, when an abnormality occurs in memory recovery, the second change trend is a continuous decline. It can be determined that the second correlation feature is that as the third time series feature data continues to decline, the fourth time series feature data continues to rise. It can be determined that the conditional information used to trigger the memory recovery abnormality is that when the memory space occupied by the new generation data continues to decline, the frequency of the new generation data and the old generation data being recovered at the same time will increase rapidly, and memory recovery will occur abnormally.

[0130] Figure 5b-1 and Figure 5b-2The diagram schematically shows the frequency change curve of the new generation data and the old generation data being recovered simultaneously when an abnormality occurs in memory recovery, and the change curve of the time consumed for data recovery.

[0131] like Figure 5b-1 As shown, Figure 5b-1 In the figure, the horizontal axis represents time, and the vertical axis represents the number of times the new generation data and the old generation data are recycled at the same time per minute. When an abnormality occurs in memory recycling, the frequency of the new generation data and the old generation data being recycled at the same time increases rapidly. Figure 5b-2 As shown, Figure 5b-2 In the figure, the horizontal axis represents time, and the vertical axis represents the average duration of a single memory recycling. When an abnormality occurs in memory recycling, the time consumed for recycling data increases rapidly and remains in a high value range.

[0132] According to the embodiment of the present disclosure, taking the third time series characteristic data as the time taken to recycle data as an example, Figure 5b-2 As shown, when an abnormality occurs in memory recovery, the second change trend is a rapid increase. It can be determined that the second correlation feature is a rapid increase with the third time series feature data, and the fourth time series feature data continues to increase. It can be determined that the conditional information used to trigger the memory recovery abnormality is that when the time consumed for data recovery increases rapidly, the frequency of the new generation data and the old generation data being recovered at the same time will increase rapidly, and memory recovery will occur abnormally.

[0133] Figure 5c The diagram schematically shows the frequency change curve of the new generation data and the old generation data being recycled at the same time (Full GC) and the frequency change curve of the new generation data being recycled (Young GC) when an exception occurs in memory recycling.

[0134] like Figure 5c As shown, Figure 5c In the figure, the horizontal axis represents time, and the vertical axis represents the frequency of data recycling. The solid curve represents the frequency of new generation data and old generation data being recycled at the same time, and the dotted curve represents the frequency of new generation data being recycled. When memory recycling is abnormal, the frequency of new generation data and old generation data being recycled at the same time increases rapidly, and the frequency of new generation data being recycled approaches 0.

[0135] According to the embodiment of the present disclosure, the third time series feature data is the frequency of recycling the new generation data as an example. Figure 5cAs shown, when an abnormality occurs in memory recovery, the second change trend is that the curve approaches 0. It can be determined that the second correlation feature is that when the third time series feature data approaches 0 and changes little, the fourth time series feature data continues to rise. It can be determined that the conditional information used to trigger the memory recovery abnormality is that when the frequency of new generation data being recovered approaches 0 and changes little, the frequency of new generation data and old generation data being recovered at the same time will increase rapidly, and memory recovery will occur abnormally.

[0136] According to the embodiments of the present disclosure, by extracting time series feature data from historical abnormal memory logs, analyzing the changing trend of the time series feature data before the memory recovery abnormality occurs, and determining the conditional information for triggering the memory recovery abnormality, it is possible to automatically determine the conditional information for triggering the memory recovery abnormality from the changing rules of the time series feature data in the historical abnormal memory logs, thereby solving the problem in the related art that it takes a lot of time and manpower to determine the memory recovery abnormality rules relying on manual experience.

[0137] Figure 6 The flowchart of the method for detecting memory recycling anomalies according to an embodiment of the present disclosure is schematically shown.

[0138] like Figure 6 As shown, first, extract the time series data from the memory recovery log, and by calculating the characteristic values ​​of the time series data, obtain the first time series characteristic data and the second time series characteristic data respectively, and use the Mann-Kendall algorithm to calculate the change trend of the first time series characteristic data. Then determine whether the first time series characteristic data and the second time series characteristic data meet the preset rules. The preset rules include the conditional rules for triggering abnormal memory recovery obtained by analyzing the data in the historical abnormal recovery memory log, and the correlation characteristics of the first time series characteristic data and the second time series characteristic data determined by the PCMCI causal detection model and the change trend of the first time series characteristic data to determine the warning rules for characterizing abnormal memory recovery. Finally, determine whether the change trends of the first time series characteristic data, the second time series characteristic data and the first time series characteristic data meet the above-mentioned preset rules. If so, output a warning message.

[0139] According to the embodiment of the present disclosure, the warning level can also be set according to the number of preset rules met. The more the number of preset rules met, the higher the warning level, which is convenient for subsequent processing according to the warning level.

[0140] Figure 7a-7d A diagram schematically shows a comparison of detection effects using a method for detecting anomalies in memory recycling according to an embodiment of the present disclosure.

[0141] like Figure 7a As shown, Figure 7aThe horizontal axis in the middle represents time, and the vertical axis represents the number of times the new generation data and the old generation data are recycled at the same time per minute. The abnormal time of memory recycling was 10:00 on August 9. Before the abnormality of memory recycling occurred, Figure 7b As shown, Figure 7b The horizontal axis in the middle represents time, and the total axis represents the average duration of a single memory recycling. The time curve of the recycling data consumption data change curve showed a rapid increase at 18:00 on August 8. Figure 7c As shown, Figure 7c The horizontal axis in the middle represents time, and the vertical axis represents the memory space occupied by the new generation data being recycled at a single time. The data change curve of the memory space occupied by the new generation data showed a continuous decline at 18:00 on August 8. Figure 7d The following schematically shows a curve diagram of the warning level according to an embodiment of the present disclosure. Figure 7d As shown, Figure 7d The horizontal axis represents time, and the vertical axis represents the warning level of memory recycling anomaly. A warning was issued at 18:00 on August 8, and the warning level is rising as time goes by. This shows that the memory recycling anomaly detection method of the embodiment of the present disclosure can issue a warning message before the memory recycling anomaly occurs.

[0142] Based on the above memory recycling anomaly detection method, the present disclosure also provides a memory recycling anomaly detection device. Figure 8 The device is described in detail.

[0143] Figure 8 The structural block diagram of the memory recycling anomaly detection device according to an embodiment of the present disclosure is schematically shown.

[0144] like Figure 8 As shown, the memory recycling anomaly detection device 800 of this embodiment includes: an acquisition module 810, a detection module 820, a calculation module 830, and an early warning module 840. Among them, the acquisition module 810 is used to acquire the first time series feature data and the second time series feature data, wherein the first time series feature data includes any one of the following: memory space occupancy data, the time length data consumed by recycling data, and the frequency data of the recycling of the first type of data; the second time series feature data includes the frequency data of the recycling of the second type of data, and the frequency of the recycling of the first type of data is greater than the frequency of the recycling of the second type of data. The detection module 820 is used to input the first time series feature data and the second time series feature data into a preset model, and output the first correlation feature of the first time series feature data and the second time series feature data. The calculation module 830 is used to calculate the first change trend of the first time series feature data. The early warning module 840 is used to output the early warning information used to characterize that the memory recycling will be abnormal when the first change trend of the first time series feature data meets the first correlation feature.

[0145] According to an embodiment of the present disclosure, the early warning module 840 includes a first early warning unit and a second early warning unit. The first early warning unit is used to output early warning information for characterizing that an abnormality will occur in memory recycling when the correlation feature is positively correlated and the change trend of the first time series feature data is an upward trend, and the change trend of the first time series feature data meets the correlation feature. The second early warning unit is used to output early warning information for characterizing that an abnormality will occur in memory recycling when the correlation feature is negatively correlated and the change trend of the first time series feature data is a downward trend, and the change trend of the first time series feature data meets the correlation feature.

[0146] According to an embodiment of the present disclosure, the acquisition module 810 includes a first extraction unit, a second extraction unit, a calculation unit, and a marking unit. The first extraction unit is used to extract the first data from the memory recovery log according to the first sliding window. The second extraction unit is used to extract the second data from the memory recovery log according to the second sliding window, wherein the data type of the first data and the second data are the same. The calculation unit is used to calculate the characteristic values ​​of the first data and the second data respectively to obtain the first characteristic data and the second characteristic data. The marking unit is used to mark the preset time of the first sliding window and the preset time of the second sliding window on the first characteristic data and the second characteristic data respectively to obtain the first time series characteristic data.

[0147] Fig. 9 The structural block diagram of a memory recycling anomaly detection device according to some other embodiments of the present disclosure is schematically shown.

[0148] like Fig. 9 As shown, in addition to the acquisition module 810, the detection module 820, the calculation module 830, and the early warning module 840, the memory recovery anomaly detection device 800 also includes an extraction module 910, an analysis module 920, a first determination module 930, and a second determination module 940. The extraction module 910 is used to extract the third time series feature data and the fourth time series feature data from the historical abnormal memory log, wherein the fourth time series feature data includes data of abnormal frequency of recovery of the second type of data, and the third time series feature data has the same data type as the first time series feature data. The analysis module 920 is used to analyze the second change trend of the third time series feature data within a preset time before the fourth time series feature data appears. The first determination module 930 is used to determine the second correlation feature of the third time series feature data and the fourth time series feature data according to the second change trend. The second determination module 940 determines the condition information for triggering the abnormal memory recovery according to the second correlation feature and the second change trend.

[0149] According to an embodiment of the present disclosure, any multiple modules among the acquisition module 810, the detection module 820, the calculation module 830, the early warning module 840, the extraction module 910, the analysis module 920, the first determination module 930 and the second determination module 940 can be combined in one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the acquisition module 810, the detection module 820, the calculation module 830, the early warning module 840, the extraction module 910, the analysis module 920, the first determination module 930 and the second determination module 940 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation modes of software, hardware and firmware or in a suitable combination of any of them. Alternatively, at least one of the acquisition module 810, the detection module 820, the calculation module 830, the early warning module 840, the extraction module 910, the analysis module 920, the first determination module 930 and the second determination module 940 can be at least partially implemented as a computer program module, which can perform corresponding functions when the computer program module is executed.

[0150] Fig.10 A block diagram of an electronic device suitable for implementing a memory recycling anomaly detection method according to an embodiment of the present disclosure is schematically shown.

[0151] like Fig.10 As shown, the electronic device 1000 according to an embodiment of the present disclosure includes a processor 1001, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1002 or a program loaded from a storage part 1008 into a random access memory (RAM) 1003. The processor 1001 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 1001 may also include an onboard memory for caching purposes. The processor 1001 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0152] In RAM 1003, various programs and data required for the operation of electronic device 1000 are stored. Processor 1001, ROM 1002 and RAM 1003 are connected to each other via bus 1004. Processor 1001 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 1002 and / or RAM 1003. It should be noted that the program can also be stored in one or more memories other than ROM 1002 and RAM 1003. Processor 1001 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in the one or more memories.

[0153] According to an embodiment of the present disclosure, the electronic device 1000 may further include an input / output (I / O) interface 1005, which is also connected to the bus 1004. The electronic device 1000 may further include one or more of the following components connected to the I / O interface 1005: an input portion 1006 including a keyboard, a mouse, etc.; an output portion 1007 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 1008 including a hard disk, etc.; and a communication portion 1009 including a network interface card such as a LAN card, a modem, etc. The communication portion 1009 performs communication processing via a network such as the Internet. A drive 1010 is also connected to the I / O interface 1005 as needed. A removable medium 1011, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 1010 as needed, so that a computer program read therefrom is installed into the storage portion 1008 as needed.

[0154] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0155] According to an embodiment of the present disclosure, a computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus or a device. For example, according to an embodiment of the present disclosure, a computer-readable storage medium may include the ROM 1002 and / or RAM 1003 described above and / or one or more memories other than ROM 1002 and RAM 1003.

[0156] The embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program includes a program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the memory recycling anomaly detection method provided by the embodiment of the present disclosure.

[0157] The above functions defined in the system / device of the embodiment of the present disclosure are performed when the computer program is executed by the processor 1001. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0158] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices, magnetic storage devices, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of signals on a network medium, and downloaded and installed through the communication part 1009, and / or installed from the removable medium 1011. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0159] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 1009, and / or installed from the removable medium 1011. When the computer program is executed by the processor 1001, the above functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the system, device, means, module, unit, etc. described above can be implemented by a computer program module.

[0160] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0161] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0162] It will be appreciated by those skilled in the art that the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations and / or combinations are not explicitly described in the present disclosure. In particular, the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways without departing from the spirit and teachings of the present disclosure. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0163] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above separately, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. The scope of the present disclosure is defined by the attached claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A memory recycling anomaly detection method, comprising: Acquire first time series characteristic data and second time series characteristic data, wherein the first time series characteristic data includes any one of the following: memory space occupancy data, time length data consumed for data recycling, and frequency data of first type data being recycled; the second time series characteristic data includes frequency data of second type data being recycled; wherein the frequency of first type data being recycled is greater than the frequency of second type data being recycled; Input the first time series feature data and the second time series feature data into a preset model, and output a first correlation feature of the first time series feature data and the second time series feature data; wherein the preset model is a causal detection model for analyzing the causal correlation between variables; the causal detection model is composed of a PC algorithm for learning the Bayesian network structure between multiple random variables and an MCI algorithm responsible for controlling false positives for highly interdependent time series situations, so as to verify the causal relationship between each first time series feature data and the second time series feature data; Calculating a first change trend of the first time series feature data; and When the first change trend of the first time series feature data meets the first correlation feature, warning information for indicating that an abnormality may occur in memory recycling is output.

2. The method according to claim 1, wherein: The memory space usage data includes any of the following: The amount of memory space occupied before the data is recycled, the amount of memory space occupied after the data is recycled, and the amount of memory space occupied after the data is recycled; the time data consumed to recycle the data includes the time data consumed to recycle the first type of data and / or the time data consumed to recycle the second type of data.

3. The method according to claim 1, wherein: When the first change trend of the first time series feature data meets the first correlation feature, outputting warning information for indicating that memory recycling will be abnormal includes: When the first correlation feature is positively correlated and the first change trend of the first time series feature data is an upward trend, the first change trend of the first time series feature data meets the first correlation feature, and warning information indicating that memory recycling may be abnormal is output.

4. The method according to claim 1, wherein: When the first change trend of the first time series feature data meets the first correlation feature, outputting warning information for indicating that memory recycling will be abnormal includes: When the first correlation feature is negatively correlated and the first change trend of the first time series feature data is a downward trend, the first change trend of the first time series feature data meets the first correlation feature, and warning information indicating that memory recycling may be abnormal is output.

5. The method according to claim 1, further comprising: Extracting first data from the memory recycling log according to the first sliding window; Extracting second data from the memory recovery log according to the second sliding window, wherein the first data and the second data have the same data type; Calculating the characteristic values ​​of the first data and the second data respectively to obtain first characteristic data and second characteristic data; The preset time of the first sliding window and the preset time of the second sliding window are marked on the first characteristic data and the second characteristic data respectively to obtain the first time series characteristic data.

6. The method according to claim 5, wherein: The preset time includes any one of the following: start time and end time.

7. The method according to claim 5, wherein: The characteristic value includes any one of the following: average value, maximum value, and minimum value.

8. The method according to claim 1, further comprising: Extracting third time series feature data and fourth time series feature data from the historical abnormal memory log, wherein the fourth time series feature data includes data showing abnormal frequency of recycling of the second type of data, and the third time series feature data has the same data type as the first time series feature data; Analyze a second change trend of the third time series characteristic data within a preset time before the fourth time series characteristic data appears; Determine a second correlation feature between the third time series feature data and the fourth time series feature data according to the second change trend; Condition information for triggering an abnormality in memory reclaim is determined according to the second correlation feature and the second change trend.

9. A memory recycling anomaly detection device, comprising: an acquisition module, configured to acquire first time series characteristic data and second time series characteristic data, wherein the first time series characteristic data includes any one of the following: memory space occupancy data, time length data consumed for data recycling, and frequency data of first type data being recycled; the second time series characteristic data includes frequency data of second type data being recycled, and the frequency of first type data being recycled is greater than the frequency of second type data being recycled; A detection module, used for inputting the first time series feature data and the second time series feature data into a preset model, and outputting a first correlation feature of the first time series feature data and the second time series feature data; wherein the preset model is a causal detection model for analyzing the causal correlation between variables; the causal detection model is composed of a PC algorithm for learning a Bayesian network structure between multiple random variables and an MCI algorithm responsible for controlling false positives for highly interdependent time series situations, so as to verify the causal relationship between each first time series feature data and the second time series feature data; a calculation module, configured to calculate a first change trend of the first time series feature data; and The early warning module is used to output early warning information indicating that an abnormality may occur in memory recycling when the first change trend of the first time series feature data meets the first correlation feature.

10. An electronic device comprising: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors execute the method according to any one of claims 1 to 8.

11. A computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, causes the processor to execute the method according to any one of claims 1 to 8.

12. A computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the method according to any one of claims 1 to 8 is implemented.

Images