Anomaly detection method, device, equipment and storage medium

Abstract

The embodiments of the present application disclose an anomaly detection method, apparatus, device and storage medium, wherein the method comprises: obtaining first configuration information of a target version; performing a similarity comparison between the first configuration information and preset configuration information to obtain a first comparison result; obtaining a first similarity threshold of the target version; and determining that the first configuration information of the target version is abnormal if the first comparison result does not meet the first similarity threshold.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of electronic information, and relate to but are not limited to an abnormality detection method, device, equipment and storage medium. Background Art

[0002] During the application change process, the number of configuration items in the configuration file changes is relatively small, and the configuration items in the same version and the same cluster are roughly the same, that is, highly similar. However, there are also some scenarios where the configuration items of different nodes are different.

[0003] In this way, during the release process, risks caused by configuration files are usually difficult to identify. Usually, application function or performance anomalies are discovered first, and configuration file problems are gradually identified. In addition, the workload of troubleshooting configuration files, especially cluster environment configuration files, is very large, which also results in a long problem location cycle and slow problem solving. Summary of the invention

[0004] In view of this, embodiments of the present application provide an anomaly detection method, apparatus, device, and storage medium.

[0005] The technical solution of the embodiment of the present application is implemented as follows:

[0006] In a first aspect, an embodiment of the present application provides an anomaly detection method, the method comprising: obtaining first configuration information of a target version; comparing the first configuration information with preset configuration information for similarity to obtain a first comparison result; obtaining a first similarity threshold of the target version; and determining that the first configuration information of the target version is abnormal if the first comparison result does not meet the first similarity threshold.

[0007] In a second aspect, an embodiment of the present application provides an anomaly detection device, which includes: a first acquisition module, used to acquire first configuration information of a target version; a first comparison module, used to compare the first configuration information with preset configuration information for similarity to obtain a first comparison result; a second acquisition module, used to acquire a first similarity threshold of the target version; and a first determination module, used to determine that the first configuration information of the target version is abnormal when the first comparison result does not meet the first similarity threshold.

[0008] In a third aspect, an embodiment of the present application provides an electronic device, including a memory and a processor, wherein the memory stores a computer program that can be executed on the processor, and the processor implements the above method when executing the program.

[0009] In a fourth aspect, an embodiment of the present application provides a storage medium storing executable instructions for causing a processor to execute and implement the above method.

[0010] In the embodiment of the present application, firstly, the first configuration information of the target version is obtained; then the first configuration information is compared with the preset configuration information for similarity to obtain a first comparison result; the first similarity threshold of the target version is obtained; finally, if the first comparison result does not meet the first similarity threshold, it is determined that the first configuration information of the target version is abnormal. In this way, the first configuration information of the target version can be effectively determined to be abnormal, the cycle of locating the problem can be shortened, the speed of problem solving can be effectively improved, and the actual needs of users can be met. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Figure 1 A schematic diagram of an implementation flow of an anomaly detection method provided in an embodiment of the present application;

[0012] Figure 2 A schematic diagram of an implementation flow of an anomaly detection method provided in an embodiment of the present application;

[0013] Figure 3 A schematic diagram of an implementation flow of an anomaly detection method provided in an embodiment of the present application;

[0014] Figure 4A A flowchart of an anomaly detection method based on historical version data provided in an embodiment of the present application;

[0015] Figure 4B A flowchart of a method for analyzing node configuration parameters and detecting anomalies in a cluster environment provided by an embodiment of the present application;

[0016] Figure 5 A schematic diagram of the structure of an abnormality detection device provided in an embodiment of the present application;

[0017] Figure 6 A hardware entity schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0018] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the specific technical solution of the embodiments of the present application will be further described in detail below in conjunction with the drawings in the embodiments of the present application. The following embodiments are used to illustrate the present application, but are not used to limit the scope of the present application.

[0019] In the following description, reference is made to “some embodiments”, which describe a subset of all possible embodiments, but it will be understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0020] In the following description, the terms "first\second\third" involved are merely used to distinguish similar objects and do not represent a specific ordering of the objects. It can be understood that "first\second\third" can be interchanged with a specific order or sequence where permitted, so that the embodiments of the present application described here can be implemented in an order other than that illustrated or described here.

[0021] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0022] Before further describing the embodiments of the present application in detail, the nouns and terms involved in the embodiments of the present application are explained. The nouns and terms involved in the embodiments of the present application are subject to the following interpretations.

[0023] DevOps, a combination of Development and Operations, is a collective term for a set of processes, methods and systems that are used to promote communication, collaboration and integration between development (application / software engineering), technical operations and quality assurance (QA) departments. DevOps is a model of IT service management that uses automation tools such as continuous delivery to achieve "rapid delivery of value."

[0024] Automated Continuous Integration (CI) / Continuous Delivery (CD) tools. Continuous integration is the process of automatically detecting, pulling, building, and (in most cases) unit testing after source code changes; continuous delivery is a software engineering method that allows software to be produced in a short cycle to ensure that the software can be reliably released at any time. Its purpose is to build, test, and release software faster and more frequently.

[0025] OpenStack is an open source cloud computing management platform project, which is a combination of a series of software open source projects. It is a cloud platform management project, not a software. This project is composed of several main components to complete some specific tasks.

[0026] Ceph, a free software distributed file system.

[0027] Hadoop is a distributed system infrastructure. Users can develop distributed programs without understanding the underlying details of the distributed system, making full use of the power of clusters for high-speed computing and storage.

[0028] The SimHash algorithm maps high-dimensional feature vectors into low-dimensional feature vectors through dimensionality reduction, and determines whether the articles are duplicates or highly similar through the Hamming distance between the two vectors.

[0029] The present application embodiment provides an abnormality detection method, such as Figure 1 As shown, the method includes:

[0030] Step S110, obtaining first configuration information of the target version;

[0031] Here, the target version can be any package in the version library. For example, a newly added package in the version library can be determined as the target version. During the implementation process, during the application upgrade or change process, an updated package will be required to support the upgrade or change of the application.

[0032] Different applications correspond to different configuration information. For example, the configuration information may include the IP address of the application, the application name, the setting path of the application, the version number of the application, etc.

[0033] After determining the target version to be detected, the first configuration information of the target version may be obtained first, that is, the application IP address, application name, application setting path, and application version number corresponding to the target version may be obtained.

[0034] Step S120: performing a similarity comparison between the first configuration information and the preset configuration information to obtain a first comparison result;

[0035] In some embodiments, the preset configuration information may be set by the user according to needs, that is, fixed preset configuration information.

[0036] In some embodiments, the preset configuration information may also be dynamically determined by the system based on the configuration information of the historical version stored in the version library, that is, dynamic preset configuration information. For example, the user may select any version of configuration information in the version library as the preset configuration information.

[0037] In some embodiments, a text similarity algorithm can be used to perform anomaly detection, complete the similarity comparison between the first configuration information and the preset configuration information, and obtain a first comparison result. Here, the text similarity algorithm includes at least the following two methods: one is to map the text to the vector space, and then use methods such as cosine similarity, where the cosine similarity algorithm measures the similarity by measuring the cosine value of the angle between two vectors; the second is the SimHash algorithm, which maps high-dimensional feature vectors into low-dimensional feature vectors through dimensionality reduction, and determines whether the article is repeated or highly similar through the Hamming distance of the two vectors. During the implementation process, any of the above text similarity algorithms can be selected, or the two algorithms can be used in combination. Of course, other text similarity algorithms can also be used.

[0038] Step S130, obtaining a first similarity threshold of the target version;

[0039] In some embodiments, the first similarity threshold may be set by the user according to needs, that is, a fixed similarity threshold. For example, the user may set the first similarity threshold to be greater than 90% similarity.

[0040] In some embodiments, the first similarity threshold can be dynamically determined by the system according to the configuration information of the historical versions stored in the version library, that is, a dynamic first similarity threshold. In the implementation process, the similarity threshold can be obtained by dynamically calculating the configuration of the historical versions, or the dynamic threshold can be set according to the distribution of the historical versions.

[0041] Step S140: When the first comparison result does not meet the first similarity threshold, determine that the first configuration information of the target version is abnormal.

[0042] Here, since the number of configuration item changes in the configuration file is small in most application update or change processes, and the configuration items in the same version (including minor versions and minor versions) are roughly the same, that is, highly similar, when it is determined that the first comparison result does not meet the first similarity threshold, it can be determined that the first configuration information of the target version is abnormal.

[0043] When it is determined that the first configuration information of the target version is abnormal, it can be reported by triggering a risk alarm so that users can discover and solve version problems in a timely manner, effectively shorten the problem location cycle, and improve the speed of problem solving.

[0044] During the implementation process, you can set the applicable version range and the inapplicable version range to reduce the occurrence of false positives.

[0045] In the embodiment of the present application, firstly, the first configuration information of the target version is obtained; then the first configuration information is compared with the preset configuration information for similarity to obtain a first comparison result; the first similarity threshold of the target version is obtained; finally, if the first comparison result does not meet the first similarity threshold, it is determined that the first configuration information of the target version is abnormal. In this way, the first configuration information of the target version can be effectively determined to be abnormal, the cycle of locating the problem can be shortened, the speed of problem solving can be effectively improved, and the actual needs of users can be met.

[0046] In some embodiments, the above step S130 "obtaining the first similarity threshold of the target version" can be implemented by the following steps:

[0047] When it is determined within a preset period that the number of historical versions reaches a number threshold, the first similarity threshold is dynamically acquired based on at least two of the historical versions.

[0048] In some embodiments, the user can set a preset period and a threshold value of the number of historical versions according to needs, and dynamically obtain the first similarity threshold when the number of historical versions reaches the threshold value within the preset period. For example, if the version update speed is fast, 3 days can be set as the preset period, and if the version update speed is slow, one week can be set as the preset period.

[0049] In some embodiments, only a threshold value for the number of historical versions may be set, that is, when the number of historical versions reaches the threshold value, the first similarity threshold value is dynamically acquired.

[0050] During the implementation process, a text similarity algorithm can be used for anomaly detection, and the first similarity threshold can be dynamically obtained based on at least two of the historical versions. Here, the text similarity algorithm includes at least the following two methods: one is to map the text to a vector space, and then use methods such as cosine similarity; the other is the SimHash algorithm. During the implementation process, any of the above text similarity algorithms can be selected, or the two algorithms can be used in combination. Of course, other text similarity algorithms can also be used.

[0051] In the embodiment of the present application, when it is determined that the number of historical versions reaches a quantity threshold within a preset period, the first similarity threshold is dynamically obtained based on at least two of the historical versions. In this way, the dynamically obtained first similarity threshold is effectively adjusted according to the configuration information of the historical versions, which can effectively improve the accuracy of determining whether the target version is abnormal.

[0052] In some embodiments, the first configuration information includes at least: the number of first configuration parameters and / or the range of first configuration parameters; the preset configuration information includes at least: the number of second configuration parameters and / or the range of second configuration parameters; the above step S120 "comparing the first configuration information with the preset configuration information for similarity to obtain a first comparison result" can be implemented by the following steps:

[0053] Step 121: performing a similarity comparison between the first configuration parameter quantity and the second configuration parameter quantity to obtain the quantity similarity of the configuration parameters; and / or,

[0054] Step 122: perform a similarity comparison between the first configuration parameter range and the second configuration parameter range to obtain the range similarity of the configuration parameters.

[0055] The configuration file of the target version is parsed to obtain the first configuration information, and the configuration item difference characteristics with the second configuration information of the historical version can be determined based on the first configuration information. Here, the difference comparison content may include: the number of configuration parameters and the range of configuration parameters. To determine the number of unchanged configuration parameters, the number of changed configuration parameters, the range of unchanged configuration parameters, and the range of changed configuration parameters.

[0056] During the implementation process, the number of the first configuration parameters and the number of the second configuration parameters can be compared for similarity to obtain the quantity similarity of the configuration parameters. For example, when the number of the first configuration parameters and the number of the second configuration parameters do not change, the quantity similarity is 100%; if the number of the first configuration parameters is different from the number of the second configuration parameters, the quantity similarity can be calculated based on the actual situation.

[0057] During the implementation process, the first configuration parameter range and the second configuration parameter range can also be compared for similarity to obtain the range similarity of the configuration parameters. For example, when the first configuration parameter range is the same as the second configuration parameter range, the range similarity is 100%; if the first configuration parameter range is different from the second configuration parameter range, the range similarity can be calculated based on the actual situation.

[0058] In the embodiment of the present application, the first configuration parameter quantity is compared with the second configuration parameter quantity to obtain the quantity similarity of the configuration parameters; and / or the first configuration parameter range is compared with the second configuration parameter range to obtain the range similarity of the configuration parameters. Similarly, by calculating the similarity based on the two dimensions of parameter quantity and parameter range, the similarity between the version configuration information can be effectively determined.

[0059] In some embodiments, the preset configuration information includes the second configuration information of the historical version; the first similarity threshold includes a first version similarity threshold and a second version similarity threshold, wherein the first version similarity threshold is less than the second version similarity threshold; the above step S130 "obtaining the first similarity threshold of the target version" can be implemented by the following steps:

[0060] Step 131: when it is determined based on the identifier of the target version and the identifier of the historical version that the relationship between the target version and the historical version is a first relationship, obtaining a first version similarity threshold based on second configuration information of at least two historical versions having a relationship of the first relationship;

[0061] Here, the identifier of the target version is an identifier that can distinguish the target version from other versions. For example, the identifier can be the version number of the target version, or the time when the target version is uploaded to the version library.

[0062] During implementation, in order to distinguish between versions with larger differences and versions with smaller differences, major version relationships and minor version relationships may be set, that is, the differences between versions satisfying the major version relationship are larger, and the differences between versions satisfying the minor version relationship are smaller.

[0063] When the first configuration information of the target version is compared with the second configuration information of other historical versions, multiple similarity thresholds can be set according to actual needs, and the value of each similarity threshold is different.

[0064] Here, the first relationship may be a major version relationship, that is, when the relationship between the target version and the historical version is a major version relationship, the major version similarity threshold may be determined based on the second configuration information of at least two historical versions that are in a major version relationship.

[0065] Step 132: When it is determined that the relationship between the target version and the historical version is a second relationship based on the identifier of the target version and the identifier of the historical version, obtain a second version similarity threshold based on second configuration information of at least two historical versions having the second relationship.

[0066] Here, the second relationship may be a minor version relationship, that is, when the relationship between the target version and the historical version is a minor version relationship, the minor version similarity threshold may be determined based on the second configuration information of at least two historical versions that are in a minor version relationship. Since the differences between versions that satisfy the major version relationship are large, and the differences between versions that satisfy the minor version relationship are small, the major version similarity threshold is smaller than the minor version similarity threshold. That is, the first version similarity threshold is smaller than the second version similarity threshold.

[0067] In actual use, users can customize the number of similarity thresholds without limiting the number.

[0068] In the embodiment of the present application, the first similarity threshold includes a first version similarity threshold and a second version similarity threshold. The user can set the comparison object of the target version according to the actual situation, and select an appropriate first similarity threshold based on the version relationship between the target version and the comparison object, which can effectively improve the accuracy of anomaly detection.

[0069] The present application embodiment provides an abnormality detection method, such as Figure 2 As shown, the following steps are included:

[0070] Step S210, obtaining first configuration information of the target version;

[0071] Step S220: performing a similarity comparison between the first configuration information and the preset configuration information to obtain a first comparison result;

[0072] Step S230, obtaining a first similarity threshold of the target version;

[0073] Step S240: If the first comparison result does not meet the first similarity threshold, determine that the first configuration information of the target version is abnormal;

[0074] Step S250: When the first comparison result meets the similarity threshold, deploy the target version in a cluster including at least two nodes;

[0075] Here, when the first comparison result satisfies the similarity threshold, that is, it is determined that the first configuration information of the target version is normal, the target version can be deployed normally, that is, the target version is deployed in a cluster including at least two nodes.

[0076] Step S260: Obtain a configuration parameter set for deploying the target version on each of the nodes, wherein the configuration parameter set includes a first parameter and a second parameter;

[0077] Step S270: Compare the configuration parameter sets of any two of the nodes to determine at least one of the first parameters that is consistently configured on each of the nodes, and at least one of the second parameters that is differently configured between any two of the nodes;

[0078] During the implementation process, it is first necessary to obtain the configuration parameter set of each node, and then compare the configuration parameter sets of any two nodes to obtain two types of parameters: the first parameter is the parameter that is configured consistently on each node; the second parameter is the parameter that has configuration differences between any two nodes. For example, the setting path and version number of the application in the first configuration information of the target version are the same on each node, which can be determined as the first parameter; the application IP address in the first configuration information of the target version is different on each node, which can be determined as the second parameter.

[0079] Step S280: When it is determined that the second parameter is the same for some nodes in the cluster and different for other nodes in the cluster, determine that the second parameter configuration is abnormal.

[0080] During implementation, if the second parameter is a parameter that is different in each node, then when the second parameter is the same in some nodes in the cluster and different in other nodes in the cluster, it can be determined that the second parameter configuration is abnormal.

[0081] When it is determined that the second parameter configuration of the target version is abnormal, it can be reported by triggering a risk alert so that users can promptly discover configuration problems of the target version and solve them, effectively shortening the problem location cycle and improving the speed of problem solving.

[0082] During the implementation process, you can set the applicable version range and the inapplicable version range to reduce the occurrence of false positives.

[0083] In an embodiment of the present application, when the first comparison result meets the similarity threshold, the target version is deployed in a cluster including at least two nodes; the configuration parameter set of the target version deployed in each of the nodes is obtained; the configuration parameter sets of any two nodes are compared to determine at least one of the first parameters that are consistently configured on each of the nodes, and at least one of the second parameters that are differently configured between any two nodes; when it is determined that the second parameter is the same for some nodes in the cluster and different for the remaining nodes in the cluster, it is determined that the second parameter configuration is abnormal. In this way, when the target version is deployed in a cluster including at least two nodes, the parameter configuration anomaly during the deployment of the target version can be effectively determined, so that the user can promptly discover the configuration problem of the target version, solve the configuration problem, effectively shorten the problem location cycle, and improve the speed of problem solving.

[0084] In some embodiments, Figure 3 As shown, the anomaly detection method also includes the following steps:

[0085] Step S310: when it is determined that the second parameters corresponding to any node in the cluster are different, obtaining a second similarity threshold of the second parameter;

[0086] Here, the second similarity threshold can be set by the user according to actual needs. For example, when the second parameter is the application IP address in the first configuration information, since the IP address of each node is relatively fixed, the second similarity threshold can be set according to the difference in IP addresses. In the implementation process, the text similarity algorithm can be used for anomaly detection to obtain the second similarity threshold of the second parameter. Here, the text similarity algorithm includes at least the following two methods: one is to map the text to the vector space, and then use methods such as cosine similarity; the other is the SimHash algorithm. In the implementation process, any of the above text similarity algorithms can be selected, or the two algorithms can be used in combination. Of course, other text similarity algorithms can also be used.

[0087] Step S320: performing a similarity comparison on the second parameters between the arbitrary two nodes to obtain a second comparison result;

[0088] In some embodiments, a text similarity algorithm can be used for anomaly detection, and the second parameter between any two nodes is compared for similarity to obtain a second comparison result. Here, the text similarity algorithm includes at least the following two methods: one is to map the text to a vector space, and then use methods such as cosine similarity; the other is the SimHash algorithm. In the implementation process, any of the above text similarity algorithms can be selected, or the two algorithms can be used in combination, and of course other text similarity algorithms can also be used.

[0089] Step S330: When the second comparison result does not meet a second similarity threshold, determine that the second parameter is abnormal.

[0090] During implementation, if it is determined based on the second comparison result that the difference between the second parameter at any two nodes is large, that is, the second similarity threshold is not met, it can be determined that the second parameter is abnormal.

[0091] In the embodiment of the present application, when it is determined that the second parameter corresponding to any node in the cluster is different, a second similarity threshold of the second parameter is obtained; the second parameter between the two nodes is compared for similarity to obtain a second comparison result; when the second comparison result does not meet the second similarity threshold, it is determined that the second parameter is abnormal. In this way, the second parameter abnormality can be effectively determined based on the second comparison result and the second similarity threshold.

[0092] In some embodiments, the above step S310 "obtaining a second similarity threshold of the second parameter when it is determined that the second parameter corresponding to any node in the cluster is different" can be implemented by the following steps:

[0093] When it is determined that the second parameters corresponding to any node in the cluster are different, the second similarity threshold is dynamically determined based on the second parameter of at least one historical version deployed in the cluster.

[0094] Here, since the nodes in the cluster can deploy historical versions before upgrading to the target version, during the implementation process, the second similarity threshold can be dynamically determined based on the normally deployed historical version, so as to achieve real-time updating of the second similarity threshold and effectively improve the accuracy of determining the abnormality of the second parameter.

[0095] In an embodiment of the present application, based on a second parameter of at least one historical version deployed in the cluster, the second similarity threshold is dynamically determined to achieve real-time updating of the second similarity threshold and effectively improve the accuracy of determining the abnormality of the second parameter.

[0096] Many existing solutions for application environment deployment and update cannot fully realize automated deployment with DevOps, automated CI / CD tools, etc. For example, cluster deployment and update of OpenStack, Ceph, Hadoop, etc. However, the inspection items of different tools are very different, and it is very costly to develop different versions of tools separately. The method provided in the embodiment of the present application can achieve a balance between flexibility and risk identification ability.

[0097] Figure 4A A flowchart of an anomaly detection method based on historical version data provided in an embodiment of the present application is shown in FIG. Figure 4A As shown, the following steps are included:

[0098] Step S401, identifying configuration information of each version of the application;

[0099] In some embodiments, what is identified is the configuration information of the program package in the version library, that is, the configuration information of the program package generated at different time points.

[0100] Here, the parameter index in the configuration information is identified, and the identified parameter index includes the number of configuration parameters, the number of changed configuration parameters, the range of unchanged configuration parameters, and the range of changed configuration parameters.

[0101] Step S402, comparing parameters under different release versions;

[0102] Based on the version identifier, such as the version number, it can be determined whether the version to be identified is a minor version relationship or a major version relationship, so as to first obtain a dynamic threshold by monitoring, and then analyze the configuration information by using the dynamic threshold.

[0103] In some embodiments, the comparison of parameters under different release versions includes: text similarity of configuration files updated in adjacent versions (including minor and major versions), etc.

[0104] Step S403: Identify and verify the configuration parameters of different release versions to obtain analysis results;

[0105] The method for generating the parameter text similarity threshold can be not only set manually, but also by first obtaining the data distribution of the parameter through historical data statistics, and then determining the dynamic threshold corresponding to the parameter based on the data distribution of the parameter.

[0106] When a dynamic threshold is determined, version anomaly detection and risk alarm can be performed based on the dynamic threshold.

[0107] Step S404: Identify abnormal changes in configuration parameters based on the analysis results and trigger a risk message.

[0108] As a method of reducing false positives during the implementation process, the administrator can set a cluster range, a node range within the cluster, an applicable historical version range, and an inapplicable historical version range based on this method to reduce the occurrence of false positives.

[0109] The implementation idea of ​​the embodiment of the present application is to identify the differences of different indicators under different historical versions, and the text similarity of all parameter contents or the changed parameter parts. If the content exceeds the threshold, a risk message will be triggered. In this way, when the target version is released, the configuration information abnormality of the target version can be effectively determined.

[0110] Figure 4B A flowchart of a method for analyzing node configuration parameters and detecting anomalies in a cluster environment provided by an embodiment of the present application is shown in FIG. Figure 4B As shown, the following steps are included:

[0111] Step S410: Obtain the configuration file of each node in the cluster;

[0112] Step S412: parsing the configuration file of each node to obtain the parameter value corresponding to the configuration file parameter of each node;

[0113] During the implementation process, the configuration information of each node in the cluster can be identified first, and then the configuration file parameters can be parsed, and finally the parameter values ​​corresponding to the configuration file parameters can be extracted.

[0114] Step S413, performing similarity analysis on parameter value changes to obtain analysis results;

[0115] During implementation, parameter values ​​are compared between cluster configuration files to determine the range of configuration parameters that are consistent across nodes and / or the range of configuration parameters that differ between nodes.

[0116] Step S414: Identify abnormal changes in configuration parameters based on the analysis results and trigger a risk message.

[0117] For situations where different configuration parameters exist between different nodes, two scenarios are identified:

[0118] Scenario 1: Parameter values ​​are consistent in some nodes but different in other nodes. When such a situation is identified, a risk message is directly triggered.

[0119] Scenario 2: The parameter values ​​are different in each node. In this case, the parameter values ​​will be compared for similarity. Typical text similarity comparison algorithms include SimHash or cosine similarity. By comparing the text similarity of the same parameter between different nodes in the cluster, if the parameter value is less than a predetermined threshold, a risk message is triggered.

[0120] In some embodiments, the text similarity comparison process can also be obtained based on the historical version change record. For example, the historical version record shows that the text similarity between parameters is between the thresholds x1 and x2. If in the new change, the cosine similarity between the parameters of two nodes is outside the x1 to x2 threshold, then an exception is marked and a risk message is triggered.

[0121] In some embodiments, as a method of implementing a process to reduce false positives, an administrator can set a cluster-wide, node-wide, range based on this method.

[0122] The implementation idea of ​​the embodiment of the present application is: in a cluster environment, each cluster parameter should be the same or similar. If the configuration parameters of a cluster node with the same function are too different from those of other nodes, there may be a deployment anomaly. In this way, when the target version is released in a cluster environment, the configuration information anomaly of the target version can be effectively determined.

[0123] Based on the foregoing embodiments, an embodiment of the present application provides an abnormality detection device, which includes the modules included, each module includes sub-modules, and can be implemented by a processor in an electronic device; of course, it can also be implemented by a specific logic circuit; in the implementation process, the processor can be a central processing unit (CPU), a microprocessor (MPU), a digital signal processor (DSP) or a field programmable gate array (FPGA), etc.

[0124] Figure 5 A schematic diagram of the structure of the abnormality detection device provided in the embodiment of the present application is shown in FIG. Figure 5 As shown, the device 500 includes:

[0125] A first acquisition module 510 is used to acquire first configuration information of a target version;

[0126] A first comparison module 520, configured to compare the first configuration information with the preset configuration information for similarity to obtain a first comparison result;

[0127] A second acquisition module 530 is used to acquire a first similarity threshold of the target version;

[0128] The first determination module 540 is configured to determine that the first configuration information of the target version is abnormal if the first comparison result does not meet a first similarity threshold.

[0129] In some embodiments, the second acquisition module 530 is further configured to dynamically acquire the first similarity threshold based on at least two of the historical versions when it is determined within a preset period that the number of historical versions reaches a number threshold.

[0130] In some embodiments, the first configuration information includes at least: the first configuration parameter quantity and / or the first configuration parameter range; the preset configuration information includes at least: the second configuration parameter quantity and / or the second configuration parameter range; the first comparison module 520 includes a first comparison submodule and / or a second comparison submodule, wherein the first comparison submodule is used to compare the first configuration parameter quantity with the second configuration parameter quantity to obtain the quantity similarity of the configuration parameters; the second comparison submodule is used to compare the first configuration parameter range with the second configuration parameter range to obtain the range similarity of the configuration parameters.

[0131] In some embodiments, the preset configuration information includes second configuration information of the historical version; the first similarity threshold includes a first version similarity threshold and a second version similarity threshold, wherein the first version similarity threshold is less than the second version similarity threshold; the second acquisition module 530 includes a first acquisition sub-module and a second acquisition sub-module, wherein the first acquisition sub-module is used to obtain the first version similarity threshold based on the second configuration information of at least two historical versions with the first relationship when it is determined that the relationship between the target version and the historical version is a first relationship based on the identifier of the target version and the identifier of the historical version; the second acquisition sub-module is used to obtain the second version similarity threshold based on the second configuration information of at least two historical versions with the second relationship when it is determined that the relationship between the target version and the historical version is a second relationship based on the identifier of the target version and the identifier of the historical version.

[0132] In some embodiments, the device also includes a deployment module, a third acquisition module, a second comparison module and a second determination module, wherein the deployment module is used to deploy the target version to a cluster including at least two nodes when the first comparison result meets the similarity threshold; the third acquisition module is used to obtain a set of configuration parameters for deploying the target version to each of the nodes, wherein the set of configuration parameters includes a first parameter and a second parameter; the second comparison module is used to compare the configuration parameter sets of any two of the nodes to determine at least one of the first parameters that is consistently configured on each of the nodes, and at least one of the second parameters that has a configuration difference between any two of the nodes; the second determination module is used to determine that the second parameter configuration is abnormal when it is determined that the second parameter is the same for some nodes in the cluster and different for the remaining nodes in the cluster.

[0133] In some embodiments, the device also includes a fourth acquisition module, a third comparison module and a third determination module, wherein the fourth acquisition module is used to obtain a second similarity threshold of the second parameter when it is determined that the second parameters corresponding to any node in the cluster are not the same; the third comparison module is used to compare the similarity of the second parameters between any two nodes to obtain a second comparison result; the third determination module is used to determine that the second parameter is abnormal when the second comparison result does not meet the second similarity threshold.

[0134] In some embodiments, the fourth acquisition module is further used to dynamically determine the second similarity threshold based on the second parameter of at least one historical version deployed in the cluster when it is determined that the second parameters corresponding to any node in the cluster are different.

[0135] The description of the above device embodiment is similar to the description of the above method embodiment, and has similar beneficial effects as the method embodiment. For technical details not disclosed in the device embodiment of the present application, please refer to the description of the method embodiment of the present application for understanding.

[0136] It should be noted that in the embodiment of the present application, if the above method is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the relevant technology can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable an electronic device (which can be a mobile phone, a tablet computer, a laptop computer, a desktop computer, etc.) to execute all or part of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a U disk, a mobile hard disk, a read-only memory (ROM), a disk or an optical disk. In this way, the embodiment of the present application is not limited to any specific combination of hardware and software.

[0137] Correspondingly, an embodiment of the present application provides a storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps in the anomaly detection method provided in the above embodiment are implemented.

[0138] Correspondingly, an embodiment of the present application provides an electronic device, Figure 6 A hardware entity diagram of an electronic device provided in an embodiment of the present application, such as Figure 6As shown, the hardware entity of the device 600 includes: a memory 601 and a processor 602, wherein the memory 601 stores a computer program that can be run on the processor 602, and the processor 602 implements the steps in the abnormality detection method provided in the above embodiment when executing the program.

[0139] The memory 601 is configured to store instructions and applications executable by the processor 602, and can also cache data to be processed or processed by the processor 602 and various modules in the electronic device 600 (for example, image data, audio data, voice communication data, and video communication data), which can be implemented through flash memory (FLASH) or random access memory (Random Access Memory, RAM).

[0140] It should be noted here that the description of the above storage medium and device embodiments is similar to the description of the above method embodiments, and has similar beneficial effects as the method embodiments. For technical details not disclosed in the storage medium and device embodiments of this application, please refer to the description of the method embodiments of this application for understanding.

[0141] It should be understood that "one embodiment" or "an embodiment" mentioned throughout the specification means that specific features, structures or characteristics related to the embodiment are included in at least one embodiment of the present application. Therefore, "in one embodiment" or "in an embodiment" appearing throughout the specification does not necessarily refer to the same embodiment. In addition, these specific features, structures or characteristics can be combined in one or more embodiments in any suitable manner. It should be understood that in various embodiments of the present application, the size of the sequence number of the above-mentioned processes does not mean the order of execution, and the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application. The above-mentioned sequence numbers of the embodiments of the present application are only for description and do not represent the advantages and disadvantages of the embodiments.

[0142] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0143] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as: multiple units or components can be combined, or can be integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0144] The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units; they may be located in one place or distributed on multiple network units; some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0145] In addition, all functional units in the embodiments of the present application may be integrated into one processing unit, or each unit may be a separate unit, or two or more units may be integrated into one unit; the above-mentioned integrated units may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0146] A person skilled in the art can understand that all or part of the steps of implementing the above method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above method embodiment; and the aforementioned storage medium includes: mobile storage devices, read-only memories (ROM), magnetic disks or optical disks, etc., various media that can store program codes.

[0147] Alternatively, if the above-mentioned integrated unit of the present application is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application can be essentially or partly reflected in the form of a software product that contributes to the relevant technology. The computer software product is stored in a storage medium, including several instructions to enable an electronic device (which can be a mobile phone, a tablet computer, a laptop computer, a desktop computer, etc.) to execute all or part of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROMs, magnetic disks, or optical disks.

[0148] The methods disclosed in several method embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments.

[0149] The features disclosed in several product embodiments provided in this application can be arbitrarily combined without conflict to obtain new product embodiments.

[0150] The features disclosed in several method or device embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments or device embodiments.

[0151] The above is only an implementation method of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for detecting anomalies, the method comprising: Obtain the first configuration information of the target version; Comparing the first configuration information with the preset configuration information for similarity to obtain a first comparison result; Obtaining a first similarity threshold of the target version; When the first comparison result does not meet the first similarity threshold, determining that the first configuration information of the target version is abnormal; When the first comparison result satisfies a similarity threshold, deploying the target version in a cluster including at least two nodes; Obtaining a configuration parameter set for deploying the target version on each of the nodes, wherein the configuration parameter set includes a first parameter and a second parameter; Comparing the configuration parameter sets of any two of the nodes to determine at least one of the first parameters that is consistently configured on each of the nodes, and at least one of the second parameters that is differently configured between any two of the nodes; When it is determined that the second parameter is the same for some nodes in the cluster and different for other nodes in the cluster, it is determined that the second parameter configuration is abnormal.

2. The method according to claim 1, wherein obtaining the first similarity threshold of the target version comprises: When it is determined within a preset period that the number of historical versions reaches a number threshold, the first similarity threshold is dynamically acquired based on at least two of the historical versions.

3. The method according to claim 1, wherein the first configuration information at least comprises: A first configuration parameter quantity and / or a first configuration parameter range; The preset configuration information includes at least: the number of second configuration parameters and / or the range of second configuration parameters; The comparing the first configuration information with the preset configuration information for similarity to obtain a first comparison result includes: Comparing the similarity between the first configuration parameter quantity and the second configuration parameter quantity to obtain the quantity similarity of the configuration parameters; and / or, The first configuration parameter range is compared with the second configuration parameter range for similarity to obtain the range similarity of the configuration parameters.

4. The method according to claim 1, wherein the preset configuration information includes the second configuration information of the historical version; the first similarity threshold includes the first version similarity threshold and the second version similarity threshold, wherein: The first version similarity threshold is less than the second version similarity threshold; The obtaining of the first similarity threshold of the target version includes: When it is determined based on the identifier of the target version and the identifier of the historical version that the relationship between the target version and the historical version is a first relationship, obtaining a first version similarity threshold based on second configuration information of at least two historical versions that are related to the first relationship; When it is determined based on the identifier of the target version and the identifier of the historical version that the relationship between the target version and the historical version is a second relationship, obtaining a second version similarity threshold based on second configuration information of at least two historical versions that are related by the second relationship; The first relationship is a major version relationship, and the second relationship is a minor version relationship. The differences between versions satisfying the major version relationship are large, and the differences between versions satisfying the minor version relationship are small.

5. The method of claim 1, further comprising: When it is determined that the second parameters corresponding to any node in the cluster are different, obtaining a second similarity threshold of the second parameter; Performing a similarity comparison on the second parameters between the any two nodes to obtain a second comparison result; When the second comparison result does not meet the second similarity threshold, it is determined that the second parameter is abnormal.

6. The method according to claim 5, wherein when it is determined that the second parameters corresponding to any node in the cluster are different, obtaining the second similarity threshold of the second parameter comprises: When it is determined that the second parameters corresponding to any node in the cluster are different, the second similarity threshold is dynamically determined based on the second parameter of at least one historical version deployed in the cluster.

7. An abnormality detection device, comprising: A first acquisition module, used to acquire first configuration information of a target version; A first comparison module, used to compare the first configuration information with preset configuration information for similarity to obtain a first comparison result; A second acquisition module, used to acquire a first similarity threshold of the target version; A first determining module, configured to determine that the first configuration information of the target version is abnormal if the first comparison result does not meet a first similarity threshold; A deployment module, configured to deploy the target version to a cluster including at least two nodes when the first comparison result satisfies a similarity threshold; A third acquisition module is used to acquire a configuration parameter set of the target version deployed on each of the nodes, wherein the configuration parameter set includes a first parameter and a second parameter; A second comparison module, used for comparing the configuration parameter sets of any two of the nodes to determine at least one of the first parameters that is consistently configured on each of the nodes, and at least one of the second parameters that has a configuration difference between any two of the nodes; The second determination module is used to determine that the second parameter configuration is abnormal when it is determined that the second parameter is the same for some nodes in the cluster and different for other nodes in the cluster.

8. An electronic device comprising a memory and a processor, wherein the memory stores a computer program executable on the processor, and the processor implements the steps of the method according to any one of claims 1 to 6 when executing the program.

9. A storage medium storing executable instructions for causing a processor to execute the instructions to implement the steps of the method according to any one of claims 1 to 6.

Images