Software running state detection method and device

Abstract

The application discloses a software running state detection method and device, to solve the technical problem that software running state detection occupies a large number of system performance resources. One of the software running state detection schemes comprises the following steps: obtaining the running state of a function function of software in a first time interval; inputting the running state of the function function of software in the first time interval into a prediction model to obtain the predicted running state of the function function of software in a second time interval; obtaining the actual running state of the function function of software in the second time interval; calculating the similarity between the actual running state and the predicted running state of the function function of software in the second time interval; and generating a software running state detection result according to the similarity. The software running state detection scheme provided by the application reduces the additional performance overhead of the system, thereby ensuring the system running rate and enabling online detection of software running.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, and particularly relates to a software running state detection method and device. BACKGROUND

[0002] The rapid development of computer technology and software engineering makes the current software system more and more complex. The rapid increase in the complexity of the software system brings great challenges to the testing work of the software system.

[0003] A survey conducted by the Software Engineering Institute of Carnegie Mellon University in the United States found that nearly 20% of defects remain after the software system is put into operation. These residual defects are usually complex defects that are difficult to find in the software testing and verification process.

[0004] The complex defects of the software system are usually difficult to find in the development and testing stage because the triggering condition and the fault propagation condition are relatively complex. They are triggered under specific conditions in the running process and cause complex software failure. This uncertainty brings risks to the operation of the complex software system and affects the reliability of the software operation.

[0005] In the implementation of the prior art, the inventors find that:

[0006] The existing technology usually monitors the time series data of the internal function functions of the software in real time when performing software anomaly detection. However, long-time intrusive monitoring will cause a huge additional overhead on the performance resources of the system, such as long-time occupation of the running memory of the system, thereby affecting the system running rate.

[0007] Therefore, it is necessary to provide a new software running state detection scheme to solve the technical problem that the software running state detection occupies a large amount of system performance resources. SUMMARY

[0008] The embodiments of the present application provide a new software running state detection scheme to solve the technical problem that the software running state detection occupies a large amount of system performance resources.

[0009] Specifically, a software running state detection method comprises the following steps:

[0010] Obtaining the running state of the function function of the software in a first time interval;

[0011] Inputting the running state of the function function in the first time interval into a prediction model to obtain the predicted running state of the function function of the software in a second time interval;

[0012] Obtaining the actual running state of the function function of the software in the second time interval;

[0013] The computing software calculates a similarity between an actual running state of the function function in the second time interval and a predicted running state of the function function.

[0014] According to the similarity, a software running state detection result is generated.

[0015] The first time interval and the second time interval are separated by a predetermined time interval.

[0016] Further, the software includes a plurality of function functions.

[0017] The running state of the function function of the software in the first time interval is obtained, specifically including:

[0018] A first type of function function is determined, which is called before the first time interval and released in the first time interval.

[0019] A second type of function function is determined, which is called in the first time interval and released in the first time interval.

[0020] A third type of function function is determined, which is called in the first time interval and not released in the first time interval.

[0021] The time series data of the first type of function function, the time series data of the second type of function function, and the time series data of the third type of function function represent the running state of the function function of the software in the first time interval.

[0022] Further, the time series data of the first type of function function is obtained, specifically including:

[0023] A first type of function function is determined, which is called before the first time interval and released in the first time interval.

[0024] The release timestamp of the first type of function function, the start timestamp of the first time interval, and the timestamp length of the first time interval are obtained.

[0025] The first type of function function time series data is obtained through a first type of function function time series data calculation formula.

[0026] The first type of function function time series data calculation formula is expressed as:

[0027]

[0028] In the formula, The first type of function function time series data is represented by t end The release timestamp of the first type of function function is represented by t w The start timestamp of the first time interval is represented by t, and the timestamp length of the first time interval is represented by Δt.

[0029] Further, the time series data of the second type function is acquired, specifically comprising:

[0030] The second type function is determined to be called in the first time interval and released in the first time interval;

[0031] The call timestamp of the second type function, the release timestamp of the second type function, and the timestamp length of the first time interval are acquired;

[0032] The second type function time series data is obtained through a second type function time series data calculation formula;

[0033] The second type function time series data calculation formula is represented as:

[0034]

[0035] In the formula, The second type function time series data is represented as t end The release timestamp of the second type function is represented as t start The call timestamp of the second type function is represented as t

[0036] Further, the time series data of the third type function is acquired, specifically comprising:

[0037] The third type function is determined to be called in the first time interval and not released in the first time interval;

[0038] The call timestamp of the third type function, the start timestamp of the first time interval, and the timestamp length of the first time interval are acquired;

[0039] The third type function time series data is obtained through a third type function time series data calculation formula;

[0040] The third type function time series data calculation formula is represented as:

[0041]

[0042] In the formula, The third type function time series data is represented as t start The call timestamp of the third type function is represented as t w The start timestamp of the first time interval is represented as t

[0043] Further, the prediction model comprises a memory network sub-model, an attention mechanism sub-model, and a full connection layer;

[0044] input the running state of the function function in the first time interval to the prediction model to obtain the predicted running state of the function function of the software in the second time interval, specifically comprising:

[0045] characteristic extraction of the running state of the function function in the first time interval through the memory network sub-model to obtain the first characteristic information related to the time series data;

[0046] weight distribution of the first characteristic information through the attention mechanism sub-model to obtain the second characteristic information related to the time series data;

[0047] fusion of the first characteristic information and the second characteristic information through the full connection layer to obtain the predicted running state of the function function of the software in the second time interval.

[0048] Further, the software running state detection method further comprises the following steps:

[0049] the running state of the function function in the first time interval, the predicted running state of the function function in the second time interval, and the actual running state of the function function in the second time interval are used as training data;

[0050] training the memory network training model using the training data to obtain the memory network sub-model;

[0051] characteristic extraction of the training data using the memory network sub-model to obtain the training characteristic information related to the time series data;

[0052] training the attention mechanism training model using the training characteristic information to obtain the attention mechanism sub-model.

[0053] Further, the software running state detection method further comprises the following steps:

[0054] determine whether the memory network training model converges;

[0055] when the memory network training model does not converge, use the target loss function to backpropagate the memory network training model;

[0056] when the memory network training model converges, save the memory network training model as the memory network sub-model;

[0057] wherein, the target loss function is expressed as:

[0058] KS loss = max(|F(x)-G(x)|)

[0059] In the formula, KS lossThe target loss function is represented, F(x) represents the predicted time series data of the function function in the second time interval, and G(x) represents the actual time series data of the function function in the second time interval.

[0060] The embodiment of the application further provides a software running state detection device.

[0061] Specifically, a software running state detection device comprises:

[0062] The acquisition module is configured to acquire the running state of the function function of the software in the first time interval, and further configured to acquire the actual running state of the function function of the software in the second time interval.

[0063] The prediction module is configured to input the running state of the function function in the first time interval into a prediction model to obtain the predicted running state of the function function of the software in the second time interval.

[0064] The detection module is configured to calculate the similarity between the actual running state of the function function of the software in the second time interval and the predicted running state of the function function, and further configured to generate a software running state detection result according to the similarity.

[0065] The first time interval and the second time interval are separated by a predetermined time interval.

[0066] Further, the software comprises a plurality of function functions.

[0067] The acquisition module is configured to acquire the running state of the function function of the software in the first time interval, and specifically comprises:

[0068] The first type of function function is determined, which is called before the first time interval and released in the first time interval.

[0069] The second type of function function is determined, which is called in the first time interval and released in the first time interval.

[0070] The third type of function function is determined, which is called in the first time interval and not released in the first time interval.

[0071] The time series data of the first type of function function, the time series data of the second type of function function and the time series data of the third type of function function represent the running state of the function function of the software in the first time interval.

[0072] The technical scheme provided by the embodiment of the application has at least the following beneficial effects:

[0073] The detection mode collected by sampling reduces the overhead of the additional performance of the system, thereby ensuring the running rate of the system, and can realize online detection of the software running. Meanwhile, the application also specifically proposes a loss function based on distribution statistics, which has a wider constraint condition compared with the traditional mean square error loss (MSE) and cross-entropy loss (CE), can accelerate the convergence speed of the model, and improve the training efficiency. BRIEF DESCRIPTION OF DRAWINGS

[0074] The drawings described herein are used to provide further understanding of the present application, constitute a part of the present application, the illustrative embodiments of the present application and the description thereof are used to explain the present application, and do not constitute improper limitation on the present application. In the drawings:

[0075] Figure 1 A flow chart of a software running state detection method provided for an embodiment of the present application.

[0076] Figure 2 A structural schematic diagram of a software running state detection device provided for an embodiment of the present application.

[0077] 100 software running state detection device

[0078] 11 acquisition module

[0079] 12 prediction module

[0080] 13 detection module DETAILED DESCRIPTION

[0081] In order to make the purpose, technical scheme and advantages of the present application clearer, the technical scheme of the present application will be described clearly and completely in combination with specific embodiments of the present application and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0082] Please refer to Figure 1 The present application provides a software running state detection method, comprising the following steps:

[0083] S110: acquiring the running state of the function function of the software in the first time interval.

[0084] The software can be understood as a collection of programs organized in a specific order, which includes several function functions. The function function refers to a subroutine or subcode that can be directly referenced by another program or code. In other words, calling a function function in a specific order, executing a function function, and releasing a function function characterize the software running process. Among them, the running process of a single function function is manifested as the function function is called as the execution starts, and the function function is released as the execution ends. The running time of a single function function is manifested as the execution timestamp length of the function function, that is, the release timestamp of the single function function minus the call timestamp.

[0085] In the prior art, when performing software anomaly detection, the time sequence data of the internal function functions of the software is often monitored in real time. However, long-term intrusive monitoring will cause a huge additional overhead on the performance resources of the system, such as long-term occupation of the running memory of the system, thereby affecting the system running rate.

[0086] To solve the technical problem that software running state detection occupies a large amount of system performance resources, the present application sets an interval time window to sample the running state of the internal function functions of the software. Specifically, the time window has a start timestamp, an end timestamp, and an interval timestamp length between the start timestamp and the end timestamp. In other words, the timestamp length of the time window can be obtained by subtracting the start timestamp from the end timestamp.

[0087] The adjacent time windows are separated by an appointed time interval. Similarly, the timestamp length of the appointed time interval can be obtained by subtracting the end timestamp of the former time window from the start timestamp of the latter time window.

[0088] It is considered that multiple time windows will appear in actual application scenarios. In order to make the description simple, only the first time interval and the second time interval are used to represent adjacent time windows here, which cannot be understood as a limitation on the scope of the invention.

[0089] Further, in a specific embodiment provided by the present application, the running state of the function function of the software in the first time interval is manifested as:

[0090] The first type of function function is determined to be called before the first time interval and released in the first time interval;

[0091] The second type of function function is determined to be called in the first time interval and released in the first time interval;

[0092] The third type of function function is determined to be called in the first time interval and not released in the first time interval;

[0093] The time series data of the first type of function function, the time series data of the second type of function function, and the time series data of the third type of function function represent the running state of the function function of the software in the first time interval.

[0094] It can be understood that, in the first time interval, the present application only focuses on three types of function functions, which are the first type of function function called before the first time interval and released in the first time interval, the second type of function function called in the first time interval and released in the first time interval, and the third type of function function called in the first time interval and not released in the first time interval. As for the function function called and released before the first time interval, and the function function not called in the first time interval, there is no monitoring significance, in order to reduce the performance resource consumption of the system, the present application does not focus on these two types of function functions.

[0095] Further, the time series data of the three types of function functions focused on by the present application in the first time interval represent the running state of the function function of the software in the first time interval, so as to obtain the running state of the function function of the software in the first time interval, the time series data of the three types of function functions need to be obtained respectively.

[0096] In a specific embodiment provided by the present application, the time series data of the first type of function function is obtained, specifically including:

[0097] determining the first type of function function called before the first time interval and released in the first time interval;

[0098] obtaining the release time stamp of the first type of function function, the start time stamp of the first time interval, and the time stamp length of the first time interval;

[0099] obtaining the release time stamp of the first type of function function, the start time stamp of the first time interval, and the time stamp length of the first time interval;

[0100] The first type of function function time series data calculation formula is expressed as:

[0101]

[0102] In the formula, indicates the first type of function function time series data, t end indicates the release time stamp of the first type of function function, t w indicates the start time stamp of the first time interval, and Δt indicates the time stamp length of the first time interval.

[0103] In another specific embodiment provided by the present application, the time series data of the second type of function function is obtained, specifically including:

[0104] determine a second type of function function called in the first time interval, and a second type of function function released in the first time interval;

[0105] acquire a call timestamp of the second type of function function, a release timestamp of the second type of function function, and a timestamp length of the first time interval;

[0106] obtain second type of function function time series data through a second type of function function time series data calculation formula;

[0107] The second type of function function time series data calculation formula is:

[0108]

[0109] In the formula, indicates the second type of function function time series data, t end indicates the release timestamp of the second type of function function, t start indicates the call timestamp of the second type of function function, and Δt indicates the timestamp length of the first time interval.

[0110] In another specific embodiment provided in the present application, the time series data of the third type of function function is acquired, and specifically includes:

[0111] determine a third type of function function called in the first time interval, and a third type of function function not released in the first time interval;

[0112] acquire a call timestamp of the third type of function function, a start timestamp of the first time interval, and a timestamp length of the first time interval;

[0113] obtain third type of function function time series data through a third type of function function time series data calculation formula;

[0114] The third type of function function time series data calculation formula is:

[0115]

[0116] In the formula, indicates the third type of function function time series data, t start indicates the call timestamp of the third type of function function, t w indicates the start timestamp of the first time interval, and Δt indicates the timestamp length of the first time interval.

[0117] Of course, when t w indicates the start timestamp of the first time interval, and Δt indicates the timestamp length of the first time interval, the first time interval can be represented as [t w , t w + Δt].start the call timestamp of the second type of function function, t end the release timestamp of the second type of function function, then the execution time interval of the function function can be expressed as [t start end

[0118] Integrating the above formula, we have

[0119]

[0120]

[0121]

[0122] In the formula, indicates the running state of the function function in the first time interval, indicates the running state of the program in the first time interval, and L indicates the running state of the software in the first time interval.

[0123] S120: input the running state of the function function in the first time interval into the prediction model to obtain the predicted running state of the function function of the software in the second time interval.

[0124] It can be understood that, in order to avoid the negative impact of long-time intrusive monitoring on the system running rate, the application first acquires the running state of the software in the first time interval; then, according to the running state of the software in the first time interval, the running state of the software in the second time interval is predicted through the prediction model; then, the actual running state of the software in the second time interval is acquired; by comparing the actual running state and the predicted running state of the software in the second time interval, it is determined whether the software runs normally. In this way, the sampling collection mode reduces the additional performance overhead of the system, and thus ensures the system running rate.

[0125] It should be pointed out that the existing technology detects the software running state in an offline manner, because the system needs to ensure sufficient performance to perform long-time intrusive monitoring on the software. However, the technical solution provided by the application reduces the additional performance overhead of the system, so that the system can perform other work in addition to detecting the software running state. For example, the idle system performance can be called to perform detection information interaction, so as to realize online detection of the software running at a remote end.

[0126] Next, how to predict the running state of the function function of the software in the second time interval is introduced.

[0127] Further, the prediction model used by the application includes a memory network sub-model, an attention mechanism sub-model, and a full connection layer.

[0128] ​​Step S120 inputs the running state of the function function in the first time interval to the prediction model to obtain the predicted running state of the function function of the software in the second time interval, specifically including:

[0129] The running state of the function function in the first time interval is extracted by a memory network submodel to obtain first feature information related to time series data;

[0130] The first feature information is assigned a weight by an attention mechanism submodel to obtain second feature information related to time series data;

[0131] The first feature information and the second feature information are fused by a full connection layer to obtain the predicted running state of the function function of the software in the second time interval.

[0132] The memory network submodel is a kind of recurrent neural network model, which can better retain historical information when processing time series data, thereby learning the trend of data change over time. In a specific application scenario, the memory network submodel is a long short term memory (LSTM) model.

[0133] Further, the input data of the LSTM model has three dimensions, which are:

[0134] [batch size, step length, input size]

[0135] Where batch size represents the batch sample size of data processing by the model at the same time, for example, batch size = 20 means that the model can process 20 samples of the same type at the same time. Step length represents the step value of the sample, that is, the length of the time series in each sample. Since the lengths of the samples in the same batch are different, the samples need to be packed (padding process) to ensure that the samples in the same batch have the same step value. Input size refers to the feature data of the sample, that is, the dimension of each data point, which indicates how many function functions the software system is composed of.

[0136] The packing process (padding process) of the sample refers to using the padding function provided in the deep learning framework Pytorch to pack the samples with lengths less than the longest sample length in the batch into a batch of samples with the same length by padding zeros at the end, while recording the number of padded zeros and passing it to the deep learning model. During training, it is excluded.

[0137] The LSTM model has four main states inside, which are:

[0138] z = tanh(W x cat(x t ,h {t-1} ))

[0139] z i = σ(W i x cat(x t ,h {t-1} ) T )

[0140] z f = σ(W f x cat(x t ,h {t-1} ) T )

[0141] z o = σ(W o x cat(x t ,h {t-1} ) T )

[0142] The state of each cell in the LSTM model is calculated by the following formula:

[0143] c t = z f ⊙ c t-1 + z i ⊙ z

[0144] The final output of the model is calculated by the following formula:

[0145] H = tanh(W' x h t + b')

[0146] wherein

[0147] h t = z o tanh(c t )

[0148] In other words, H in the above formula represents the first feature information related to the time series data.

[0149] The application also uses an attention mechanism sub-model to help the LSTM model remember important fragments in the time series. Further, the attention mechanism sub-model is used to weight the first feature information to obtain the second feature information related to the time series data, which is specifically represented as:

[0150] The attention mechanism sub-model first applies nonlinear processing to the output H in the LSTM sub-model:

[0151] M = tanh(H)

[0152] Then, the weight matrix of Attention is calculated:

[0153] w = softmax(a T M)

[0154] Subsequently, the attention distribution of each part in the time series is calculated:

[0155] attention = Hw T

[0156] Finally, the first feature information and the second feature information are fused through a fully connected layer, and a softmax nonlinear processing is applied to obtain the predicted running state of the function function in the second time interval:

[0157] output = softmax(a T x tanh(attention)H)

[0158] In the formula, output is the final output, indicating the predicted running state of the function function in the second time interval.

[0159] Further, in the application scenario of online detection of software proposed in the present application, the prediction model usually also needs to be pre-trained.

[0160] Specifically, the process of pre-training the prediction model is as follows:

[0161] The running state of the function function in the first time interval, the predicted running state of the function function in the second time interval, and the actual running state of the function function in the second time interval are used as training data.

[0162] The training data is used to train the memory network training model to obtain a memory network submodel.

[0163] The memory network submodel is used to extract features from the training data to obtain training feature information related to the time series data.

[0164] The training feature information is used to train the attention mechanism training model to obtain an attention mechanism submodel.

[0165] It is also necessary to point out that in the training process, the application requires the prediction model to fit the running state of the software runtime. In order to achieve this, while relaxing the constraint of the loss function, the convergence speed of the model is accelerated, and the application also provides a loss function KS-Loss based on the significance of data distribution. Specifically, KS-loss as the target loss function in the training process of the LSTM sub-model, the main purpose is to make the difference between the output of the model and the true measured value as small as possible. In a specific application scenario, the target loss function is expressed as:

[0166] KS loss =max(|F(x)-G(x)|)

[0167] In the formula, KS loss indicates the target loss function, F(x) indicates the predicted time series data of the function function in the second time interval, and G(x) indicates the actual time series data of the function function in the second time interval.

[0168] Further, in the pre-training process of the prediction model, the step of converging the memory network training model is also included:

[0169] determine whether the memory network training model converges;

[0170] When the memory network training model does not converge, the memory network training model is subjected to back propagation using the target loss function;

[0171] When the memory network training model converges, the memory network training model is saved as a memory network sub-model.

[0172] It is necessary to point out that compared with the traditional MSE loss function, KS-Loss only requires that the model result and the target value have no significant difference (constraint relaxation), which greatly accelerates the convergence speed of the training model and improves the training efficiency.

[0173] S130: Obtain the actual running state of the function function of the software in the second time interval.

[0174] The scheme of step S130 obtaining the actual running state of the function function of the software in the second time interval can refer to the scheme of step S110 obtaining the running state of the function function of the software in the first time interval, which will not be described here.

[0175] S140: Calculate the similarity between the actual running state of the function function of the software in the second time interval and the predicted running state of the function function.

[0176] S150: Generate a software running state detection result according to the similarity.

[0177] It can be understood that after the predicted running state of the function function of the software in the second time interval is obtained in step S120, and the actual running state of the function function of the software in the second time interval is obtained in step S130, the similarity between the actual running state of the function function of the software in the second time interval and the predicted running state of the function function can be calculated.

[0178] When the similarity is within the allowable threshold interval, the software running state detection result is that the software running state is normal; when the similarity is not within the allowable threshold interval, the software running state detection result is that the software running state is abnormal.

[0179] To sum up, the software running state detection method provided by the application reduces the additional performance overhead of the system, thereby ensuring the system running rate, and can realize online detection of software running. Meanwhile, the application also specifically proposes a loss function based on distribution statistics, which has a wider constraint condition compared with the traditional mean square error loss (MSE) and cross entropy loss (CE), can accelerate the convergence speed of the model, and improve the training efficiency.

[0180] Please refer to Figure 2 To support the software running state detection method, the application also provides a software running state detection device 100, which comprises:

[0181] The acquisition module 11 is configured to acquire the running state of the function function of the software in the first time interval, and is further configured to acquire the actual running state of the function function of the software in the second time interval.

[0182] The prediction module 12 is configured to input the running state of the function function in the first time interval into a prediction model to obtain the predicted running state of the function function of the software in the second time interval.

[0183] The detection module 13 is configured to calculate the similarity between the actual running state of the function function of the software in the second time interval and the predicted running state of the function function, and is further configured to generate a software running state detection result according to the similarity.

[0184] It can be understood that the software can be understood as a collection of programs organized in a specific order, and the programs include a plurality of function functions. The function function refers to a subprogram or subcode that can be directly referenced by another program or code. In other words, calling the function function in a specific order, executing the function function, and releasing the function function represent the software running process. The running process of a single function function is represented as the function function being called as the execution starts, and the function function being released as the execution ends. The running time of a single function function is represented as the execution timestamp length of the function function, i.e. the release timestamp of the single function function minus the call timestamp.

[0185] In the prior art, when performing software anomaly detection, the time series data of the internal function functions of the software are often monitored in real time. However, long-term intrusive monitoring will cause a huge additional overhead on the performance resources of the system, such as long-term occupation of the running memory of the system, thereby affecting the system running rate.

[0186] To solve the technical problem that software running state detection occupies a large amount of system performance resources, the present application sets an interval time window to sample the running state of the internal function functions of the software. Specifically, the time window has a start time stamp, an end time stamp, and an interval time stamp length between the start time stamp and the end time stamp. In other words, the time stamp length of the time window can be obtained by subtracting the start time stamp from the end time stamp.

[0187] The adjacent time windows are separated by an appointed time interval. Similarly, the time stamp length of the appointed time interval can be obtained by subtracting the end time stamp of the earlier time window from the start time stamp of the later time window.

[0188] It is considered that multiple time windows will appear in actual application scenarios. For the sake of simplicity of description, only the first time interval and the second time interval are used to represent adjacent time windows here, and this should not be construed as a limitation on the scope of the invention.

[0189] Further, in a specific embodiment provided by the present application, the acquisition module 11 acquires the running state of the function functions of the software in the first time interval as follows:

[0190] determining a first type of function function that is called before the first time interval and released in the first time interval;

[0191] determining a second type of function function that is called in the first time interval and released in the first time interval;

[0192] determining a third type of function function that is called in the first time interval and not released in the first time interval;

[0193] The time series data of the first type of function function, the time series data of the second type of function function, and the time series data of the third type of function function represent the running state of the function functions of the software in the first time interval.

[0194] It can be understood that the acquisition module 11 only focuses on three types of function functions in the first time interval, which are the first type of function function called before the first time interval and released in the first time interval, the second type of function function called in the first time interval and released in the first time interval, and the third type of function function called in the first time interval and not released in the first time interval. As for the function function called and released before the first time interval, the function function not called in the first time interval has no monitoring significance, in order to reduce the performance resource overhead of the system, the acquisition module 11 does not focus on the two types of function functions.

[0195] Further, the time sequence data of the above three types of function functions represents the running state of the software in the first time interval, so that the acquisition module 11 acquires the running state of the function function of the software in the first time interval, and needs to acquire the time sequence data of the three types of function functions respectively.

[0196] In a specific embodiment provided by the present application, the acquisition module 11 acquires the time sequence data of the first type of function function, specifically including:

[0197] Determine the first type of function function called before the first time interval and released in the first time interval;

[0198] Acquire the release timestamp of the first type of function function, the start timestamp of the first time interval, and the timestamp length of the first time interval;

[0199] Obtain the first type of function function time sequence data through the first type of function function time sequence data calculation formula;

[0200] The first type of function function time sequence data calculation formula is represented as:

[0201]

[0202] In the formula, The first type of function function time sequence data is represented as t end The release timestamp of the first type of function function is represented as t w The start timestamp of the first time interval is represented as t, and the timestamp length of the first time interval is represented as Δt.

[0203] In another specific embodiment provided by the present application, the acquisition module 11 acquires the time sequence data of the second type of function function, specifically including:

[0204] Determine the second type of function function called in the first time interval and released in the first time interval;

[0205] acquiring a call timestamp of the second type function, a release timestamp of the second type function, and a timestamp length of the first time interval;

[0206] calculating the second type function time series data through a second type function time series data calculation formula;

[0207] The second type function time series data calculation formula is expressed as:

[0208]

[0209] In the formula, t represents the second type function time series data, t represents the call timestamp of the second type function, t represents the release timestamp of the second type function, and Δt represents the timestamp length of the first time interval. end start

[0210] In another specific embodiment provided in the application, the acquisition module 11 acquires third type function time series data, and specifically includes:

[0211] determining the third type function that is called in the first time interval and not released in the first time interval;

[0212] acquiring a call timestamp of the third type function, a start timestamp of the first time interval, and a timestamp length of the first time interval;

[0213] calculating the third type function time series data through a third type function time series data calculation formula;

[0214] The third type function time series data calculation formula is expressed as:

[0215]

[0216] In the formula, t represents the third type function time series data, t represents the call timestamp of the third type function, t represents the start timestamp of the first time interval, and Δt represents the timestamp length of the first time interval. start w

[0217] Of course, when t w represents the start timestamp of the first time interval, and Δt represents the timestamp length of the first time interval, the first time interval can be represented as [t w , t w + Δt]. When t start represents the call timestamp of the second type function, t end ​​​​​​The release timestamp of the second type of function function is represented by [t start ,t end ] represents the execution time interval of the function function.

[0218] Integrating the above formula, we have

[0219]

[0220]

[0221]

[0222] In the formula, represents the running state of the function function in the first time interval, represents the running state of the program in the first time interval, and L represents the running state of the software in the first time interval.

[0223] It should be noted that, in order to avoid the negative impact of long-term intrusive monitoring on the system running rate, the acquisition module 11 first acquires the running state of the software in the first time interval; then the prediction module 12 predicts the running state of the software in the second time interval according to the running state of the software in the first time interval through the prediction model; the acquisition module 11 acquires the actual running state of the software in the second time interval; the detection module 13 compares the actual running state of the software in the second time interval with the predicted running state, so as to determine whether the software runs normally. The software running state detection device 100 provided by the present application reduces the additional performance overhead of the system by such sampling collection, thereby ensuring the system running rate.

[0224] It should be noted that the existing technology for detecting the running state of software is offline detection, because the system needs to ensure sufficient performance for long-term intrusive monitoring of software. However, the software running state detection device 100 provided by the present application reduces the additional performance overhead of the system, so that the system can perform other work in addition to detecting the running state of software. For example, idle system performance can be called to interact with detection information, thereby realizing online detection of software running at a remote end.

[0225] The following describes how the prediction module 12 predicts the running state of the function function of the software in the second time interval.

[0226] Further, the prediction model used by the prediction module 12 includes a memory network sub-model, an attention mechanism sub-model, and a fully connected layer.

[0227] The prediction module 12 inputs the running state of the function function in the first time interval into the prediction model to obtain the predicted running state of the function function of the software in the second time interval, specifically including:

[0228] The running state of the function function in the first time interval is extracted by a memory network submodel to obtain first feature information related to time series data;

[0229] The first feature information is assigned a weight by an attention mechanism submodel to obtain second feature information related to time series data;

[0230] The first feature information and the second feature information are fused by a full connection layer to obtain the predicted running state of the function function of the software in the second time interval.

[0231] The memory network submodel is a kind of recurrent neural network model, which can better retain historical information when processing time series data, thereby learning the trend of data over time. In a specific application scenario, the memory network submodel is a long short term memory (LSTM) model.

[0232] Further, the input data of the LSTM model has three dimensions, which are:

[0233] [batch size, step length, input size]

[0234] Where batch size represents the batch sample size of data processing by the model at the same time, for example, batch size = 20 means that the model can process 20 samples of the same type at the same time. Step length represents the step value of the sample, that is, the length of the time series in each sample. Since the lengths of the samples in the same batch are different, the samples need to be packed (padding process) to ensure that the samples in the same batch have the same step value. Input size refers to the feature data of the sample, that is, the dimension of each data point, which indicates how many function functions the software system is composed of.

[0235] The packing process (padding process) of the sample refers to using the padding function provided in the deep learning framework Pytorch to pack the samples with lengths less than the longest sample length in the batch into a batch of samples with the same length by padding zeros at the end, while recording the number of padded zeros and passing it to the deep learning model. During training, it is excluded.

[0236] The LSTM model has four main states, which are:

[0237] z = tanh(W x cat(x t ,h {t-1} )

[0238] z i = σ(W i x cat(x t ,h {t-1} ) T )

[0239] z f = σ(W f x cat(x t ,h {t-1} ) T )

[0240] z o = σ(W o x cat(x t ,h {t-1} ) T )

[0241] The state of each cell in the LSTM model is calculated by the following formula:

[0242] c t = z f ⊙c t-1 +z i ⊙z

[0243] The final output of the model is calculated by the following formula:

[0244] H = tanh(W' x ht+ b')

[0245] where

[0246] h t = z o tanh(c t )

[0247] In other words, H in the above formula represents the first feature information related to the time series data.

[0248] The prediction module 12 also uses an attention mechanism sub-model to help the LSTM model remember important segments in the time series. Further, the prediction module 12 performs weight distribution on the first feature information through the attention mechanism sub-model to obtain second feature information related to the time series data, which is specifically manifested as:

[0249] The attention mechanism sub-model first applies nonlinear processing to the output H in the LSTM sub-model:

[0250] M = tanh(H)

[0251] Then, the weight matrix of Attention is calculated:

[0252] w = softmax(a T M)

[0253] Subsequently, the attention distribution of each part in the time series is calculated:

[0254] attention = Hw T

[0255] Finally, the first feature information and the second feature information are fused through a fully connected layer, and a softmax nonlinear processing is applied to obtain the predicted running state of the function function in the second time interval:

[0256] output = softmax(a T x tanh(attention)H)

[0257] In the formula, output is the final output, indicating the predicted running state of the function function in the second time interval.

[0258] Further, in the application scenario of online detection of software proposed in the present application, the prediction model usually also needs to be pre-trained.

[0259] Specifically, the process of pre-training the prediction model is as follows:

[0260] The running state of the function function in the first time interval, the predicted running state of the function function in the second time interval, and the actual running state of the function function in the second time interval are used as training data.

[0261] The training data is used to train the memory network training model to obtain a memory network submodel.

[0262] The memory network submodel is used to extract features from the training data to obtain training feature information related to the time series data.

[0263] The training feature information is used to train the attention mechanism training model to obtain an attention mechanism submodel.

[0264] It is also necessary to point out that in the training process, the application requires the prediction model to fit the running state of the software runtime. In order to achieve this, while relaxing the constraint of the loss function, the application also provides a loss function KS-Loss based on the significance of data distribution. Specifically, KS-loss as the target loss function in the training process of the LSTM sub-model, the main purpose is to make the difference between the output of the model and the true measured value as small as possible. In a specific application scenario, the target loss function is expressed as:

[0265] KS loss = max(|F(x)-G(x)|)

[0266] In the formula, KS loss represents the target loss function, F(x) represents the predicted time series data of the function function in the second time interval, and G(x) represents the actual time series data of the function function in the second time interval.

[0267] Further, in the pre-training process of the prediction model, the step of converging the memory network training model is also included:

[0268] determine whether the memory network training model converges;

[0269] When the memory network training model does not converge, the memory network training model is subjected to back propagation using the target loss function;

[0270] When the memory network training model converges, the memory network training model is saved as a memory network sub-model.

[0271] It is necessary to point out that compared with the traditional MSE loss function, KS-Loss only requires that the model result and the target value have no significant difference (constraint relaxation), which greatly speeds up the convergence of the training model and improves the training efficiency.

[0272] Further, the scheme for the acquisition module 11 to obtain the actual running state of the function function of the software in the second time interval can refer to the scheme for the acquisition module 11 to obtain the running state of the function function of the software in the first time interval, which will not be described here.

[0273] After the prediction module 12 obtains the predicted running state of the function function of the software in the second time interval, and the acquisition module 11 obtains the actual running state of the function function of the software in the second time interval, the detection module 13 can calculate the similarity between the actual running state of the function function of the software in the second time interval and the predicted running state of the function function. Finally, the detection module 13 generates a software running state detection result according to the similarity.

[0274] Specifically, when the similarity is within the allowable threshold interval, the detection module 13 determines that the software running state detection result is normal; when the similarity is not within the allowable threshold interval, the detection module 13 determines that the software running state detection result is abnormal.

[0275] To sum up, the software running state detection device 100 provided by the application reduces the additional performance overhead of the system, thereby ensuring the system running rate, and can realize online detection of software running. Meanwhile, the application also specifically proposes a loss function based on distribution statistics, which has a wider constraint condition compared with the traditional mean square error loss (MSE) and cross entropy loss (CE), can accelerate the convergence speed of the model, and improve the training efficiency.

[0276] It should be noted that the terms "comprising", "including", or any other variant thereof are intended to cover non-exclusive inclusions, so that processes, methods, articles or devices including a series of elements not only include those elements, but also include other elements not explicitly listed, or include elements inherent to such processes, methods, articles or devices. Without more limitations, the element defined by the phrase "including a" does not exclude the presence of other identical elements in the process, method, article or device including the element.

[0277] The above only describes the embodiments of the application and is not intended to limit the application. Those skilled in the art can make various changes and modifications to the application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the application shall be included in the scope of the claims of the application.

Claims

1. A software running state detection method, characterized by, The method comprises the following steps: obtaining the running state of the function function of the software in the first time interval; inputting the running state of the function function of the software in the first time interval into a prediction model to obtain the predicted running state of the function function of the software in the second time interval; obtaining the actual running state of the function function of the software in the second time interval; calculating the similarity between the actual running state and the predicted running state of the function function of the software in the second time interval; generating a software running state detection result according to the similarity; wherein the first time interval and the second time interval are separated by a predetermined time interval; the software comprises a plurality of function functions; obtaining the running state of the function function of the software in the first time interval, specifically comprising: determining a first type of function function that is called before the first time interval and released in the first time interval; determining a second type of function function that is called in the first time interval and released in the first time interval; determining a third type of function function that is called in the first time interval and not released in the first time interval; The time series data of the first type of function function, the time series data of the second type of function function, and the time series data of the third type of function function represent the running state of the function function of the software in the first time interval.

2. The software execution state detection method according to Claim 1, characterized by, Obtaining the time series data of the first type of function function, specifically comprising: determining a first type of function function that is called before the first time interval and released in the first time interval; obtaining the release timestamp of the first type of function function, the start timestamp of the first time interval, and the timestamp length of the first time interval; obtaining the time series data of the first type of function function through a first type of function function time series data calculation formula; The first type of function function time series data calculation formula is expressed as: ; In the formula, denotes the time series data of the first type of functional function, denotes the release timestamp of the first type of functional function, denotes the start timestamp of the first time interval, denotes the timestamp length of the first time interval.

3. The software execution state detection method according to Claim 1, wherein obtaining the time series data of the second type of function function, specifically comprising: determining a second type of function function that is called in the first time interval and released in the first time interval; obtaining the call timestamp of the second type of function function, the release timestamp of the second type of function function, and the timestamp length of the first time interval; obtaining the time series data of the second type of function function through a second type of function function time series data calculation formula; The second type of function function time series data calculation formula is expressed as: ; In the formula, denotes the time series data of the second type of functional function, denotes the release timestamp of the second type of functional function, denotes the call timestamp of the second type of functional function, denotes the timestamp length of the first time interval.

4. The software execution state detection method according to Claim 1, characterized by, obtaining the time series data of the third type of function function, specifically comprising: determining a third type of function function that is called in the first time interval and not released in the first time interval; obtaining the call timestamp of the third type of function function, the start timestamp of the first time interval, and the timestamp length of the first time interval; obtaining the time series data of the third type of function function through a third type of function function time series data calculation formula; The third type of function function time series data calculation formula is expressed as: ; In the formula, represents the third type of functional function time series data, represents the call timestamp of the third type of functional function, represents the start timestamp of the first time interval, represents the timestamp length of the first time interval.

5. The software execution state detection method according to Claim 1, characterized by, The prediction model comprises a memory network sub-model, an attention mechanism sub-model, and a fully connected layer; inputting the running state of the function function of the software in the first time interval into a prediction model to obtain the predicted running state of the function function of the software in the second time interval, specifically comprising: The memory network sub-model is used for feature extraction of the running state of the function function in the first time interval, to obtain first feature information related to the time series data; The attention mechanism sub-model is used for weight distribution of the first feature information, to obtain second feature information related to the time series data; The first feature information and the second feature information are fused through a full connection layer, to obtain a predicted running state of the function function of the software in the second time interval.

6. The software execution state detection method according to Claim 1, wherein The software running state detection method further includes the following steps: The running state of the function function in the first time interval, the predicted running state of the function function in the second time interval, and the actual running state of the function function in the second time interval are used as training data; The memory network training model is trained using the training data, to obtain the memory network sub-model; The training data is subjected to feature extraction using the memory network sub-model, to obtain training feature information related to the time series data; The attention mechanism training model is trained using the training feature information, to obtain the attention mechanism sub-model.

7. The software execution state detection method according to Claim 6, characterized by, The software running state detection method further includes the following steps: It is determined whether the memory network training model converges; When the memory network training model does not converge, the memory network training model is subjected to back propagation using a target loss function; When the memory network training model converges, the memory network training model is saved as the memory network sub-model; The target loss function is expressed as: ; In the formula, denotes a target loss function, denotes a predicted time series data of the function function in the second time interval, denotes an actual time series data of the function function in the second time interval.

8. A software operation state detection device characterized by comprising: includes: The acquisition module is configured to acquire the running state of the function function of the software in the first time interval; The acquisition module is further configured to acquire the actual running state of the function function of the software in the second time interval; The prediction module is configured to input the running state of the function function of the software in the first time interval into the prediction model, to obtain the predicted running state of the function function of the software in the second time interval; The detection module is configured to calculate the similarity between the actual running state of the function function of the software in the second time interval and the predicted running state of the function function, and further configured to generate a software running state detection result according to the similarity; The first time interval and the second time interval are separated by a predetermined time interval, The software includes a plurality of function functions; The acquisition module is configured to acquire the running state of the function function of the software in the first time interval, and specifically includes: A first type of function function is determined, which is called before the first time interval and released in the first time interval; A second type of function function is determined, which is called in the first time interval and released in the first time interval; A third type of function function is determined, which is called in the first time interval and not released in the first time interval; The time series data of the first type of function function, the time series data of the second type of function function, and the time series data of the third type of function function represent the running state of the function function of the software in the first time interval.

Images