Anomaly troubleshooting method, device, equipment, medium and program product

Abstract

This disclosure provides an anomaly detection method applicable to the internet or financial sectors. The method includes: calling an SDK that records a custom method, wherein the SDK contains a memory array for storing recording parameters, including the recorded parameter value recorded during the execution of the custom method; when a program error occurs, the method includes: filtering the recorded parameters based on preset rules; storing the filtered recorded parameters in a data file stored in a local file storage unit; and transmitting the data file to a data storage system based on a first preset period to obtain the data file to be investigated. This disclosure also provides an anomaly detection device, equipment, storage medium, and program product.

Description

Technical Field

[0001] This disclosure relates to the Internet or financial fields, specifically to the analysis and investigation of program anomalies, and more specifically to an anomaly investigation method, apparatus, equipment, medium, and program product. Background Technology

[0002] In existing technologies, when an application encounters an anomaly, such as when a user encounters an error while using a function in an application software (such as a client APP), the anomaly is usually investigated and analyzed by querying the logs recorded by the backend development team or by having the user submit error information, in order to assess and resolve the specific problem encountered by the client.

[0003] In realizing the concept of this disclosure, the inventors discovered at least the following problems in the prior art:

[0004] 1. The logs recorded by the backend development are built from the perspective of backend technology and differ from the application development methods. Querying the logs of the backend development is not very helpful for application developers to analyze problems. For example, it cannot help application developers to determine in a timely manner which methods were executed in the application for a certain user operation, and what methods caused the error.

[0005] 2. When users describe the error, they may not use professional and specific error messages, but can only describe the error information in general terms. This makes it difficult for application developers to understand the user's problem in a timely manner, to troubleshoot the anomaly, and to provide a solution, which affects the user experience of the product. Summary of the Invention

[0006] In view of the above problems, embodiments of this disclosure provide methods, apparatus, devices, media, and program products for improving the efficiency of anomaly detection.

[0007] According to a first aspect of this disclosure, an anomaly detection method is provided, characterized by comprising the following steps: calling an SDK for recording a custom method, wherein the SDK includes a memory array for storing recording parameters, the recording parameters including the recording parameter value recorded during the execution of the custom method; when the program reports an error, the method comprises: filtering the recording parameters based on preset rules; storing the filtered recording parameters in a data file, the data file being stored in a local file storage unit; and transmitting the data file to a data storage system based on a first preset period to obtain the data file to be investigated.

[0008] According to an embodiment of this disclosure, the SDK for calling the custom recording method includes: an SDK initialization method for calling the custom recording method, which initializes the SDK as a singleton; and an initialization data file, which stores the recording parameter Key in the initialization data file, wherein the recording parameter Key corresponds to the recording parameter value.

[0009] According to an embodiment of this disclosure, filtering the record parameters based on preset rules includes: determining whether the execution time of the custom method before the error occurs and the execution time of the custom method after the error occurs exceed the configured time; when the execution time of the custom method before the error occurs and / or the execution time of the custom method after the error occurs exceeds the configured time, extracting the record parameters within the configured time as the record parameters to be stored.

[0010] According to an embodiment of this disclosure, when the execution time of the custom method before the error occurs and / or the execution time of the custom method after the error occurs does not exceed a pre-configured time, the recorded parameters during the execution time of the custom method before the error occurs and / or the execution time of the custom method after the error occurs are used as recorded parameters to be stored.

[0011] According to embodiments of this disclosure, the record parameter Key includes at least the terminal identifier, the name of the custom method, and the class name to which the custom method belongs.

[0012] According to an embodiment of this disclosure, the record parameter Key further includes method passing parameters, which are associated with a custom sub-method, and the custom sub-method is a subset of the custom methods.

[0013] According to an embodiment of this disclosure, the method further includes the step of obtaining the configuration time: calling a backend interface; when the backend interface call is successful, obtaining the log recording time; caching the log recording time locally and marking it as the configuration time.

[0014] According to an embodiment of this disclosure, when the backend interface call fails, the method further includes: retrieving the local default configuration time.

[0015] According to embodiments of this disclosure, when the program does not report an error, the method further includes: clearing the record parameters stored in the memory array.

[0016] According to an embodiment of this disclosure, after obtaining the data file to be investigated, the method further includes: transmitting the data file to be investigated to an analysis port based on a second preset period.

[0017] The second aspect of this disclosure provides an anomaly detection device, characterized in that it includes: a running module configured to call an SDK for recording custom methods, wherein the SDK includes a memory array for storing recording parameters; a filtering module configured to filter the recording parameters based on preset rules when the program reports an error; a storage module configured to store the filtered recording parameters in a data file, wherein the data file is stored in a local file storage unit; and a transmission module configured to transmit the data file to a data storage system based on a first preset period to obtain the data file to be investigated.

[0018] A third aspect of this disclosure provides an electronic device, comprising: one or more processors; and a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors perform the above-described anomaly detection method.

[0019] A fourth aspect of this disclosure also provides a computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, cause the processor to perform the above-described anomaly troubleshooting method.

[0020] The fifth aspect of this disclosure also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described anomaly detection method. Attached Figure Description

[0021] The foregoing contents, as well as other objects, features, and advantages of this disclosure, will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0022] Figure 1 The diagram illustrates an application scenario of the anomaly detection method according to an embodiment of the present disclosure.

[0023] Figure 2 A flowchart illustrating an anomaly detection method according to an embodiment of the present disclosure is shown schematically.

[0024] Figure 3 A flowchart illustrating an anomaly detection method according to an embodiment of the present disclosure is shown schematically.

[0025] Figure 4 A flowchart illustrating a method for obtaining configuration time according to an embodiment of the present disclosure is shown schematically.

[0026] Figure 5 A flowchart illustrating a method for filtering record parameters based on preset rules according to an embodiment of the present disclosure is shown.

[0027] Figure 6 A flowchart illustrating a method for obtaining a data file to be investigated according to an embodiment of the present disclosure is shown.

[0028] Figure 7 A flowchart illustrating a method when no error occurs in the program according to an embodiment of this disclosure is shown.

[0029] Figure 8 A schematic block diagram of an anomaly detection device according to an embodiment of the present disclosure is shown.

[0030] Figure 9 A block diagram schematically illustrates an electronic device suitable for implementing an anomaly detection method according to an embodiment of the present disclosure. Detailed Implementation

[0031] The embodiments of the present disclosure will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the disclosure. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of the present disclosure for ease of explanation. However, it will be apparent that one or more embodiments may be practiced without these specific details. Furthermore, descriptions of well-known structures and techniques are omitted in the following description to avoid unnecessarily obscuring the concepts of the present disclosure.

[0032] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit this disclosure. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0033] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0034] When using expressions such as "at least one of A, B and C", they should generally be interpreted in accordance with the meaning that is commonly understood by those skilled in the art (e.g., "a system having at least one of A, B and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B and C, etc.).

[0035] When users encounter anomalies while using various applications, such as errors occurring when a user encounters a function in a client-side app, they typically use one of two methods to troubleshoot and analyze the anomaly: 1. Querying backend development logs; 2. Analyzing the anomaly based on user-submitted error messages to assess and resolve the specific problem encountered by the client. However, both methods have the following problems: 1. Backend development logs are built from a backend technical perspective and differ somewhat from application development methods. Querying backend development logs is not very helpful for application developers to analyze problems. For example, it cannot allow application developers to effectively determine which methods were executed in the application for a user's operation, and at what point the error occurred. 2. When describing the error, users may not use professional error-reporting language, only providing general information. This hinders application developers from understanding the user's problem promptly, troubleshooting the anomaly in a timely manner, and providing solutions, thus affecting the user experience.

[0036] To address the aforementioned problems in the prior art, embodiments of this disclosure provide an anomaly detection method, apparatus, electronic device, medium, and program product. The anomaly detection method includes: invoking an SDK for recording a custom method, wherein the SDK includes a memory array for storing recording parameters, including the recording parameter `value` recorded during the execution of the custom method; when a program error occurs, the method includes: filtering the recording parameters based on preset rules; storing the filtered recording parameters in a data file, the data file being stored in a local file storage unit; and transmitting the data file to a data storage system based on a first preset period to obtain a data file to be investigated. Further, invoking the SDK for recording the custom method includes: invoking an SDK initialization method for recording the custom method to initialize the SDK as a singleton; and initializing the data file, storing the recording parameter `Key` in the initialized data file. The recording parameter `Key` corresponds to the recording parameter `value`. Specifically, it determines whether the execution time of the custom method before the error occurs and the execution time of the custom method after the error occurs exceed the configured time; when the execution time of the custom method before the error occurs and / or the execution time of the custom method after the error occurs exceeds the pre-configured time, the recorded parameters within the configured time are extracted as the recorded parameters to be stored.

[0037] The anomaly detection method provided in this disclosure instructs application developers to infer user behavior and the cause of program errors by calling the SDK of a custom method in the application and recording parameters within a preset configuration time before and after the program error occurs. This allows application developers to analyze the cause of program errors more quickly, improving the accuracy and efficiency of problem analysis. Since this anomaly detection method can be executed automatically on a regular basis, it can provide feedback to the relevant application developers after suspicious data is discovered, before customer complaints are received, thus improving user satisfaction.

[0038] It should be noted that the anomaly detection methods, apparatus, devices, media, and program products provided in this disclosure can be used in the application of Internet technology to program anomaly detection and analysis, and can also be used in various fields other than Internet technology, such as the financial field. The application fields of the anomaly detection methods, apparatus, devices, media, and program products provided in this disclosure are not limited.

[0039] The above-described operations for achieving at least one objective of this disclosure will be described below in conjunction with the accompanying drawings and their descriptions.

[0040] Figure 1 The diagram illustrates an application scenario of the anomaly detection method according to an embodiment of this disclosure. It should be noted that... Figure 1 The examples shown are merely application scenarios in which the embodiments of this disclosure can be applied, to help those skilled in the art understand the technical content of this disclosure, but do not mean that the embodiments of this disclosure cannot be used in other scenarios.

[0041] like Figure 1 As shown, application scenario 100 according to this embodiment may include terminal devices 101, 102, and 103, a network 104, and a server 105. Network 104 serves as a medium for providing a communication link between terminal devices 101, 102, and 103 and server 105. Network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0042] Users can use terminal devices 101, 102, and 103 to interact with server 105 via network 104 to receive or send messages, etc. Terminal devices 101, 102, and 103 can have the function of running applications, including client apps, installation-free applications, web applications, etc. Terminal devices 101, 102, and 103 can also have SDKs that call custom methods of applications, store data files and transfer data files to a data storage system, and call backend interfaces to obtain log recording times, etc. Various communication client applications can also be installed on terminal devices 101, 102, and 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0043] Terminal devices 101, 102, and 103 can be various electronic devices with displays and web browsing capabilities, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0044] Server 105 can be a server that provides various services, such as a backend management server for receiving data files and / or a server cluster (for example only). The backend management server can store the received data files and can also transmit the data files to be investigated to the analysis port to facilitate problem analysis by application developers.

[0045] It should be noted that the anomaly detection method provided in this embodiment can generally be executed by terminal devices 101, 102, and 103. Correspondingly, the anomaly detection device provided in this embodiment can generally be installed in terminal devices 101, 102, and 103. The anomaly detection method provided in this embodiment can also be executed by a terminal device different from terminal devices 101, 102, and 103 but capable of communicating with server 105. Correspondingly, the anomaly detection device provided in this embodiment can also be installed in a terminal device different from terminal devices 101, 102, and 103 but capable of communicating with server 105.

[0046] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0047] The following will be based on Figure 1 The described scene, through Figures 2-7 The anomaly detection method of the disclosed embodiments is described in detail.

[0048] Figure 2 A flowchart illustrating an anomaly detection method according to an embodiment of the present disclosure is shown schematically.

[0049] like Figure 2 As shown, the anomaly troubleshooting method in this embodiment includes operations S210 to S240.

[0050] When operating S210, the SDK for recording custom methods is invoked.

[0051] According to embodiments of this disclosure, an application may include a client-side APP, a mini-program embedded in a client-side APP, a web application, etc. An application may contain multiple functions. When running a certain type of function, it is usually necessary to call underlying methods and custom methods. The underlying methods are the foundation for implementing the function, while the custom methods are used to implement specific business functions within the application. Custom methods can implement business functions through mutual calls or by calling underlying methods. It should be noted that the exception handling method of this disclosure is applied to troubleshooting exceptions in custom methods during application execution.

[0052] In embodiments of this disclosure, the SDK may include a memory array. The memory array is used to store recorded parameters. After the application is started, each time a custom method in the application is executed, the recorded parameters can be stored in this memory array. The recorded parameters include the recorded parameter value recorded during the execution of the custom method, which can correspond to a recorded parameter key. The recorded parameter key can be the name of the parameter to be stored or a unique identifier other than a name, and the recorded parameter value can be a specific value corresponding to the recorded parameter key. The recorded parameter value is assigned to the memory array during the execution of the custom method according to predetermined rules, order, and format.

[0053] It's understandable that the SDK's recording start time can be preset, for example, the time when a special processing method is enabled for a specific function. Correspondingly, the SDK's recording end time can be preset, for example, the time when a special processing method is completed for a specific function, the time when a program reports an error, or the time when relevant recorded parameters for that error are stored. A typical SDK recording start time could be the time when facial recognition is enabled in a bank client's payment function, and the SDK recording end time could be the time when facial recognition is completed, the time when the client reports an error, or the time when the client returns after an error, re-enters the client or payment function for facial recognition, and fails again. Recorded parameters from the SDK's recording start to end time can be stored in a memory array for subsequent processing. When the SDK finishes recording, the memory array can be cleared, or the stored recorded parameters can be further filtered and stored as a data file for subsequent processing.

[0054] According to embodiments of this disclosure, an SDK that calls a custom method may include an initialization method.

[0055] Figure 3 A flowchart illustrating an anomaly detection method according to an embodiment of the present disclosure is shown schematically.

[0056] like Figure 3As shown, the anomaly troubleshooting method in this embodiment includes operations S310 to S320.

[0057] When operating S310, the SDK initialization method that records custom methods is called to initialize the SDK as a singleton.

[0058] In operation S320, the data file is initialized, and the record parameter Key is stored in the initialized data file, wherein the record parameter Key corresponds to the record parameter value.

[0059] According to embodiments of this disclosure, to conserve system resources and avoid errors in recording parameter processing, the SDK initialization method for recording custom methods can be called to initialize the SDK as a singleton. When initializing a singleton, the application process has only one memory address, ensuring that custom methods can only be executed through this single memory address during program execution, thus conserving system resources. Furthermore, since the SDK is a singleton, it ensures that the memory array used for storage and the memory array used for subsequent processing such as clearing are the same array, preventing execution errors when calling the SDK termination method.

[0060] In addition to initializing the SDK as a singleton, a data file can also be initialized. The data file can be a document file, such as an Excel file. Record parameter keys can be stored in the initialized data file as identifiers for storing record parameter values.

[0061] According to embodiments of this disclosure, the recorded parameter Key includes at least a terminal identifier, a custom method name, and the class name to which the custom method belongs. The terminal identifier may include a terminal ID. Taking a mobile phone as an example, the terminal identifier can be the phone's UUID, phone model, and phone operating system, where the phone's UUID is the ID that identifies each phone, the phone model is the specific model of each phone, such as iPhone 7, and the phone operating system is the operating system used by the phone when executing the current custom method, such as iOS 13.2. The custom method name includes the name of the executed custom method, which can identify the custom method corresponding to the recorded parameter. The class to which the custom method belongs contains one or more custom methods. In embodiments of this disclosure, the SDK may include the called SDK class (i.e., the specific SDK method). When using the SDK method, a singleton can be created using the SDK class name for data storage, etc.

[0062] According to embodiments of this disclosure, the recorded parameter Key may further include method passing parameters. These method passing parameters can be associated with custom sub-methods. The custom sub-methods can be a subset of the custom methods. For example, when a custom method contains m sub-methods, each corresponding to different method operation steps, the method passing parameters can be used to determine which sub-method should be executed. Specifically, custom method A may contain sub-methods B and C, and the method passing parameter param may contain 0 and 1. When custom method A is executed, the method passing parameter param determines whether to execute B or C next. When param is 0, custom method B is executed; when param is 1, custom method C is executed.

[0063] It is understandable that the recorded parameter key can also include other parameter keys that can identify the current user, such as the login mobile phone number, login user ID, etc.

[0064] When the program reports an error, operations S220 to S230 are executed.

[0065] In operation S220, record parameters are filtered based on preset rules.

[0066] It's understandable that when a program encounters an error, the SDK can record parameters for a certain period. To improve data processing efficiency and reduce transmission overhead, the recorded parameters can be filtered based on preset rules. This filtering can be based on a configured timeframe, which can be preset based on data volume and processing efficiency requirements.

[0067] Figure 4 A flowchart illustrating a method for obtaining configuration time according to an embodiment of the present disclosure is shown schematically.

[0068] like Figure 4 As shown, the method for obtaining the configuration time in this embodiment includes operations S410 to S440 or operations S410 to S420 and S450.

[0069] When operating the S410, a backend interface is called.

[0070] When operating the S420, determine whether the backend interface was successfully called.

[0071] When the backend interface call is successful, execute operation S430.

[0072] When operating S430, obtain the log recording time.

[0073] In operation S440, the log recording time is cached locally and marked as the configuration time.

[0074] When the backend interface call fails, execute operation S450.

[0075] When operating the S450, retrieve the local default time configuration.

[0076] According to embodiments of this disclosure, the configuration time can be set by the backend, for example, by a backend server. It is understood that the configuration time can be preset before executing the anomaly troubleshooting method of this disclosure. The configuration time can be obtained based on the log recording time of the backend server. The log recording time can be obtained when the terminal device calls the backend interface and the call is successful. After caching the log recording time locally, it can be marked as the configuration time. It is understood that when the terminal device calls the backend interface and the call fails, the log recording time cannot be obtained. In this case, the local default configuration time can be retrieved. The local default configuration time can be a local configuration of the terminal device or a retained value of the configuration time previously obtained from the backend. It is understood that the configuration time can be flexibly adjusted and updated based on the execution effect of the anomaly troubleshooting method of this disclosure.

[0077] Figure 5 A flowchart illustrating a method for filtering record parameters based on preset rules according to an embodiment of the present disclosure is shown.

[0078] like Figure 5 As shown, the method for filtering record parameters based on preset rules in this embodiment includes operations S510 to S520 or operations S510 and S530.

[0079] When operating S510, determine whether the execution time of the custom method before the error occurs and the execution time of the custom method after the error occurs exceed the configured time.

[0080] If at least one of the execution times of the custom method before the error occurs or the execution time of the custom method after the error occurs exceeds the configured time, operation S520 is executed.

[0081] In operation S520, when the execution time of the custom method before the error occurs and / or the execution time of the custom method after the error occurs exceeds the configured time, the recorded parameters within the configured time are extracted as the recorded parameters to be stored.

[0082] According to embodiments of this disclosure, a period of time before and after an error can be set as the configuration time. Furthermore, recorded parameters can be filtered based on the configuration time. Typical configuration time can be calculated in minutes, such as 3 minutes, 5 minutes, 10 minutes, etc. When a program encounters an error, it can be determined whether the execution time of the custom method before and after the error exceeds the configuration time. When the execution time of the custom method before and / or after the error exceeds the configuration time, recorded parameters within the configuration time can be extracted as recorded parameters to be stored. For example, data exceeding 3 minutes before and after the error in the SDK's memory array can be deleted, and data within 3 minutes before and after the error can be used as recorded parameters to be stored.

[0083] It is understood that when the execution time of the custom method before the error occurs and / or the execution time of the custom method after the error occurs does not exceed the pre-configured time, operation S530 is executed.

[0084] In operation S530, the recorded parameters of the custom method execution time before the error occurred and / or the custom method execution time after the error occurred are used as the recorded parameters to be stored.

[0085] After filtering the recorded parameters, return to operation S230.

[0086] In operation S230, the filtered record parameters are stored to the data file.

[0087] According to embodiments of this disclosure, the data file is stored in a local file storage unit. A typical local file storage unit may include a sandbox, sand table, or sandpit. Data files, including Excel files, can be stored in a local file storage unit such as a sandbox to facilitate retrieval of the data file to be investigated.

[0088] In operation S240, the data file is transmitted to the data storage system based on the first preset cycle to obtain the data file to be investigated.

[0089] According to embodiments of this disclosure, after acquiring the data file, the method further includes the step of transmitting the data file to the data storage system according to a first preset period. After acquiring the data file containing error information, it can be immediately transmitted to the data storage system. It is understood that, to reduce unnecessary data transmission overhead, it is not necessary to immediately transmit the data file to the data storage system. For example, a data file can be recorded when a special processing method of a certain function in a program encounters an error. After the function is completed, other functions of the current program can continue to be used, and operations S210 to S230 can be repeated. When other functions encounter errors, the recording parameters containing error information can be sequentially recorded into the data file according to the error time sequence, and then the data file can be transmitted to the data storage system according to the first preset period. The first preset period can be a preset time interval, which can be set in minutes, hours, or days. The time interval can also be a preset operation, such as a user killing a process and restarting it. When a user kills a process and restarts it, the data file can be transmitted to the data storage system. The data storage system can store persistent data files for subsequent anomaly investigation and analysis. It is understandable that when data files are transferred to a data storage system, the data files stored locally on the terminal device can be deleted to reduce data storage overhead.

[0090] In a specific example, when a user kills and restarts the process, the Excel data file can be compressed into a zip archive and uploaded to the backend server via a relevant interface. Simultaneously, the data file in the application's sandbox is deleted. The backend server then persists the received Excel data to a database for later use.

[0091] According to the anomaly troubleshooting method of the embodiments of this disclosure, after obtaining the data file to be investigated in operation S240, the method may further include the step of data file transmission.

[0092] Figure 6 A flowchart illustrating a method for obtaining a data file to be investigated according to an embodiment of the present disclosure is shown.

[0093] like Figure 6 As shown, the method for obtaining the data file to be investigated in this embodiment includes operation S610.

[0094] During operation S610, the data file to be investigated is transmitted to the analysis port based on the second preset cycle.

[0095] According to embodiments of this disclosure, after acquiring the data file to be investigated, it can be immediately transmitted to the analysis port. The analysis port can be connected to a backend server or to other terminal devices used by the program developers. The counterpart to the analysis port connection is not limited, as long as the program developers can receive it. Once the data file to be investigated is transmitted to the analysis port, the program developers can perform data analysis based on different dimensions of the recorded parameters to investigate anomalies. For example, user behavior analysis can be performed on error reports based on terminal identifiers to determine if the current program error is a problem with the program itself. It is understood that to reduce unnecessary data transmission overhead, the data file to be investigated may not need to be transmitted to the analysis port immediately. For example, the data file to be investigated may be transmitted to the analysis port based on a second preset period. The second preset period can be preset in hours / days / months / quarters / half-years. It is understood that the second preset period can be flexibly adjusted based on factors such as program error frequency and program maintenance cycle.

[0096] It should be noted that steps S210 to S240 are executed when a program error occurs. When no error occurs, steps S220 to S240 do not need to be executed. Specifically, when no error occurs, step S250 can be executed after step S210.

[0097] Figure 7 A flowchart illustrating a method when no error occurs in the program according to an embodiment of this disclosure is shown.

[0098] like Figure 7 As shown, the method in this embodiment when no error occurs includes operation S210 and operation S250.

[0099] When operating S210, the SDK for recording custom methods is invoked.

[0100] In operation S250, the record parameters stored in the memory array are cleared.

[0101] According to embodiments of this disclosure, the method for calling the SDK's custom method can be the same as when the program reports an error, and will not be described again here. It is understood that when the program does not report an error, there is no need for subsequent exception investigation and analysis, and therefore no need to extract the record parameters stored in the memory array to the data file. To reduce data storage overhead, the record parameters stored in the memory array can be cleared, and the currently executing SDK method can be terminated.

[0102] The anomaly detection method provided in this disclosure, by calling the SDK of a custom method in the application, records parameters of the user's operation behavior and the cause of the program error within a preset configuration time before and after the program error occurs, thereby inferring the user's operation behavior and the cause of the program error. This enables application developers to analyze the cause of program errors more quickly, improving the accuracy and efficiency of problem analysis. By automatically executing the anomaly detection method of this disclosure through a preset time period, feedback can be provided to the relevant application developers after suspicious data is discovered, before customer complaints are received, which helps to improve user satisfaction.

[0103] Based on the above-mentioned anomaly detection method, this disclosure also provides an anomaly detection device. The following will be combined with... Figure 8 The device is described in detail.

[0104] Figure 8 A schematic block diagram of an anomaly detection device according to an embodiment of the present disclosure is shown.

[0105] like Figure 8 As shown, the anomaly detection device 800 of this embodiment includes an operation module 810, a filtering module 820, a storage module 830, and a transmission module 840.

[0106] The runtime module 810 is configured to call an SDK that records custom methods, wherein the SDK contains a memory array for storing record parameters.

[0107] The storage module 830 is configured to store the filtered record parameters to a data file, which is stored in a local file storage unit.

[0108] The transmission module 840 is configured to transmit the data file to the data storage system based on a first preset period to obtain the data file to be investigated.

[0109] According to embodiments of this disclosure, any plurality of modules among the operation module 810, filtering module 820, storage module 830, and transmission module 840 can be combined into one module, or any one of these modules can be split into multiple modules. Alternatively, at least part of the functionality of one or more of these modules can be combined with at least part of the functionality of other modules and implemented in one module. According to embodiments of this disclosure, at least one of the operation module 810, filtering module 820, storage module 830, and transmission module 840 can be at least partially implemented as hardware circuitry, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or implemented in hardware or firmware by any other reasonable means of integrating or packaging circuitry, or implemented in software, hardware, or firmware, or in any suitable combination of any of these three implementation methods. Alternatively, at least one of the operation module 810, filtering module 820, storage module 830, and transmission module 840 can be at least partially implemented as a computer program module, which, when run, can perform corresponding functions.

[0110] Figure 9 A block diagram schematically illustrates an electronic device suitable for implementing an anomaly detection method according to an embodiment of the present disclosure.

[0111] like Figure 9 As shown, an electronic device 900 according to an embodiment of the present disclosure includes a processor 901, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 902 or a program loaded from a storage portion 908 into a random access memory (RAM) 903. The processor 901 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 901 may also include onboard memory for caching purposes. The processor 901 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0112] RAM 903 stores various programs and data required for the operation of electronic device 900. Processor 901, ROM 902, and RAM 903 are interconnected via bus 904. Processor 901 performs various operations of the method flow according to embodiments of the present disclosure by executing programs in ROM 902 and / or RAM 903. It should be noted that the programs may also be stored in one or more memories other than ROM 902 and RAM 903. Processor 901 may also perform various operations of the method flow according to embodiments of the present disclosure by executing programs stored in said one or more memories.

[0113] According to embodiments of this disclosure, the electronic device 900 may further include an input / output (I / O) interface 905, which is also connected to a bus 904. The electronic device 900 may also include one or more of the following components connected to the I / O interface 905: an input section 906 including a keyboard, mouse, etc.; an output section 907 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 908 including a hard disk, etc.; and a communication section 909 including a network interface card such as a LAN card, modem, etc. The communication section 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to the I / O interface 905 as needed. A removable medium 911, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 910 as needed so that computer programs read from it can be installed into the storage section 908 as needed.

[0114] This disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs that, when executed, implement the method according to the embodiments of this disclosure.

[0115] According to embodiments of this disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, such as including, but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this disclosure, the computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this disclosure, the computer-readable storage medium may include ROM 902 and / or RAM 903 and / or one or more memories other than ROM 902 and RAM 903 described above.

[0116] Embodiments of this disclosure also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code is used to enable the computer system to implement the anomaly detection method provided in the embodiments of this disclosure.

[0117] When the computer program is executed by the processor 901, it performs the functions defined in the system / apparatus of this disclosure embodiments. According to embodiments of this disclosure, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0118] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and downloaded and installed via the communication section 909, and / or installed from a removable medium 911. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0119] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 909, and / or installed from the removable medium 911. When the computer program is executed by the processor 901, it performs the functions defined in the system of this disclosure embodiment. According to embodiments of this disclosure, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0120] According to embodiments of this disclosure, program code for executing the computer programs provided in embodiments of this disclosure can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can execute entirely on a user's computing device, partially on a user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0121] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0122] Those skilled in the art will understand that the features described in the various embodiments and / or claims of this disclosure can be combined or combined in various ways, even if such combinations or combinations are not explicitly described in this disclosure. In particular, the features described in the various embodiments and / or claims of this disclosure can be combined or combined in various ways without departing from the spirit and teachings of this disclosure. All such combinations and / or combinations fall within the scope of this disclosure.

[0123] The embodiments of this disclosure have been described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of this disclosure. Although various embodiments have been described above, this does not mean that the measures in the various embodiments cannot be used advantageously in combination. The scope of this disclosure is defined by the appended claims and their equivalents. Various substitutions and modifications can be made by those skilled in the art without departing from the scope of this disclosure, and all such substitutions and modifications should fall within the scope of this disclosure.

Claims

1. An abnormality troubleshooting method characterized by comprising: Includes the following steps: An SDK for recording custom methods is invoked, wherein the SDK contains a memory array for storing recording parameters, including the recording parameter value recorded during the execution of the custom method; When the program reports an error, the method includes: The record parameters are filtered based on preset rules, wherein the filtering is performed based on a configuration time, which is preset based on the data volume and processing efficiency requirements. The filtered record parameters are stored in a data file, which is stored in a local file storage unit; and The data file is transmitted to the data storage system based on a first preset period to obtain the data file to be investigated, and the data file to be investigated is transmitted to the analysis port based on a second preset period. The filtering of the record parameters based on preset rules includes: Determine whether the execution time of the custom method before the error occurs and the execution time of the custom method after the error occurs exceed the configured time. When the execution time of the custom method before the error occurs and / or the execution time of the custom method after the error occurs exceeds the configured time, the recorded parameters within the configured time are extracted as the recorded parameters to be stored. If the execution time of the custom method before the error occurs and / or the execution time of the custom method after the error occurs does not exceed the configured time, the recorded parameters within the execution time of the custom method before the error occurs and / or the execution time of the custom method after the error occurs will be used as the recorded parameters to be stored.

2. The abnormality investigation method according to claim 1, wherein The SDK for recording custom methods includes: Call the SDK initialization method that records custom methods to initialize the SDK as a singleton; and Initialize the data file and store the record parameter Key in the initialization data file, wherein the record parameter Key corresponds to the record parameter value.

3. The anomaly detection method according to claim 2, wherein, The record parameter Key must include at least the terminal identifier, the name of the custom method, and the class name to which the custom method belongs.

4. The anomaly detection method according to claim 3, wherein, The record parameter Key also includes method passing parameters, which are associated with custom sub-methods and are subsets of custom methods.

5. The anomaly detection method according to claim 1, wherein, The method also includes the step of obtaining the configuration time: Call the backend interface; When the backend interface call is successful, obtain the log recording time; The log recording time is cached locally and marked as the configuration time.

6. The anomaly detection method according to claim 5, wherein, When the backend interface call fails, the method further includes: Retrieve the local default time configuration.

7. The anomaly detection method according to claim 1, wherein, When the program does not report an error, the method further includes: Clear the record parameters stored in the memory array.

8. An anomaly detection device, characterized in that, include: The running module is configured to call the SDK for recording custom methods, wherein the SDK contains a memory array for storing recording parameters; The filtering module is configured to filter the recorded parameters based on preset rules when the program reports an error. The filtering is performed based on a configured time, which is preset based on the data volume and processing efficiency requirements. The storage module is configured to store the filtered record parameters into a data file, wherein the data file is stored in a local file storage unit; The transmission module is configured to transmit the data file to the data storage system based on a first preset period, obtain the data file to be investigated, and transmit the data file to be investigated to the analysis port based on a second preset period; The filtering of the record parameters based on preset rules includes: Determine whether the execution time of the custom method before the error occurs and the execution time of the custom method after the error occurs exceed the configured time. When the execution time of the custom method before the error occurs and / or the execution time of the custom method after the error occurs exceeds the configured time, the recorded parameters within the configured time are extracted as the recorded parameters to be stored. If the execution time of the custom method before the error occurs and / or the execution time of the custom method after the error occurs does not exceed the configured time, the recorded parameters within the execution time of the custom method before the error occurs and / or the execution time of the custom method after the error occurs will be used as the recorded parameters to be stored.

9. An electronic device, comprising: One or more processors; Storage device for storing one or more programs. Wherein, when the one or more programs are executed by the one or more processors, the one or more processors perform the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, cause the processor to perform the method according to any one of claims 1 to 7.

11. A computer program product comprising a computer program that, when executed by a processor, implements the method according to any one of claims 1 to 7.

Images