An anomaly detection method, device, readable storage medium, and electronic device

Abstract

The specification discloses an abnormality detection method, device, readable storage medium and electronic equipment, through a pre-deployed aspect program for each business application, monitoring indexes in a business process of each business application and monitoring indexes corresponding to an application container where each business application is located are acquired, for each business application, according to preset abnormal conditions of each monitoring index, an abnormal monitoring index corresponding to the business application is determined and counted to obtain a statistical index, and whether to send an early warning information is judged according to the statistical index. According to the method, for each business application, each abnormal monitoring index of the business application is counted to determine a statistical index, and whether to send an early warning information is judged based on the statistical index, the number of early warning information is converged, and the early warning information is processed in time.

Description

Technical Field

[0001] This specification relates to the field of computer technology, and in particular to an anomaly detection method, apparatus, readable storage medium, and electronic device. Background Technology

[0002] Currently, with the development of computer technology and the need for deeper integration of business, business scenarios such as distributed computing have emerged. Users are paying more and more attention to their own privacy. In distributed computing scenarios, in order to ensure the efficiency of business execution, it is usually necessary to monitor the operation of each business application that performs the business.

[0003] In the existing technology, for each business application, whenever the monitoring indicators of the business application meet the preset abnormal conditions, it is determined that the business application has an anomaly and an early warning message is sent.

[0004] However, existing technologies can lead to a massive amount of early warning information in distributed computing scenarios, making it difficult to process such information in a timely manner.

[0005] Based on this, this specification provides an anomaly detection method based on safety cross-sections. Summary of the Invention

[0006] This specification provides an anomaly detection method, apparatus, readable storage medium, and electronic device to partially solve the aforementioned problems existing in the prior art.

[0007] The following technical solution is adopted in this specification:

[0008] This specification provides an anomaly detection method for detecting anomalies in a business application deployed in an application container, comprising:

[0009] In response to the anomaly detection task, the monitoring metrics of each business application during the execution of business processes are obtained by using aspect programs pre-deployed for each business application, as well as the monitoring metrics corresponding to each application container.

[0010] For each business application, based on the pre-defined abnormal conditions of each monitoring metric, the monitoring metrics of the business application, and the monitoring metrics of the application container where the business application resides, determine the corresponding abnormal monitoring metrics for that business application.

[0011] Collect statistics on various abnormal monitoring indicators of the business application, obtain statistical indicators, and determine whether to send a warning message to the business application based on the statistical indicators.

[0012] This specification provides an anomaly detection device for detecting anomalies in a business application deployed in an application container, comprising:

[0013] The acquisition module is used to respond to the anomaly detection task by acquiring the monitoring indicators of each business application during the execution of business processes, as well as the monitoring indicators corresponding to each application container, through the aspect programs pre-deployed for each business application.

[0014] The determination module is used to determine the abnormal monitoring indicators corresponding to each business application based on the abnormal conditions of each preset monitoring indicator, the monitoring indicators of the business application, and the monitoring indicators of the application container where the business application is located.

[0015] The early warning module is used to collect statistics on various abnormal monitoring indicators of the business application, obtain statistical indicators, and determine whether to send early warning information for the business application based on the statistical indicators.

[0016] This specification provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described anomaly detection method.

[0017] This specification provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the above-described anomaly detection method.

[0018] The above-mentioned technical solutions adopted in this specification can achieve the following beneficial effects:

[0019] By pre-deploying aspect programs for each business application, the monitoring metrics of each business application during its business execution process and the monitoring metrics corresponding to the application containers where each business application resides are obtained. Then, for each business application, based on the pre-set abnormal conditions of each monitoring metric, the abnormal monitoring metrics corresponding to that business application are determined and statistically analyzed to obtain statistical metrics. Finally, based on the statistical metrics, it is determined whether to send an alert.

[0020] This method targets each business application, statistically analyzes various anomaly monitoring indicators of that application to determine statistical indicators, and then uses these indicators to decide whether to send an early warning message. This reduces the number of early warning messages and facilitates timely processing of them. Attached Figure Description

[0021] The accompanying drawings, which are included to provide a further understanding of this specification and form part of this specification, illustrate exemplary embodiments and are used to explain this specification, but do not constitute an undue limitation thereof. In the drawings:

[0022] Figure 1 This is a flowchart illustrating the anomaly detection method provided in this manual;

[0023] Figure 2 This is a trend graph showing the change in response time over the acquisition time provided in this manual.

[0024] Figure 3 This is a schematic diagram of the anomaly detection device provided in this manual;

[0025] Figure 4 The corresponding information provided in this specification Figure 1 A schematic diagram of an electronic device. Detailed Implementation

[0026] To make the objectives, technical solutions, and advantages of this specification clearer, the technical solutions of this specification will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this specification, and not all of them. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this specification.

[0027] Currently, in distributed cloud computing scenarios, to ensure high resource utilization, multiple business applications are typically deployed, each executing slightly different business functions. Since the runtime environments required for these applications differ, containerization technology is often employed to define the corresponding application container. This application container can be a server-side environment created within the server, containing the business application's runtime environment and the maximum available computing resources allocated to that application. Alternatively, the application container can be a unit within a microservice architecture; the specific type and configuration of the application container can be determined as needed, and this specification does not impose any restrictions.

[0028] To ensure the efficiency of business operations and prevent business applications from malfunctioning and thus failing to execute, it is necessary to monitor the metrics of each business application during the execution of its business operations. Anomaly detection is then performed based on the monitored metrics to determine the operational status of the business applications. This is to avoid security risks caused by the inability to promptly detect faults when business applications malfunction.

[0029] Currently, a common anomaly detection method is based on monitoring metrics of business applications. Specifically, each business application deploys aspects. Then, during the execution of business operations, various monitoring metrics can be obtained based on the deployed aspects. Finally, for each monitoring metric, a corresponding anomaly threshold can be preset. When a monitoring metric exceeds or falls below the threshold, an anomaly can be identified in the business application, and a warning message indicating the anomaly is sent.

[0030] However, each business application may experience various anomalies, and a cloud service scenario often deploys numerous business applications. Consequently, the number of warning messages generated in a cloud service scenario is also massive, making it difficult to process the massive amount of warning messages in a timely manner.

[0031] In addition, there may be situations where monitoring indicators fluctuate near abnormal conditions, causing the business application to frequently trigger warning messages. This situation will lead to a further increase in the number of warning messages, making it even more difficult to process each warning message in a timely manner.

[0032] Based on this, this specification provides an anomaly detection method based on security aspects. By employing security aspects, it obtains monitoring metrics of each business application containing aspect programs during business execution. Then, based on the monitoring metrics showing anomalies, it identifies and statistically analyzes the corresponding anomaly monitoring metrics for each application, and uses these anomaly monitoring metrics to determine whether to send an alert. Furthermore, it reduces the number of alerts to ensure the efficiency of anomaly detection.

[0033] The security aspect mentioned above refers to a method that uses aspect-oriented programming (AOP) to dynamically add or modify aspects within the runtime logic of a business application to implement security-related business logic without modifying the application itself. This decouples the implementation of security-related business logic from the business application, thus avoiding development iteration problems caused by high coupling.

[0034] The aspect program mentioned here refers to an enhancement program that implements security aspect functionality based on business logic. By using aspect-oriented programming, aspect programs can be injected into corresponding pointcuts in the business application. These aspect programs are triggered and executed during the execution of the business application to achieve the required security aspect functionality.

[0035] When a business application executes its business logic, it typically does so through method calls. Therefore, any method within the business application can be used as a pointcut for an aspect, as mentioned above, and the aspect can be injected into the corresponding pointcut. This ensures that when the business application reaches a pointcut—that is, when it calls a method of the business application corresponding to that pointcut—the injected aspect is executed.

[0036] Typically, the code responsible for injecting aspects into pointcuts has high reusability. Therefore, the program implementing this process is usually abstracted into a service module, namely the aspect base. The aspect base can obtain the aspects to be deployed and the pointcuts in the business application from a third party that provides secure aspect services. After the application container starts, it is configured by the environment and the corresponding aspects are injected at the pointcuts in the business application.

[0037] A business application can be a business application that provides business services on the servers of a business platform. These business services can be services provided by the business platform's servers to users, such as query services and payment services. Business services can also be services provided by one server of the business platform to other servers, such as settlement services.

[0038] Of course, as described above, to decouple the security aspect service program from the business application, this specification employs aspect-oriented programming (AOP) to allow the security aspect service program and the business application to intertwine during business execution, while remaining parallel and independently maintainable. Therefore, unlike the business application provider, the third party providing the security aspect service can manage the content related to the security aspect service through a management platform, such as configuring security aspect service management policies, iterating aspect program versions, configuring aspect program deployment rules, etc. Of course, the provider of the security aspect service can be either a third party or a business application provider.

[0039] When managing the content related to security aspect services, the management platform can record various configuration information through configuration files, such as the configuration of various policies and the deployment rules for aspect programs. This allows the aspect base to deploy aspect programs based on the configuration files, or the management platform to implement security aspect services based on the configuration files.

[0040] In practical applications, service providers typically set up data centers containing several physical machines or servers, providing the physical resources required by business applications. Of course, a business application may not require all the physical resources of a single physical machine; therefore, virtualization technology is often used to run multiple virtual hosts on a single physical machine. Each virtual host is independent, sharing a portion of the physical resources of the physical machine. Application containers can then be deployed within these virtual hosts, and business applications can run through these containers. Application containers typically contain the physical resources allocated to them, such as CPU and memory, as well as the runtime environment provided to them, such as the operating system (OS) or other runtime environment data (e.g., container serial number, assigned IP address, application name, tenant, environment variables, etc.). Business applications can be deployed within these application containers to execute business logic.

[0041] In scenarios where secure aspect-based business execution is used, the server of the business provider or a third party providing secure aspect services can provide a management platform. The management platform can manage the content involved in the secure aspect services and deploy the aspect base in the application container. The aspect program is injected into the business application in the business application container through the aspect base, so as to provide secure aspect service support for the application container of the business provider.

[0042] Therefore, the aspect-oriented framework can be pre-deployed in the application container of the service provider. Typically, when the application container starts, the operating system provided to the application container is invoked, and the pre-deployed aspect-oriented framework runs. The aspect-oriented framework obtains the aspect programs and pointcuts of the business application from the management platform and injects the aspect programs into the pointcuts of the business application within the application container. Furthermore, the aspect-oriented framework can also obtain the aspect programs and pointcuts of the business application from the management platform during the execution of the business application and inject the aspect programs into the pointcuts of the business application within the application container.

[0043] Of course, how the segmentation base obtains the information required for deploying the segmentation program from the management platform can be configured as needed. For example, it can actively pull the required information from the management platform based on the configuration file, or the management platform can actively send the required information to the segmentation base.

[0044] After injecting an aspect into a pointcut of a business application, the business application can trigger the aspect during execution to achieve the corresponding security aspect business function.

[0045] The technical solutions provided in the various embodiments of this specification are described in detail below with reference to the accompanying drawings.

[0046] Figure 1 This is a flowchart illustrating the anomaly detection method provided in this specification, which specifically includes the following steps:

[0047] S100: In response to the anomaly detection task, the monitoring metrics of each business application during the execution of business processes are obtained through the aspect programs pre-deployed for each business application, as well as the monitoring metrics corresponding to each application container.

[0048] In one or more embodiments provided in this specification, the anomaly detection method can be applied to a distributed computing scenario where multiple business applications are deployed to execute business functions, and each business application pre-deploys aspect-oriented programming (AOPs) within its program. This anomaly detection method can be executed by a business system comprising multiple business applications, by a business application within that system used for monitoring, or by a separate monitoring system.

[0049] Of course, the monitoring system can be deployed on the server where the business system is located, or on other servers besides the server where the business system is located. The specific entity executing the anomaly detection method and the type of equipment deployed by the monitoring system can be set as needed, and this manual does not impose any restrictions on them.

[0050] For ease of description, the following explanation will use the example of a monitoring system executing this anomaly detection method.

[0051] In typical cloud computing scenarios, if a business application experiences an anomaly, it is usually reflected in two aspects: the application itself and the environment in which it resides. The application container provides the execution environment for the business application. Therefore, the anomaly of a business application can be determined based on both the application itself and its application container.

[0052] Based on this, the monitoring system can obtain monitoring metrics for each business application during the execution of business processes, as well as monitoring metrics for each application container.

[0053] Specifically, for each business application, during the execution of business operations, the monitoring system can obtain monitoring indicators such as resource utilization and business execution success rate of the corresponding business application, which can be used as monitoring indicators for that business application.

[0054] Meanwhile, the monitoring system can also identify the application container where each business application resides, and determine monitoring indicators such as the computing resources consumed during the operation of the application container and the time taken for garbage collection of the application container, which can be used as monitoring indicators for the application container where the business application resides.

[0055] As mentioned earlier, aspect-oriented programming is deployed within a business application, which in turn is deployed within an application container. This business application requires computing resources to execute its business logic. While physical machines in a data center provide ample computing resources, directly using these machines to power the application within the container would compromise resource utilization. Therefore, virtual hosting technology is typically used to divide the physical machine into several virtual hosts, which then provide the computing resources for the application. In other words, the application container is deployed within virtual hosts, which are partitioned from the physical machines.

[0056] Of course, for each application container, it can also be deployed on a real physical machine, and the physical machine can directly provide computing resources for the business applications in the application container. How to deploy the application container can be configured as needed, and this manual does not impose any restrictions on this.

[0057] S102: For each business application, based on the pre-defined abnormal conditions of each monitoring metric, the monitoring metrics of the business application, and the monitoring metrics of the application container where the business application resides, determine the corresponding abnormal monitoring metrics for that business application.

[0058] Unlike the current approach that determines the execution status of business applications based on a single indicator, which sends an alert message as soon as the indicator is abnormal, resulting in a large number of alert messages and making it impossible to process them in a timely manner, thus reducing business execution efficiency and posing security risks.

[0059] This specification provides a novel anomaly detection method. Based on monitoring metrics of a business application during its execution, the monitoring metrics of the application container hosting each business application, and preset anomaly conditions for each monitoring metric, it identifies anomaly monitoring metrics for the business application and uses these as anomaly monitoring metrics. Furthermore, based on statistical metrics obtained from analyzing these anomaly monitoring metrics, it determines whether to send an alert. This method reduces the number of alerts issued.

[0060] Based on this, the monitoring system can determine the corresponding abnormal monitoring indicators for each business application according to the abnormal conditions of each preset monitoring indicator.

[0061] Specifically, for each monitoring indicator in step S100, the monitoring system can determine whether the indicator value meets the pre-defined abnormal conditions based on the received indicator value and the corresponding abnormal conditions. If the conditions are met, the monitoring system can use the monitoring indicator as the corresponding abnormal monitoring indicator.

[0062] Taking the response time of a business application as a monitoring metric as an example, suppose the abnormal condition corresponding to the response time is: the response time exceeds 10 seconds, and the obtained metric value is a response time of 7 seconds, then it can be considered that the monitoring metric is not abnormal. However, if the obtained metric value is a response time of 19 seconds, then it can be considered that the monitoring metric is abnormal.

[0063] S104: Collect statistics on the various abnormal monitoring indicators of the business application, obtain statistical indicators, and determine whether to send a warning message for the business application based on the statistical indicators.

[0064] In one or more embodiments provided in this specification, a business system contains multiple business applications. In this scenario, if the abnormal business applications are determined based on whether a single indicator is abnormal and / or the type of indicator, the number of abnormal applications identified will still be large, making it impossible to handle the abnormal business applications in a timely manner. Therefore, in this specification, abnormal applications can be determined based on multiple indicators.

[0065] Based on this, the monitoring system needs to statistically analyze various abnormal monitoring indicators to obtain the statistical indicators of the business application, and then determine whether to send an early warning message to the business application based on these statistical indicators.

[0066] Specifically, after identifying each anomaly monitoring indicator, the monitoring system can statistically analyze the anomaly monitoring indicators corresponding to the same business application based on the business application identifier carried in each indicator, thereby determining the statistical indicators for that business application. These statistical indicators include multiple anomaly monitoring indicators, each with different dimensions. The dimension describes the perspective from which the business application is viewed. For example, while content occupancy and response time are both monitoring indicators for a business application, their dimensions differ.

[0067] Taking the monitoring metrics corresponding to business applications as controller resource utilization and business application execution time, and the abnormal conditions corresponding to controller resource utilization as exceeding 75%, and the abnormal conditions corresponding to business application execution time as exceeding 0.01 seconds, as an example, assuming that the abnormal monitoring metrics for business application 1 are "business application execution time: 0.02s" and "controller resource utilization: 80%", the monitoring system can determine that the statistical metrics for business application 1 are "business application execution time: 0.02s; controller resource utilization: 80%". Here, controller resource utilization is the CPU utilization rate, and business application execution time is the time corresponding to the business application processing one business task.

[0068] Of course, the monitoring system can also first determine the monitoring indicators corresponding to each business application based on the business application identifier, and then, for each monitoring indicator, determine the abnormal monitoring indicators based on the preset conditions corresponding to that monitoring indicator, and statistically analyze the abnormal monitoring indicators to obtain the statistical indicators corresponding to that business application. The specific method for determining the statistical indicators can be set as needed, and this manual does not impose any restrictions on it.

[0069] Once the statistical indicators are determined, the business application can use these indicators to decide whether to send an early warning message.

[0070] Specifically, the number of abnormal monitoring indicators included in the statistical indicators can reflect the degree of abnormality of the business application to a certain extent. Thus, the application can determine the number of abnormal monitoring indicators included in the statistical indicators and send an early warning message when the number of abnormal monitoring indicators exceeds a preset threshold.

[0071] Furthermore, different business applications have not entirely identical statistical indicators. If each business application needs to be optimized or troubleshooted individually based on these indicators, the optimization or troubleshooting process will be time-consuming, and the effectiveness of the identified anomalies will be significantly reduced. For example, when a business application is found to have an excessively low success rate and excessively long execution time, it can be determined that an anomaly exists and needs to be addressed. However, since each business application needs to be addressed individually, the process is time-consuming, and by the time the anomaly of a particular application is addressed, the application may have already crashed. Therefore, this monitoring system needs to determine the business applications that require alerts based on the specific statistical indicators corresponding to each business application, and then send alert information accordingly.

[0072] Furthermore, different anomalies exist in different business applications, resulting in different anomaly monitoring metrics for each application. Therefore, combining the anomaly conditions corresponding to different monitoring metrics based on logical relationships often yields results corresponding to different types of anomalies. Based on the types of anomalies that can be processed or require pre-processing, the monitoring system can determine the corresponding anomaly judgment strategy and filter out the abnormal applications from various business applications.

[0073] Specifically, for each business application, the monitoring system can match the pre-defined anomaly detection strategy with the corresponding statistical indicators of that business application.

[0074] If a match is successful, the monitoring system can determine that the business application is abnormal and can then send an alert message based on the business application's identifier to indicate that the business application is abnormal.

[0075] The reasons for the appearance of the statistical indicators of this abnormal application can be roughly divided into three categories:

[0076] 1. Problems arising from the application itself.

[0077] 2. There is a problem with the aspect injected into the business application.

[0078] 3. Incompatibility issues between business applications and aspect-oriented programming.

[0079] After receiving the warning information, staff can identify the abnormal application based on the warning information, investigate the cause of the abnormality based on the reasons mentioned above, and then handle the abnormal application based on the identified cause of the abnormality.

[0080] If the match fails, the monitoring system can assume that the business application is running normally and there is no abnormality.

[0081] Furthermore, in this specification, aspect programs can be injected into different locations within the business application. When determining monitoring and statistical indicators, the monitoring system can also determine and record the identifier corresponding to the point where the monitoring indicator is collected.

[0082] Therefore, when an anomaly occurs in a business application, the monitoring system can determine the identifier of the cut-off point for obtaining the statistical metric based on the statistical metric of the business application.

[0083] Then, the monitoring system can send a warning message indicating that the abnormal application has an anomaly at the cut-off point, based on the identifier of the cut-off point and the identifier of the business application.

[0084] In addition, since there may be multiple cut-off points in the business application, when determining the statistical indicators, the statistical indicators of the business application at each cut-off point can be determined, and then based on the statistical indicators, it can be determined whether to send an early warning message carrying the identifier of the cut-off point.

[0085] Of course, in order to enable the warning information to be processed quickly, the warning information may also carry the device identifier of the abnormal application, so that staff can identify the device where the abnormal application is located based on the device identifier, and investigate the cause of the abnormality based on the device where the abnormal application is located.

[0086] Specifically, the monitoring system can determine the device where the abnormal application is located based on the physical information of the abnormal application.

[0087] Once the device is identified, the monitoring system can send a warning message based on the device identifier, the business application identifier, and the cut-off point identifier to indicate that the abnormal application running on the device has an anomaly at the cut-off point.

[0088] The device identifier can be the identifier of the physical machine where the abnormal application resides, or it can be the identifier of the virtual host where the abnormal application resides. The specific type of the device identifier can be set as needed, and this manual does not impose any restrictions on it.

[0089] like Figure 1 The anomaly detection method described herein obtains monitoring metrics for each business application's execution process and the corresponding monitoring metrics for each application's application container by pre-deploying aspect-oriented procedures for each business application. Then, for each business application, based on preset anomaly conditions for each monitoring metric, it determines the corresponding anomaly monitoring metrics. It then statistically analyzes these anomaly monitoring metrics to obtain the statistical metrics for that business application. Finally, it determines whether to send a warning message to indicate an anomaly in that business application based on these statistical metrics. This method, after determining the monitoring metrics for each business application, first identifies the corresponding anomaly monitoring metrics for that business application, then statistically analyzes these anomaly monitoring metrics to determine the statistical metrics, and finally determines whether to send a warning message based on these statistical metrics. This reduces the number of warning messages and facilitates timely processing of warning messages.

[0090] Furthermore, if an anomaly occurs in the business application, the monitoring metrics for its business execution will be affected to some extent. Therefore, in step S100, during the business application's execution process, the monitoring system can acquire at least one of the following metrics as monitoring metrics for the business application: execution time, number of business transactions executed per unit time, and data on failed business transactions per unit time.

[0091] The execution time of the business application is the time required for the application to execute a single business function, and can be the average time required for the application to execute a specified number of business functions.

[0092] Of course, in addition to the indicators listed above, the monitoring system can also obtain other indicators such as the success rate of the business executed within a unit of time as monitoring indicators for the business application. The specific types of monitoring indicators can be set as needed, and this manual does not impose any restrictions on this.

[0093] Furthermore, the anomaly detection method provided in this specification can be applied to anomaly detection through aspects deployed in business applications. Therefore, in step S100, the monitoring system can also determine the monitoring indicators of the business application based on the aspect program itself.

[0094] Specifically, the monitoring system can determine the number of business transactions processed by a business application per unit time by using aspect programs pre-deployed in the business application during the business execution process, and based on this number, determine the trigger level of the business application per unit time as a monitoring indicator for the business application.

[0095] Simultaneously, the monitoring system can identify different methods within the application corresponding to the business application and determine the call time for each method. Based on these call times, it then determines the response time of the business application and uses this response time as a monitoring metric. The response time can be the maximum value among the call times to ensure the sensitivity of the monitoring system, or it can be the average value among the call times to ensure the accuracy of identifying abnormal applications based on response time. The specific method for determining the response time based on call times can be configured as needed, and this manual does not impose any restrictions on this.

[0096] Furthermore, the aspect-oriented programming (AOP) deployed in this business application is typically applicable to the field of information security. Therefore, the monitoring system can also use the AOP to determine the semantics of business data and, based on the semantics, identify the data that needs to be blocked, such as sensitive data or untrusted data. The monitoring system can also record the number of times the AOP blocks data per unit time and, based on the recorded number of blocks, determine the unit number of blocks for business data in the business application, using this unit number of blocks as a monitoring metric for the business application.

[0097] Furthermore, during the execution of business operations by the business application, since this specification requires the injection of aspects into the business application, compatibility issues between the business application itself, the injected aspects, and between the business application and the injected aspects may all lead to exceptions being thrown. Therefore, this monitoring system can also obtain the number of times the business application throws exceptions per unit time during its operation, and use this number of exceptions thrown per unit time as an efficiency indicator for the business application.

[0098] Of course, this monitoring system can use at least one of the above-mentioned trigger level per unit time, response time, number of interceptions per unit time, and number of exceptions thrown per unit time as monitoring indicators for the business application. The specific data types included in the monitoring indicators of this business application and how they are determined can be configured as needed; this manual does not impose any restrictions on this.

[0099] Furthermore, during business execution, if the memory usage, and / or controller resource utilization, and / or controller load of the business application are too high, it can be determined that the business application is under excessive operating pressure. Similar to the situation where server resources are being occupied, the business application is also at risk of crashing. In this case, it may be necessary to allocate more computing resources to the business application or reduce the workload to ensure its safe operation.

[0100] The memory usage rate can be determined based on the actual memory used by the business application and the maximum memory allocated to the business application. This maximum memory usage can be allocated to a physical machine or a virtual host.

[0101] Therefore, in step S100, the monitoring system can also acquire at least one of the following during the operation of the business application: memory usage, controller resource utilization, and controller load, as monitoring metrics for the environment in which the business application resides, i.e., the application container where the business application container is located. Of course, the specific types of these monitoring metrics can be set as needed, and this specification does not limit this.

[0102] Furthermore, for each business application, the execution environment corresponding to that application can be roughly measured from three aspects: memory usage, system latency, and system throughput. In other words, the presence of abnormalities in the application container can be measured based on the monitoring metrics of these three aspects.

[0103] Taking system latency as an example, the monitoring system can obtain the time and number of garbage collections in the application container where the business application is located during the execution of the business application, and determine the system latency of the application container based on the time and number of collections, which serves as the monitoring indicator for the application container.

[0104] Of course, this monitoring system can also acquire at least one of the following during the execution of business applications: memory usage, system latency, and system throughput of the application container where the application resides, as monitoring metrics for the application container. The specific type of monitoring metrics for the application container and how they are determined can be configured as needed, and this manual does not impose any restrictions on this.

[0105] Furthermore, as mentioned earlier, when determining statistical indicators based on the abnormal conditions of each monitoring indicator, the collection periods of each monitoring indicator may be different. Therefore, the monitoring system can also determine the abnormal indicators corresponding to each collection period based on the collection period, as shown in Table 1.

[0106] 8：00-8：10 a x 1 Response time 17 8：00-8：10 b y 2 Controller occupancy 59 8：30-8：40 a x 1 Number of service failures 4 … … … … … …

[0107] Table 1

[0108] Table 1 is a schematic table of abnormal indicators provided in this manual. The collection period refers to the time period during which the monitoring indicator is collected. The business application is the business application in which the aspect-oriented programming language is injected; the machine is the physical machine that actually provides the computing resources allocated to the business application; the data center is the data center where the physical machine is located; the abnormal indicator is determined based on preset conditions to determine whether the monitoring indicator is abnormal; if abnormal, the monitoring indicator is designated as an abnormal indicator; and the abnormal data is the actual value of the monitoring indicator.

[0109] Of course, the categories corresponding to the above-mentioned business applications, machines, and data centers can also simply be the business application identifiers of the business applications. In this case, the monitoring system stores the correspondence between business applications, machines, data centers, etc. Therefore, when an anomaly occurs, the monitoring system determines the machine and data center where the business application is located based on the business application identifier. The specific categories included in the above anomaly indicator table can be set as needed, and this manual does not impose any restrictions on this.

[0110] The monitoring system can then determine the detection period corresponding to the anomaly detection task, and based on the detection period and the collection period of each anomaly indicator, determine the anomaly indicators of the business application within the monitoring period, which will serve as the statistical indicators corresponding to the business application. See Table 2.

[0111]

[0112] Table 2

[0113] Table 2 is a statistical indicator table provided in this manual. The detection period is determined by the monitoring system based on the anomaly detection task. That is, the detection period can be preset. An example in the table is 8:00-9:00. The anomaly indicators include the anomaly indicators existing in the business application and the corresponding collection period for each anomaly indicator. The business application is the business application for which the monitoring indicators are collected; the machine is the physical machine that actually provides the computing resources allocated to the business application; and the data center is the data center where the physical machine is located. The anomaly indicators include the anomalies existing in the business application within that time period.

[0114] Based on Table 1, it can be seen that the response time of business application a is abnormal between 8:00 and 8:10, and the number of service failures is abnormal between 8:30 and 8:40. Based on this, it can be determined that business application a has anomalies in both response time and the number of service failures during the period from 8:00 to 9:00. The abnormal value of the response time is 17, and the collection period is 8:00-8:10. The abnormal value of the number of service failures is 4, and the collection period is 8:30-8:40.

[0115] Similarly, the aforementioned business application, machine, and server room can simply be the business application identifier of the business application. When the monitoring system determines that the business application is abnormal, it uses the business application identifier to determine the machine and server room where the business application is located. The specific settings can be configured as needed, and this manual does not impose any restrictions on this.

[0116] Of course, the above statistical period can be set as needed. For example, when the business system is busy, the time corresponding to the statistical period can be shortened to ensure that abnormal business applications can be identified and processed in a timely manner. When the business system is under less pressure, the time corresponding to the statistical period can be extended to avoid wasting resources caused by frequently and repeatedly determining the computing resources used for monitoring indicators. The specific method of determining the statistical period can be set as needed, and this manual does not impose any restrictions on it.

[0117] Furthermore, for a business system, the business applications that typically require priority handling tend to have more prominent anomalies in terms of severity and developer concern compared to other business applications. For each business application, if a particular monitoring metric occurs frequently, it can be considered that the application has a serious anomaly with that metric. Therefore, this monitoring system can update the statistical metrics by analyzing the frequency and collection period of each anomalous metric among several statistical indicators.

[0118] Specifically, for each business application, the monitoring system can, for each type of monitoring indicator in the statistical indicators corresponding to that business application, when the number of monitoring indicators for that type meets the preset merging conditions, merge the monitoring indicators of that type according to the collection period, and update the statistical indicators of the business application based on the merging results for each type. The merging conditions can be that the monitoring indicator appears more than once, or that the number of times the monitoring indicator appears within a continuous time period is a specified number. The specific merging conditions can be set as needed, and this manual does not impose any restrictions on them.

[0119] Taking response time as an example among monitoring metrics, assuming the collection period for response time is 30 minutes, starting at 8:30 and lasting for 10 seconds, that is, collecting the monitoring metric corresponding to the response time between 8:30:00 and 8:30:10. If the response time at 8:30 is an abnormal metric, and the response time at 9:00 is also an abnormal metric, then the monitoring system can update the collection period for the response time to 8:30-9:30, or record the abnormal period corresponding to the response time as one hour. However, if the collection period for the response time is 10 minutes, then the monitoring system can record the abnormal period for the response time as 8:30:00-8:30:10 & 9:00:00-9:30:10, etc., or they can be left uncombined.

[0120] Therefore, the monitoring system can update the statistical indicators based on the merged results.

[0121] Of course, the specific settings for merging abnormal indicators can be configured as needed, and this manual does not impose any restrictions on this.

[0122] Based on the same idea, this manual also provides a table of abnormal indicators as shown in Table 3.

[0123]

[0124] Table 3

[0125] The start time refers to the moment when the monitoring indicator begins to be collected. For example, if the start time is 8:00, then the monitoring indicator can begin to be collected at 8:00. The duration is the time it takes to collect the monitoring indicator, or the time period during which the monitoring indicator can be collected. For example, if the duration is 10 seconds, then the monitoring indicator can be collected within 10 seconds after 8:00.

[0126] It should be noted that the above-mentioned collection period, collection duration, collection cycle, etc. can all be used to characterize how the monitoring system acquires monitoring indicators, and can all be time parameters of the monitoring indicators. The specific collection parameters used to determine the statistical indicators and the updating of the statistical indicators can all be set as needed, and this manual does not impose any restrictions on this.

[0127] In addition, during the monitoring period, abnormal indicators that occur more frequently than a preset frequency can be merged, and the statistical indicators of the business application can be updated based on the merged abnormal indicators.

[0128] Furthermore, when determining the statistical indicators for this business application within the monitoring period, there may be instances where the monitoring period is set unreasonably, leading to inaccurate statistical indicators. For example... Figure 2 As shown.

[0129] Figure 2 This is a trend graph showing the response time as a function of the data acquisition time, as provided in this manual. The vertical axis represents the index value corresponding to the response time, and the horizontal axis represents the sampling time. The sampling times mentioned in the graph are 0:01, 0:02, ..., 0:10. The dashed lines represent the index values ​​corresponding to abnormal conditions; that is, a response time higher than 4.5 is considered abnormal. If the monitoring period is 0:00-0:05, then the response time is abnormal only at the data acquisition time of 0:04. This result is obviously not accurate enough; therefore, this monitoring system can also determine the monitoring period.

[0130] Specifically, for each monitoring indicator, the monitoring system can determine the consecutive data collection periods in which the indicator appears, and based on these determined periods, determine the first time period corresponding to that monitoring indicator. For example, Figure 2 The first period of the response time can be 0:00-0:10, etc.

[0131] Then, the monitoring system can determine the monitoring period based on the first time period corresponding to each monitoring indicator in the business application.

[0132] The specific method for determining the first time period and the monitoring period based on the first time period can be set as needed, and this manual does not impose any restrictions on this.

[0133] In addition, after determining the statistical indicators, the monitoring system can identify the business applications that match the statistical indicators based on the preset anomaly detection strategy.

[0134] Specifically, anomaly detection strategies can be preset. For example, excessively long response times and a high number of service failures, excessively long response times, or excessive controller occupancy, etc.

[0135] Therefore, the monitoring system can determine whether an anomaly has occurred in each business application based on the statistical indicators and anomaly detection strategies of that business application.

[0136] Furthermore, different anomalies can correspond to different anomaly assessment strategies, and the different risks corresponding to different anomalies are also the different risks corresponding to the anomaly assessment strategies. In other words, there can be multiple anomaly assessment strategies in this specification, and different anomaly assessment strategies can correspond to different risk levels.

[0137] Therefore, the monitoring system can identify each business application as an abnormal application when the statistical indicators and anomaly judgment strategies for that application match, and use the risk level of the anomaly judgment strategy as the risk level of the abnormal application.

[0138] When sending an alert, the monitoring system can send the alert based on the identifier and risk level of each abnormal application.

[0139] Of course, in order to quickly handle more urgent anomalies, the monitoring system can also send early warning information by selecting the business applications whose statistical indicators match the anomaly judgment strategy from each business application in descending order of risk level.

[0140] It should be noted that all actions involving the acquisition of signals, information, data, or indicators in this application are carried out in compliance with the relevant data protection laws and policies of the country where the application is located, and with authorization from the owner of the relevant device.

[0141] Figure 3 The anomaly detection device provided in this specification is used to detect anomalies in a business application deployed in an application container, and includes:

[0142] The acquisition module 200 is used to respond to the anomaly detection task by acquiring the monitoring indicators of each business application during the execution of business processes, as well as the monitoring indicators corresponding to each application container, through the aspect programs pre-deployed for each business application.

[0143] The determination module 202 is used to determine, for each business application, the abnormal monitoring indicators corresponding to the business application based on the abnormal conditions of each preset monitoring indicator, the monitoring indicators of the business application, and the monitoring indicators of the application container where the business application is located.

[0144] The early warning module 204 is used to collect statistics on various abnormal monitoring indicators of the business application, obtain statistical indicators, and determine whether to send early warning information for the business application based on the statistical indicators.

[0145] Optionally, for each business application, several pointcuts for injecting the aspect program are deployed on the business application. The early warning module 204 is used to determine that the business application is an abnormal application when the statistical indicators match the preset anomaly judgment strategy, determine the identifier of the pointcut for obtaining the statistical indicators based on the statistical indicators of the abnormal application, and send early warning information based on the identifier of the abnormal application and the identifier of the pointcut. The early warning information is used to indicate that the abnormal application in the application container has an anomaly at the pointcut.

[0146] Optionally, the early warning module 204 is used to determine the risk level of the anomaly judgment strategy for each business application when the statistical indicators of the business application match the preset anomaly judgment strategy. There are multiple anomaly judgment strategies, and the risk levels of different anomaly judgment strategies are not completely the same. The business application is regarded as an abnormal application, and the risk level corresponding to the anomaly judgment strategy is used as the risk level of the abnormal application. Early warning information is sent according to the identifier of the abnormal application and the risk level.

[0147] Optionally, the early warning module 204 is used to determine the collection time periods corresponding to each abnormal monitoring indicator of the business application, wherein the collection time periods of each monitoring indicator are not completely the same. Based on the detection time period corresponding to the abnormal detection task and the collection time periods corresponding to each abnormal monitoring indicator, the module determines each abnormal monitoring indicator of the business application within the detection time period, and determines the statistical indicators of the business application based on each abnormal monitoring indicator.

[0148] Optionally, the monitoring indicators have multiple types, and the collection periods for different types of monitoring indicators are not exactly the same. The collection period includes the period duration and the start time of collection. The determining module 202 is used to, for each type of abnormal monitoring indicator in the statistical indicators, when the number of abnormal monitoring indicators corresponding to that type meets the preset merging conditions, merge the abnormal monitoring indicators of that type according to the collection period of the abnormal monitoring indicators of that type, and update the statistical indicators according to the merging results corresponding to each type.

[0149] Optionally, the acquisition module 200 is used to acquire, for each business application, at least one of the following during the execution of business operations: resource utilization rate, business execution success rate, and number of business operations, as a monitoring indicator for the business application; determine the application container where the business application resides; and acquire the resource utilization rate of the application container during the execution of the business application, as a monitoring indicator for the application container where the business application container resides.

[0150] Optionally, there may be multiple abnormal applications. The early warning module 204 is used to sort the abnormal applications in descending order of risk level, and send early warning information based on the identifier of each abnormal application according to the sorting result.

[0151] This specification also provides a computer-readable storage medium storing a computer program that can be used to execute the above-described... Figure 1 The aforementioned anomaly detection method.

[0152] This instruction manual also providesFigure 4 The diagram shows the schematic structure of the electronic device. As described in section 4, at the hardware level, this electronic device includes a processor, an internal bus, a network interface, memory, and non-volatile memory, and may also include other hardware required for various services. The processor reads the corresponding computer program from the non-volatile memory into memory and then runs it to achieve the above-mentioned functions. Figure 1 The anomaly detection method described above. Of course, in addition to software implementation, this specification does not exclude other implementation methods, such as logic devices or a combination of hardware and software, etc. In other words, the execution subject of the following processing flow is not limited to individual logic units, but can also be hardware or logic devices.

[0153] In the 1990s, improvements to a technology could be clearly distinguished as either hardware improvements (e.g., improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the methodology). However, with technological advancements, many methodological improvements today can be considered direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved methodology into the hardware circuit. Therefore, it cannot be said that a methodological improvement cannot be implemented using hardware physical modules. For example, a Programmable Logic Device (PLD) (such as a Field Programmable Gate Array (FPGA)) is such an integrated circuit whose logic function is determined by the user programming the device. Designers can program and "integrate" a digital system onto a PLD themselves, without needing chip manufacturers to design and manufacture dedicated integrated circuit chips. Furthermore, nowadays, instead of manually manufacturing integrated circuit chips, this programming is mostly implemented using "logic compiler" software. Similar to the software compiler used in program development, the original code before compilation must be written in a specific programming language, called a Hardware Description Language (HDL). There are many HDLs, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, and RHDL (Ruby Hardware Description Language). Currently, the most commonly used are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should understand that by simply performing some logic programming on the method flow using one of these hardware description languages ​​and programming it into an integrated circuit, the hardware circuit implementing the logical method flow can be easily obtained.

[0154] The controller can be implemented in any suitable manner. For example, it can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicon Labs C8051F320. A memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also recognize that, in addition to implementing the controller in purely computer-readable program code form, the same functionality can be achieved by logically programming the method steps to make the controller take the form of logic gates, switches, ASICs, programmable logic controllers, and embedded microcontrollers. Therefore, such a controller can be considered a hardware component, and the means included therein for implementing various functions can also be considered as structures within the hardware component. Alternatively, the means for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0155] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, a computer can be, for example, a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email device, game console, tablet computer, wearable device, or any combination of these devices.

[0156] For ease of description, the above devices are described in terms of function, divided into various units. Of course, in implementing this specification, the functions of each unit can be implemented in one or more software and / or hardware components.

[0157] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0158] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0159] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0160] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0161] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0162] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0163] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0164] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0165] Those skilled in the art will understand that the embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this specification may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0166] This specification can be described in the general context of computer-executable instructions that are executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a specific task or implement a specific abstract data type. This specification can also be practiced in distributed computing environments, where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0167] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0168] The above description is merely an embodiment of this specification and is not intended to limit this specification. Various modifications and variations can be made to this specification by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of the claims of this specification.

Claims

1. An anomaly detection method for detecting anomalies in a business application, said business application being deployed in an application container, the method comprising: In response to the anomaly detection task, the monitoring metrics of each business application during the execution of business processes are obtained by using aspect programs pre-deployed for each business application, as well as the monitoring metrics corresponding to each application container. For each business application, based on the pre-defined abnormal conditions of each monitoring metric, the monitoring metrics of the business application, and the monitoring metrics of the application container where the business application resides, determine the corresponding abnormal monitoring metrics for that business application. Collect statistics on various abnormal monitoring indicators of the business application, obtain statistical indicators, and determine whether to send early warning information to the business application based on the statistical indicators; Specifically, based on the detection period corresponding to the anomaly detection task and the collection period corresponding to each anomaly monitoring indicator, the anomaly monitoring indicators of the business application within the detection period are determined, and the statistical indicators of the business application are determined based on each anomaly monitoring indicator. For each type of anomaly monitoring indicator in the statistical indicators, when the number of anomaly monitoring indicators corresponding to that type meets a preset merging condition, the anomaly monitoring indicators of that type are merged according to the collection cycle of the anomaly monitoring indicators of that type, and the anomaly duration period included in the statistical indicators is updated according to the merging result. The merging condition includes that the number of times the monitoring indicator appears within a continuous time period is a specified number.

2. The method of claim 1, wherein for each business application, a plurality of pointcuts for injecting the aspect program are deployed on the business application; Determining whether to send an alert for the business application based on the aforementioned statistical indicators specifically includes: When the statistical indicators match the preset anomaly detection strategy, the business application is determined to be an abnormal application. Based on the statistical metrics of the abnormal application, determine the identifier of the cut-off point for obtaining the statistical metrics; Based on the identifier of the abnormal application and the identifier of the cut-off point, an early warning message is sent, which is used to indicate that the abnormal application in the application container has an anomaly at the cut-off point.

3. The method as described in claim 1, wherein determining whether to send a warning message for the business application based on the statistical indicators specifically includes: For each business application, when the statistical indicators of the business application match the preset anomaly judgment strategy, the risk level of the anomaly judgment strategy is determined. There are multiple anomaly judgment strategies, and the risk levels of different anomaly judgment strategies are not completely the same. The business application is classified as an abnormal application, and the risk level corresponding to the abnormality judgment strategy is used as the risk level of the abnormal application. Warning information is sent based on the identifier of the abnormal application and the risk level.

4. As described in claim 1, the collection periods for each monitoring indicator are not entirely the same.

5. The method as described in claim 1, wherein the monitoring indicators are of various types, and the collection periods for different types of monitoring indicators are not entirely the same, wherein the collection period includes the period duration and the start time of collection.

6. The method as described in claim 1, obtaining monitoring metrics during the execution of business processes by each business application, and monitoring metrics corresponding to each application container, specifically includes: For each business application, at least one of the following is obtained during the business application's execution process: resource utilization, business execution success rate, and number of business executions, as a monitoring indicator for that business application. Identify the application container where the business application resides, and obtain the resource utilization rate of the application container during the execution of the business application, as a monitoring indicator for the application container where the business application resides.

7. The method as described in claim 3, wherein the number of abnormal applications is multiple; Sending warning information based on the identifier of the abnormal application and the risk level, specifically including: The abnormal applications are sorted in descending order of risk level. Based on the sorting results, warning messages are sent sequentially according to the identifier of each abnormal application.

8. An anomaly detection device for detecting anomalies in a business application, the business application being deployed in an application container, the device comprising: The acquisition module is used to respond to the anomaly detection task by acquiring the monitoring indicators of each business application during the execution of business processes, as well as the monitoring indicators corresponding to each application container, through the aspect programs pre-deployed for each business application. The determination module is used to determine the abnormal monitoring indicators corresponding to each business application based on the abnormal conditions of each preset monitoring indicator, the monitoring indicators of the business application, and the monitoring indicators of the application container where the business application is located. The early warning module is used to collect statistics on various abnormal monitoring indicators of the business application, obtain statistical indicators, and determine whether to send early warning information for the business application based on the statistical indicators. Specifically, based on the detection period corresponding to the anomaly detection task and the collection period corresponding to each anomaly monitoring indicator, the anomaly monitoring indicators of the business application within the detection period are determined, and the statistical indicators of the business application are determined based on each anomaly monitoring indicator. For each type of anomaly monitoring indicator in the statistical indicators, when the number of anomaly monitoring indicators corresponding to that type meets a preset merging condition, the anomaly monitoring indicators of that type are merged according to the collection cycle of the anomaly monitoring indicators of that type, and the anomaly duration period included in the statistical indicators is updated according to the merging result. The merging condition includes that the number of times the monitoring indicator appears within a continuous time period is a specified number.

9. A computer-readable storage medium storing a computer program that, when executed by a processor, implements the method described in any one of claims 1 to 7.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method described in any one of claims 1 to 7.

Images