Configuration anomaly detection method, device, computer equipment and storage medium

Abstract

The present invention discloses a configuration anomaly detection method, apparatus, computer equipment, and storage medium, relating to the field of computer technology, and addressing the high labor costs associated with existing anomaly detection efforts. The method comprises: obtaining configuration files to be detected; performing word extraction on each configuration file to obtain words in each configuration file; determining the word attributes of each word; constructing a grammatical analysis tree corresponding to each configuration file based on preset rules, each word, and its word attributes; and performing anomaly detection on each configuration file based on the grammatical analysis tree corresponding to each configuration file to obtain a configuration anomaly detection result.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a configuration anomaly detection method, device, computer equipment and storage medium. Background Art

[0002] Modern network systems are massive, with numerous devices supporting the efficient operation of the entire network. Configuration files drive network devices to operate according to user expectations, ensuring the proper operation of the entire network. Any anomalies in configuration files can reduce service efficiency, disrupt service logic, and prevent the fulfillment of service requirements.

[0003] Configuration anomaly detection is designed to detect anomalies in configuration files on the network, locate the anomaly in a timely manner, and provide recommended modification solutions to assist network engineers in accurately retrieving and modifying abnormal configurations.

[0004] Related technologies typically detect anomalies in configuration files based on configuration syntax rules, requiring personnel to learn and accumulate a large number of these rules beforehand. However, network devices are developed and manufactured by different manufacturers, and the corresponding configuration file syntax rules vary widely. These rules also constantly change with device upgrades. Consequently, configuration anomaly detection methods require extensive ongoing maintenance to maintain their operation, resulting in a high labor cost. Summary of the Invention

[0005] The present invention provides a configuration anomaly detection method, apparatus, computer equipment and storage medium, which are used to solve the problem of high labor cost in anomaly detection work in related technologies.

[0006] In order to achieve the above object, the present invention adopts the following technical solutions:

[0007] In a first aspect, the present invention provides a configuration anomaly detection method, comprising:

[0008] Obtain the configuration files to be tested; perform word extraction on each configuration file to obtain the words in each configuration file; determine the word attributes of each word; based on preset rules, each word and the word attributes of each word, respectively construct a grammatical analysis tree corresponding to each configuration file; perform anomaly detection on each configuration file based on the grammatical analysis tree corresponding to each configuration file to obtain a configuration anomaly detection result.

[0009] In the above technical solution, a parse tree corresponding to the configuration file to be tested is constructed using the words and their attributes. Anomaly detection is then performed for each configuration file based on the parse tree. This allows a computer to automatically analyze the attributes of the words contained in the configuration file and, based on these attributes, detect anomalies in the configuration file. This eliminates the need for time-consuming maintenance by personnel and reduces labor costs.

[0010] In some possible implementations, before determining the word attributes of each word, the method further includes: filtering out target words that do not belong to a preset format from each word; in this implementation, determining the word attributes of each word includes: determining the word attributes of each target word.

[0011] In this technical solution, before determining the word attributes of words in the configuration file, the words in the preset format are filtered out, and the word attributes are determined only for target words that do not belong to the preset format. This can improve the efficiency of configuration anomaly detection.

[0012] In some possible implementations, the word attributes of the target word include: the number of consecutive repetitions of the target word in the configuration file and the word type. Determining the word attributes of each target word includes: counting the number of consecutive repetitions and the frequency of occurrence of each target word in the configuration file; and determining the word type corresponding to each target word in the configuration file based on the frequency of occurrence.

[0013] In this technical solution, word types are determined by their frequency of occurrence in the configuration file, allowing us to distinguish the importance of words in the configuration file. The word type and number of consecutive repetitions are then used as word attributes. This facilitates anomaly detection in configuration files at the word level.

[0014] In some possible implementations, the frequency of occurrence includes word frequency and document frequency. Determining the word type corresponding to each target word in the configuration file based on the frequency of occurrence includes: if a first word in the target words meets a preset condition, determining the word type of the first word as a keyword type; the preset condition includes that the word frequency of the word is greater than a first threshold and the document frequency is greater than a second threshold; if a second word in the target words does not meet the preset condition, determining the word type of the second word as a common type.

[0015] In this technical solution, word types are divided into keyword types and common types based on their frequency in the configuration file and document frequency. This makes it easier to detect anomalies in the configuration file based on word attributes.

[0016] In some possible implementations, based on preset rules, each word and the word attributes of each word, a grammatical analysis tree corresponding to each configuration file is constructed respectively, including: for any configuration file: storing the file identifier of the configuration file in the first-level node of the grammatical analysis tree; creating a word node based on the target word, and storing the word content and word attributes of the target word in the word node; concatenating each word node belonging to the same sentence in the order of appearance of each target word in the configuration file to obtain a sentence node; concatenating each sentence node belonging to the same paragraph in the order of appearance to obtain a paragraph node; counting the number of consecutive repetitions of each sentence node and paragraph node respectively; storing the number of consecutive repetitions of the paragraph node and paragraph node in the second-level node of the grammatical analysis tree; connecting each sentence node to the paragraph node corresponding to the sentence node according to the paragraph to which each sentence node belongs in the configuration file, and storing the number of consecutive repetitions of the sentence node together with the sentence node as a third-level node of the grammatical analysis tree; connecting each word node to the sentence node corresponding to the word node according to the sentence to which each target word belongs in the configuration file as a fourth-level node of the grammatical analysis tree.

[0017] In this technical solution, a parse tree of the configuration file is constructed based on the words, sentences, and paragraphs in the configuration file and the number of consecutive repetitions of each. This facilitates analysis based on the words, sentences, and paragraphs in the configuration file and implements anomaly detection in the configuration file.

[0018] In one possible embodiment, the configuration anomaly detection result includes: an abnormal configuration file in which an anomaly occurs in the configuration file, the abnormal location in the abnormal configuration file, and the abnormal type corresponding to the abnormal location. The configuration anomaly detection is performed on each configuration file based on the syntax parse tree corresponding to each configuration file to obtain the configuration anomaly detection result, including: clustering the syntax parse trees corresponding to each configuration file to determine the abnormal configuration file in each configuration file; comparing the configuration file template with the abnormal configuration file to determine the abnormal location of the abnormal configuration file; the configuration file template and the abnormal configuration file belong to the same type; and matching the file content of the abnormal location of the abnormal configuration file with a preset abnormal type to obtain the abnormal type corresponding to the file content at the abnormal location.

[0019] In this technical solution, abnormal configuration files are identified by clustering the grammatical analysis trees corresponding to the configuration files. Furthermore, the abnormal configuration files are compared with the configuration file template to determine the abnormal location of the abnormal configuration files. Finally, the abnormality type of the abnormal location is determined based on the preset abnormality type. In this way, the configuration file is converted into the corresponding grammatical analysis tree, and the abnormal configuration file is determined based on the grammatical analysis tree. Combined with the normal configuration file template and the preset abnormality type, the location and type of the abnormality in the abnormal configuration file are determined. This simplifies the configuration file anomaly detection process and eliminates the need for subsequent maintenance by relevant personnel, reducing labor costs. It also supports batch anomaly detection of configuration files, improving the efficiency of abnormal configuration detection.

[0020] In one possible embodiment, after performing word extraction on each configuration file to obtain the words in each configuration file, the method further includes: randomly selecting two or more groups of adjacent corpus samples from the configuration file; wherein the corpus samples include at least one of paragraphs, sentences, and words; counting the co-occurrence frequency of adjacent corpus combinations in the configuration file; the adjacent corpus combinations are composed of adjacent corpus samples of the same type; calculating the similarity between the same corpus samples in the configuration file; determining the candidate anomaly type of each configuration file based on the co-occurrence frequency of the adjacent corpus combinations and the similarity between the same corpus samples; issuing a prompt message based on the candidate anomaly type and obtaining user feedback information regarding the prompt message; and using the target candidate anomaly type determined in the feedback information as the preset anomaly type of the configuration file.

[0021] In this technical solution, the type of anomaly in the configuration file is determined based on the frequency of occurrence of two adjacent corpora of the same type in the configuration file and the similarity between the combinations of adjacent corpora of the same type. This makes it easier to determine the anomaly type at the abnormal location in the configuration file when performing anomaly detection on the configuration file.

[0022] In one possible implementation, clustering the parse trees corresponding to each configuration file to identify abnormal configuration files within each configuration file includes: clustering the parse trees using a K-means clustering algorithm to obtain clustering results; and obtaining abnormal data points from the clustering results; wherein the abnormal configuration files include the configuration files corresponding to the abnormal data points. In this technical solution, the K-means clustering algorithm is used to cluster the parse trees, which has a simple algorithm concept, fast convergence speed, and excellent clustering effect.

[0023] In one possible implementation, a K-means clustering algorithm is used to cluster each parse tree to obtain a clustering result, including: determining the number of paragraph types, sentence types, and word types included in each configuration file based on the parse tree; generating an array corresponding to each parse tree based on the number of paragraph types, sentence types, and word types in each configuration file; and clustering the array corresponding to each parse tree using a K-means clustering algorithm to obtain a clustering result. In this technical solution, the parse tree is converted into a corresponding array based on the number of non-repeating paragraphs, sentences, and words in the parse tree, simplifying the clustering method process. This can improve clustering efficiency, thereby improving the efficiency of abnormal configuration detection.

[0024] In one possible implementation, determining the K value in the K-means clustering algorithm includes obtaining the number of configuration file types as the K value. In this technical solution, because configuration files of the same type have similar parse tree structures, the K value in the K-means clustering algorithm is determined based on the type of configuration file to be tested. This improves clustering performance.

[0025] In a second aspect, the present invention provides a configuration anomaly detection device, comprising:

[0026] The acquisition module is configured to execute acquisition of the configuration files to be detected; the extraction module is configured to execute word extraction on each configuration file to obtain the words in each configuration file; the attribute determination module is configured to execute determination of the word attributes of each word; the construction module is configured to execute construction of the syntax analysis tree corresponding to each configuration file based on preset rules, each word and the word attributes of each word; the detection module is configured to execute anomaly detection on each configuration file based on the syntax analysis tree corresponding to each configuration file to obtain configuration anomaly detection results.

[0027] In a third aspect, the present invention provides a computer device comprising: a processor and a memory for storing instructions executable by the processor; wherein the processor is configured to execute instructions to implement the configuration anomaly detection method as in the first aspect and any possible implementation of the first aspect.

[0028] In a fourth aspect, the present invention provides a computer-readable storage medium. When the instructions in the computer-readable storage medium are executed by a processor of a computer device, the computer device is enabled to execute the configuration anomaly detection method as in the first aspect and any possible implementation of the first aspect.

[0029] Fifthly, the specific descriptions of aspects 2 to 4 and their various implementations in this application can refer to the detailed descriptions in the first aspect and its various implementations; and the beneficial effects of aspects 2 to 4 and their various implementations can refer to the analysis of the beneficial effects in the first aspect and its various implementations, which will not be repeated here.

[0030] These and other aspects of the present application will become more readily apparent from the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0032] Figure 1 This is an architectural diagram of a configuration anomaly detection system provided in one embodiment of the present application;

[0033] Figure 2 A flowchart of a configuration anomaly detection method provided in one embodiment of the present application;

[0034] Figure 3 A flowchart of a configuration anomaly detection method provided in another embodiment of the present application;

[0035] Figure 4 A flowchart of a configuration anomaly detection method provided in another embodiment of the present application;

[0036] Figure 5 A flowchart of a configuration anomaly detection method provided in another embodiment of the present application;

[0037] Figure 6 A flowchart of a configuration anomaly detection method provided in another embodiment of the present application;

[0038] Figure 7 A flowchart of a configuration anomaly detection method provided in another embodiment of the present application;

[0039] Figure 8 A flowchart of a configuration anomaly detection method provided in another embodiment of the present application;

[0040] Figure 9 A flowchart of a configuration anomaly detection method provided in another embodiment of the present application;

[0041] Figure 10 A block diagram of a configuration anomaly detection device provided in one embodiment of the present application;

[0042] Figure 11A block diagram of a computer device provided in accordance with an embodiment of the present application. DETAILED DESCRIPTION

[0043] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0044] The terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the quantity of the technical features being referred to. Thus, a feature specified as "first" or "second" may explicitly or implicitly include one or more of such features. In the description of the present invention, unless otherwise specified, "plurality" means two or more.

[0045] The configuration anomaly detection method provided in the embodiment of the present application can be applied to Figure 1 The configuration anomaly detection system shown in FIG. The configuration anomaly detection system includes at least one computer device 101 and at least one server 102. The terminal devices 101 are connected to the servers 102. The terminal devices 101 communicate with the servers 102 via wired or wireless communication.

[0046] The terminal device 101 can be any computer device, including but not limited to mobile phones, tablet computers, desktop computers, laptop computers, vehicle-mounted terminals, handheld terminals, augmented reality (AR) devices, virtual reality (VR) devices, etc. The embodiment of the present application does not impose any special restrictions on the specific form of the terminal device 101. It can interact with the user through one or more methods such as a keyboard, touchpad, touch screen, remote control, voice interaction, or handwriting device. In the embodiment of the present application, the terminal device 101 can be used to input a configuration file to be detected.

[0047] Server 102 may be a single server, or a server cluster consisting of multiple servers, or a cloud computing service center, which is not limited in this application. Server 102 is used to store a topographic map of the parking area. Server 102 is also used to, after obtaining the configuration file to be tested, perform abnormal configuration detection on the configuration file to obtain an abnormal configuration detection result.

[0048] The following describes the technical terms that may be involved in the embodiments of this application.

[0049] The grammar analysis tree is a graphical representation of the language derivation process. This representation method reflects the essence of the language and the language derivation process.

[0050] Unsupervised learning involves classification without any labeling. The goal of unsupervised learning is to discover the inherent properties and patterns of data by learning from unlabeled samples, providing a foundation for further data analysis. A typical example of unsupervised learning is clustering.

[0051] The K-means clustering algorithm is an iterative cluster analysis algorithm. The data is pre-divided into K groups, and K objects are randomly selected as initial cluster centers. The distance between each object and each seed cluster center is then calculated, and each object is assigned to the cluster center closest to it. The cluster centers and the objects assigned to them represent a cluster. With each assigned sample, the cluster center is recalculated based on the existing objects in the cluster. This process is repeated until a termination condition is met.

[0052] Determining the value of K is crucial for the K-means algorithm. Based on the data's characteristics, the optimal K value should minimize the intra-class distance and maximize the inter-class distance. The appropriateness of the K value for the K-means algorithm can be assessed using features such as the average silhouette coefficient, intra-class distance, and / or inter-class distance.

[0053] The Silhouette Coefficient (Sketch Coefficient) is a measure of clustering effectiveness. For example, using K-means, the data to be classified is divided into K clusters. For each array in the cluster, the Silhouette Coefficient can be calculated.

[0054] In some embodiments, the K value in the K-means algorithm can be automatically determined by the following method:

[0055] Define the initial variables score_list (score list) and silhouette_int (silhouette coefficient). score_list is used to store the average silhouette coefficient of the model under each K condition, which is convenient for printing detailed calculation results at the end. The initial value of silhouette_int is set to -1. If the average silhouette coefficient calculated under each K condition is greater than this value, it is assigned to silhouette_int.

[0056] 1. Use a for loop to traverse each candidate K value. The range of candidate K values ​​can be determined according to actual conditions, for example (2, 10).

[0057] 2. Create a K-means model object model_kmeans through K-means(n_clusters=n_clusters, random_state=0), set the number of clusters to the K value obtained in the loop, and set a fixed initial state.

[0058] 3. Obtain the cluster labels for the training set. In some embodiments, the fit_predict method is used on model_kmeans to obtain the cluster labels for its training set. In other embodiments, the model can be trained using the fit method first, and then the label attribute of the model_kmeans object can be used to obtain the label classification of its training set.

[0059] 4. Use the metrics.silhouette_score method to test the average silhouette coefficient score of the dataset and assign its score to silhouette_tmp. There are two input parameters:

[0060] ①X: array or matrix of original input;

[0061] ②cluster_labels: cluster labels corresponding to the training set.

[0062] In other embodiments, the K value used in the K-means algorithm may also be determined based on the configuration file to be detected.

[0063] Principal Component Analysis (PCA) is a common data analysis method, often used for dimensionality reduction of high-dimensional data, and can be used to extract the main characteristic components of the data.

[0064] Internet Protocol version 4 (IPv4), also known as the fourth Internet Protocol revision, is the fourth revision of the Internet Protocol. IPv4 is typically written in dotted decimal notation, for example, 192.168.0.1, where the numbers are decimal, separated by solid dots.

[0065] An IPv6 128-bit address is usually written as eight groups, each consisting of four hexadecimal numbers. For example: AD80:0000:0000:0000:ABAA:0000:00C2:0002.

[0066] A regular expression is a logical formula for string operations. It uses pre-defined specific characters and combinations of these specific characters to form a "regular string". This "regular string" is used to express a filtering logic for the string.

[0067] A measure is a function that specifies a number for some subset of a given set. This number can be compared to size, volume, probability, etc. In the embodiment of the present application, the measure represents distance.

[0068] Cosine distance is also called cosine similarity. In geometry, the cosine of the angle can be used to measure the difference in the directions of two arrays. Machine learning borrows this concept to measure the difference between sample arrays.

[0069] Manhattan distance is a geometric term used in geometric metric space to indicate the sum of the absolute distances between two points in a standard coordinate system.

[0070] The edit distance is a quantitative measure of the difference between two strings (e.g., English words) by measuring the minimum number of operations required to transform one string into the other. Edit distance is used in natural language processing. For example, spell checkers can use the edit distance between a misspelled word and the correct word to determine which one (or several) is the most likely word.

[0071] The edit distance is calculated as:

[0072] 1. If the i-th character of string 1 is equal to the j-th character of string 2, that is, string 1[i-1] = string 2[j-1], then the Levenshtein distance between the first i characters of string 1 and the first j characters of string 2 is equal to the Levenshtein distance between the first (i-1) characters of string 1 and the first (j-1) characters of string 2, that is, d[i][j] = d[i-1][j-1], because we only need to convert the first (i-1) characters of string 1 into the first (j-1) characters of string 2 to get the first j characters of string 2.

[0073] 2. If the i-th character of string1 is not equal to the j-th character of string2, according to the definition of Levenshtein distance, the final operation of transforming the first i characters of string1 to the first j characters of string2 can only be one of insertion, deletion, and modification. The three cases are as follows:

[0074] If the last step is insertion, then the first i characters of string1 need to be transformed into the first (j-1) characters of string2, and the last step is to insert string2[j-1]. This requires at least d[i][j-1]+1 steps, because transforming the first i characters of string1 into the first (j-1) characters of string2 requires at least d[i][j-1] steps (this is the meaning of matrix d), plus the insertion operation in the last step, so a total of at least d[i][j-1]+1 steps are required.

[0075] If the last step is deletion, then the first (i-1) characters of string1 need to be converted to the first j characters of string2. The last step is to delete string1[i-1], which requires at least d[i-1][j]+1 steps.

[0076] If the last step is modification, then the first (i-1) characters of string1 need to be converted to the first (j-1) characters of string2, and the last step is to modify string1[i-1] to string[j-1], which requires at least d[i-1][j-1]+1 steps.

[0077] The calculation method of the above edit distance can be expressed by the following formula:

[0078]

[0079] Where d[i][j] represents the edit distance between the i-th character of string1 and the j-th character of string2.

[0080] like Figure 2 The figure is a flow chart of a configuration anomaly detection method provided by an embodiment of the present application. The method can be applied to Figure 1 The computer device 101 or server 102 shown. The method includes S210-S250. In which:

[0081] S210, obtaining a configuration file.

[0082] A configuration file is a computer file that can configure parameters and initial settings for some computer programs. The configuration file is the configuration file that needs to be detected for anomalies.

[0083] S220: Extract words from each configuration file to obtain words in each configuration file.

[0084] The specific process of extracting words from the configuration file can be referred to the description in the related art and will not be described in detail in the embodiments of this application.

[0085] S230: Determine the word attributes of each word.

[0086] Word attributes refer to the properties and relationships of words. In some embodiments, word attributes include the number of consecutive repetitions of a word in a configuration file, the word type of the word, and the like.

[0087] like Figure 3 As shown, in some embodiments, before determining the word attributes of each word, the method further includes S310.

[0088] S310: Filter out target words that do not belong to a preset format from the words.

[0089] The preset format is pre-set. In some embodiments, the preset format includes two or more formats. In some embodiments, the preset format includes formats corresponding to network addresses (such as IPv4 addresses, IPv6 addresses), port numbers, registration numbers, dates, and serial numbers.

[0090] The network address, port number, registration number, date, and serial number in the configuration file are all highly random and therefore can be excluded from the analysis. Therefore, in this embodiment, after extracting the words from the configuration file, these words are filtered out and only the word attributes of the remaining content in the configuration file are determined and analyzed.

[0091] In some embodiments, the network address, port number, registration number, date, and serial number have relatively fixed formats, so these parts of the configuration file can be filtered out using their corresponding fixed formats to obtain the target word.

[0092] Furthermore, in some embodiments, after filtering out the words such as network address, port number, registration number, date, and serial number, fixed fields are used to replace these contents in the configuration file. For example, if "192.168.0.1" in the configuration file is determined to be an IPv4 address after analysis, "192.168.0.1" in the configuration file can be replaced with "IPv4 address". Similarly, "2022-05-20" in the configuration file can be replaced with "date". It should be noted that the above-mentioned fixed fields can also be other names, such as A, B, C, D, E, F, etc.

[0093] As can be seen from the description of the above embodiment, the above network addresses, port numbers and other contents each have a fixed format, so the words corresponding to the above contents can be filtered out from all the words in the configuration file through regular expressions.

[0094] Please continue to refer to Figure 3 In this embodiment, the above S230 includes S230a.

[0095] S230a: Determine the word attributes of each target word.

[0096] It is understandable that in the technical solution of screening out target words, the subsequent steps of filtering out the words in the configuration file can be performed only on the target words.

[0097] In the technical solution provided in the embodiment of the present application, words that do not need to be analyzed are screened out from all words, and only the target words are analyzed to determine the word attributes, which can reduce the complexity of subsequent steps and improve detection efficiency.

[0098] In some embodiments, the word attributes of the target word include: the number of consecutive repetitions of the target word in the configuration file, and the word type. Figure 4 As shown, in this embodiment, S230a includes S231 and S232.

[0099] in:

[0100] S231, counting the number of consecutive repetitions and the frequency of occurrence of each target word in the configuration file.

[0101] If two adjacent words are the same, it means that the word is repeated; the number of consecutive identical words is the number of consecutive repetitions of the word.

[0102] For example, if the configuration file contains the sentence "BAAAAC," the number of consecutive repetitions of word A in the configuration file is the number of consecutive repetitions of A, which is 4. For another example, if the configuration file contains the sentence "ABAAAAC," word A appears twice: the first time before word B, the number of consecutive repetitions is 1; the second time between word B and word C, the number of consecutive repetitions is 4.

[0103] In some embodiments, the frequency of occurrence of a term includes word frequency and document frequency.

[0104] Term frequency is used to assess the degree of repetition of a term within a document or a set of domain documents in a corpus. In the present embodiment, term frequency represents the degree of repetition of a term within a configuration file. Specifically, the term frequency of a term within a configuration file may be the ratio of the number of occurrences of the term within the configuration file to the total number of terms within the configuration file.

[0105] Document frequency refers to the number of documents in which the term appears in the training corpus. In this embodiment of the present application, the document frequency of a term in a configuration file represents the ratio of the number of times the term appears in all configuration files to be tested to the number of configuration files to be tested.

[0106] S232: Determine the word type corresponding to each target word in the configuration file according to the frequency of occurrence.

[0107] In some embodiments, the word type includes a keyword type and a common type. The word type is determined according to the frequency of occurrence of the word in the configuration file, where a word with a high frequency of occurrence is a keyword type and a word with a low frequency of occurrence is a common type.

[0108] In some embodiments, the word type corresponding to each target word in the configuration file is determined based on the frequency of occurrence, including: if the first word in the target words meets the preset conditions, then the word type of the first word is determined to be a keyword type; if the second word in the target words does not meet the preset conditions, then the word type of the second word is determined to be an ordinary type.

[0109] The pre-set conditions include a word frequency greater than a first threshold and a document frequency greater than a second threshold. Words with both high word and document frequencies may be highly important in the configuration file being tested. Therefore, in this embodiment, words with both word and document frequencies greater than the corresponding thresholds are marked as keywords. The first and second thresholds can be set based on actual circumstances.

[0110] In some embodiments, after determining the word type of each target word, the method further includes storing the keyword-type words in a keyword corpus. Constructing a keyword corpus for the keywords in the configuration file to be tested facilitates determining the anomaly type contained in the configuration file to be tested. Determining the anomaly type contained in the configuration file to be tested will be described in detail in a later embodiment.

[0111] In some embodiments, after determining the word type of each target word, the method further includes: marking the corresponding word type for each target word in the configuration file to be detected. Marking the word type in the configuration file facilitates constructing a corresponding grammar analysis tree based on the configuration file.

[0112] The technical solution provided in the embodiments of this application calculates the number of consecutive repetitions of each target word in the configuration file, its frequency of occurrence (e.g., word frequency, document frequency), and other attributes. The word type is then determined based on the word frequency and document frequency of the target word, thereby distinguishing the importance of the word in the configuration file. This facilitates anomaly detection in the configuration file at the word level.

[0113] S240 , constructing a syntax analysis tree corresponding to each configuration file based on preset rules, each word and its attribute.

[0114] The preset rules represent rules for establishing a syntax analysis tree. In some embodiments, the preset rules specify the contents stored in nodes at each level of the syntax analysis tree corresponding to the configuration file.

[0115] In some embodiments, constructing the syntax analysis tree specifically involves constructing a corresponding syntax analysis tree for each configuration file to be detected.

[0116] like Figure 5 As shown, in some embodiments, the above S240 includes S241-S248. For any configuration file:

[0117] S241: Store the file identifier of the configuration file in the first-level node of the syntax analysis tree.

[0118] The file identifier of the configuration file is used to uniquely identify the configuration file. In some embodiments, the file identifier of the configuration file can be information such as the configuration file name, the file number of the configuration file, etc.

[0119] The first layer node of the syntax analysis tree is also the root node of the syntax analysis tree. In this embodiment, the file identifier of the configuration file is stored as the root node of the syntax analysis tree.

[0120] S242: Create a word node according to the target word, and store the word content and word attributes of the target word in the word node.

[0121] In some embodiments, creating word nodes based on target words may specifically include creating a word node for consecutively repeated words in the configuration file. For example, for the sentence "ABAAAAC", word nodes for word A, word B, word A, and word C are created respectively, which can be represented as four word nodes: word node A1, word node B, word node A2, and word node C.

[0122] Then, the word attributes (such as the number of consecutive repetitions, word type) and word content of the target word corresponding to each word node are stored in the word node. Still taking the above sentence "ABAAAAC" as an example, after creating word node A1, word node B, word node A2 and word node C, it is determined that the number of consecutive repetitions of word node A1 is 1, and the number of consecutive repetitions is stored together with the word content and word type in word node A1. Similarly, the number of consecutive repetitions stored in word node B, word node A2 and word node C are 1, 4 and 1 respectively. Similarly, according to the above similar method, the word type of the word can also be stored in the word node.

[0123] S243 , concatenating the word nodes belonging to the same sentence according to the order in which the target words appear in the configuration file to obtain a sentence node.

[0124] After creating a word node corresponding to each target word and storing the word content and word attributes of the target word in the word node, the word nodes storing the word content and word attributes are concatenated to obtain a sentence node.

[0125] S244: Concatenate sentence nodes belonging to the same paragraph in order of appearance to obtain a paragraph node.

[0126] Similar to concatenating word nodes to obtain sentence nodes, paragraph nodes can be obtained by concatenating sentence nodes in the order in which they appear in the configuration file.

[0127] S245, counting the number of consecutive repetitions of each sentence node and paragraph node.

[0128] If two adjacent sentences (or paragraphs) are identical, the sentence (or paragraph) is considered repeated. The number of consecutive identical sentences or paragraphs is the number of consecutive repetitions of the sentence node or paragraph node.

[0129] In some embodiments, after filtering out words in a preset format, the words in the configuration file in the preset format are replaced with fixed fields. Therefore, when determining whether two sentences are the same, it is only necessary to determine whether the structures of the two sentences are the same.

[0130] For example, if the word C in the sentence "ABAAAAC" is an IPv4 address in a preset format, then in the configuration file, we replace word C with the IPv4 address, resulting in the sentence "ABAAAA-IPv4 address." The sentence "M" in the sentence "ABAAAAM" is also an IPv4 address in a preset format, and after replacement, we obtain the sentence "ABAAAA-IPv4 address." Since the sentences obtained after replacement are both "ABAAAA-IPv4 address," they are identical. Therefore, the sentences "ABAAAAC" and "ABAAAAM" will be determined to be the same sentence in the configuration file.

[0131] Two paragraphs are identical if all corresponding sentences in the two paragraphs are identical. Whether sentences in a paragraph are identical can be determined by referring to the above method and will not be repeated here.

[0132] S246: Store the paragraph node and the number of consecutive repetitions of the paragraph node in the second-level nodes of the grammar analysis tree.

[0133] In the second-level nodes of the parse tree, consecutively repeated paragraph nodes are stored in the same node, and the number of consecutive repetitions of the paragraph node is stored in the node. The paragraph node corresponding to a paragraph serves as a branch of a root node. After storing the paragraph nodes corresponding to all paragraphs in the configuration file according to the above method, the second-level nodes of the configuration file can be obtained.

[0134] S247 , according to the paragraph to which each sentence node belongs in the configuration file, connect each sentence node to the paragraph node corresponding to the sentence node, and store the sentence node and the number of consecutive repetitions as the third-level node of the grammar analysis tree.

[0135] For the sentence nodes corresponding to the sentences contained in the same paragraph, the corresponding paragraph nodes of the paragraph are connected to obtain the third-level nodes of the parse tree. Specifically, for the sentence nodes that are repeated continuously in the same paragraph, they are stored in the same node, and the number of consecutive repetitions of the sentence node is stored in the node.

[0136] Among them, the sentence node corresponding to a sentence serves as a branch of a paragraph node.

[0137] S248 , according to the sentences to which each target word belongs in the configuration file, each word node is connected to the sentence node corresponding to the word node, as a fourth-level node of the grammatical analysis tree.

[0138] Similar to connecting the sentence nodes to the paragraph nodes of the paragraphs they belong to, the word nodes corresponding to the words belonging to the same sentence are connected to the sentence nodes of the sentence respectively, so as to obtain the fourth-level nodes of the grammatical analysis tree.

[0139] In some embodiments, when creating word nodes based on words, words that appear repeatedly in the configuration file are merged and created into a single word node. Therefore, when storing word nodes, it is sufficient to sequentially connect word nodes belonging to the same sentence to the sentence node of the sentence. Each word node in a sentence serves as a branch of the sentence node corresponding to the sentence. It is understood that the node storing each word node is the fourth-level node of the parse tree.

[0140] In the technical solution provided in the embodiments of this application, a corresponding parse tree is constructed for each configuration file. Each parse tree includes at least nodes constructed based on the configuration file's paragraphs, sentences, and words, as well as the number of consecutive repetitions of each. This facilitates analysis based on the words, sentences, and paragraphs in the configuration file, enabling anomaly detection in the configuration file.

[0141] S250 , performing anomaly detection on each configuration file according to the syntax analysis tree corresponding to each configuration file to obtain a configuration anomaly detection result.

[0142] After constructing a corresponding syntax analysis tree for each configuration file, analysis can be performed based on the syntax analysis tree to detect anomalies in the configuration file.

[0143] In some embodiments, anomaly detection is performed on the configuration file based on the grammatical analysis tree. Specifically, the grammatical analysis tree may be clustered, and the configuration files are determined to have anomalies based on the clustering results. After determining which configuration files have anomalies, the specific location of the anomaly in the configuration file and the type of anomaly may also be determined.

[0144] In the technical solution provided by the embodiments of the present application, a grammatical analysis tree corresponding to the configuration file to be detected is constructed using the words and the word attributes of each word. Anomaly detection is then performed for each configuration file based on the grammatical analysis tree corresponding to the configuration file. In this way, a computer automatically analyzes the word attributes of the words contained in the configuration file based on the configuration file, and completes anomaly detection for the configuration file based on the word attributes, eliminating the need for time-consuming maintenance by relevant personnel and reducing labor costs.

[0145] Exemplarily, the configuration anomaly detection result includes: an abnormal configuration file where an anomaly occurs in the configuration file, an abnormal location in the abnormal configuration file, and an abnormality type corresponding to the abnormal location.

[0146] like Figure 6 As shown, in some embodiments, S250 includes S251-S253, wherein:

[0147] S251 , clustering the syntax analysis trees corresponding to the configuration files to determine abnormal configuration files among the configuration files.

[0148] The process of dividing a set of physical or abstract objects into multiple classes consisting of similar objects is called clustering. In the embodiment of the present application, any clustering method can be used to cluster the parse tree.

[0149] In some embodiments, as Figure 7 As shown, S251 includes S710 and S720.

[0150] S710 , clustering each grammar analysis tree using a K-means clustering algorithm to obtain a clustering result.

[0151] The K-means clustering algorithm divides input data into K sets. After clustering is complete, a small amount of data that cannot be classified into the K sets is generally considered to be an abnormal data point. In this embodiment, the profile corresponding to the abnormal data point in the clustering results of the K-means clustering algorithm is determined as an abnormal profile.

[0152] It can be understood that if there are no abnormal data points in the clustering results obtained by the K-means clustering method, it means that there may be no abnormal configuration files in the configuration files.

[0153] Among them, such as Figure 8 As shown, the above S710 specifically includes S711-S713. Among them:

[0154] S711: Determine the number of paragraph types, sentence types, and word types included in each configuration file based on the grammatical analysis tree.

[0155] The number of paragraph types specifically refers to the number of paragraph types included in the configuration file, with identical paragraphs being counted as one type of paragraph. Similarly, the number of sentence types and the number of word types respectively refer to the number of sentence types and word types included in a configuration file.

[0156] Since nodes are constructed according to paragraphs, sentences, and words when constructing the syntax analysis tree corresponding to the configuration file, the number of paragraph types, sentence types, and word types in the configuration file can be determined by counting and analyzing the content of each node.

[0157] S712: Generate an array corresponding to each grammatical analysis tree based on the number of paragraph types, sentence types, and word types in each configuration file.

[0158] In some embodiments, for any parse tree, the number of paragraph types, the number of sentence types, and the number of word types are respectively used as three elements of an array to obtain an array corresponding to the parse tree. For example, the composition of the array can be (number of paragraph types, number of sentence types, number of word types) or (number of word types, number of sentence types, number of paragraph types), which is not limited in the embodiments of the present application.

[0159] S713, clustering the arrays corresponding to the grammar analysis trees using the K-means clustering algorithm to obtain clustering results.

[0160] Specifically, in the process of the K-value clustering algorithm, the similarity of each input array is calculated, and each array is divided into sets according to the similarity between the arrays. In some embodiments, any similarity calculation method can be used in the process of the K-means clustering algorithm. For example, cosine similarity can be used, Manhattan distance can be used to represent the similarity between arrays, or edit distance, etc. Among them, the specific process of calculating the similarity between arrays using any of the above similarity calculation methods can refer to the description in the relevant technology and will not be repeated in the embodiments of this application.

[0161] In some embodiments, the arrays corresponding to the parse trees are clustered using a K-means clustering algorithm. The process of obtaining the clustering result may specifically include:

[0162] Randomly select K arrays from n arrays (samples) as the centroids of the group; traverse the arrays corresponding to all parse trees and divide them into the nearest centroids; calculate the similarity between the remaining samples and the initial centroid to determine the new centroid; repeat the above steps until the stopping condition is met.

[0163] The standard measurement function may be cosine distance or Manhattan distance, etc. The stopping conditions may specifically include: the centroid no longer moves; all distances reach a minimum value, i.e., the standard measurement function begins to converge; or the number of iterations reaches a preset value.

[0164] Among them, the K value of the K-means clustering algorithm needs to be determined in advance. In some embodiments, the K value of the K-means clustering algorithm can be automatically determined using an algorithm. As can be seen from the above description, the arrays corresponding to the various parse trees can be combined into a matrix, and the matrix can be used as the input parameter X for automatically determining the K value. By traversing each candidate K value, the silhouette coefficient corresponding to each K value is calculated respectively. The K value with the highest silhouette coefficient is determined as the K value finally used by the K-means clustering algorithm.

[0165] In some embodiments, the arrays corresponding to the grammar analysis trees are combined into a matrix. Specifically, the array corresponding to each grammar analysis tree is used as a row element of the matrix to obtain a matrix composed of the arrays.

[0166] In other embodiments, the K value of the K-means clustering algorithm can also be determined according to the application scenario. Exemplarily, the process of determining the K value in the K-means clustering algorithm includes: obtaining the number of types of each configuration file as the K value.

[0167] The structures of different types of configuration files are generally different, while the structures of configuration files of the same type are similar. Therefore, in the embodiment of the present application, the number of types of configuration files to be detected is obtained and used as the K value used by the K-means clustering algorithm. When the K-means clustering algorithm is used to cluster the parse trees corresponding to each configuration file, the number of clustered sets is the same as the number of configuration files. This makes the clustering of the K-means clustering algorithm more reasonable.

[0168] In some embodiments, the configuration file typically includes information such as manufacturer information and a version number. Configuration files corresponding to the same manufacturer and the same version number typically use similar structures. Therefore, the type of configuration file can be determined based on the manufacturer information, version number, and other information of the configuration file. In some embodiments, if the configuration file includes a version number, configuration files with the same version number are determined to be of the same type. If the configuration file does not include a version number, configuration files with the same manufacturer information are determined to be of the same type.

[0169] In the technical solution provided in the embodiment of the present application, the value of K used in the K-means clustering algorithm is determined according to the type of the configuration file to be detected, thereby making the clustering of the K-means clustering algorithm more reasonable.

[0170] S720: Obtain abnormal data points in the clustering results.

[0171] In this embodiment, the abnormal configuration file includes a configuration file corresponding to the abnormal data point.

[0172] The K-means clustering algorithm clusters the input data into K clusters and then determines the distance from each element in each cluster to the cluster center. Data points with the greatest distance, or those with a distance greater than a distance threshold, are selected as outliers. In this embodiment of the present application, the K-means clustering algorithm is used to cluster the parse trees corresponding to each configuration file. The configuration files corresponding to the resulting outlier data points are then determined to be outlier configuration files.

[0173] In the technical solution provided in the embodiment of this application, the configuration files converted into parse trees are clustered using the K-means clustering algorithm, and abnormal configuration files are determined based on the distance results. The clustering algorithm is simple in concept, converges quickly, and has excellent clustering effect.

[0174] S252: Compare the configuration file template with the abnormal configuration file to determine the abnormal position of the abnormal configuration file.

[0175] Configuration file templates and exception configuration files belong to the same category. Each exception configuration file corresponds to a configuration file template.

[0176] In some embodiments, the configuration file template may be a configuration file without exception that belongs to the same type as the abnormal configuration file, for example, a configuration file without exception that has the same version number as the abnormal configuration file; if the abnormal configuration file does not have a version number, the configuration file template may also select a configuration file without exception that belongs to the same manufacturer as the abnormal configuration file.

[0177] In other embodiments, a configuration file template may be selected based on clustering results. For example, in the clustering results, the configuration file corresponding to any array in the cluster closest to the array corresponding to the abnormal configuration file is selected as the configuration file template. It should be understood that in other embodiments, the configuration file template may also be determined by other means.

[0178] After determining the configuration file template corresponding to the abnormal configuration file, the abnormal configuration file is compared with the configuration file template to determine the position where the abnormality exists in the abnormal configuration file, which is recorded as the abnormal position.

[0179] S253: Match the file content at the abnormal position of the abnormal configuration file with the preset abnormal type to obtain the abnormal type corresponding to the file content at the abnormal position.

[0180] The preset exception type is a type of exception that occurs in a predetermined configuration file. In some embodiments, the preset exception type can be obtained from an exception type that occurs in a common configuration file; specifically, it can be obtained through a network, or from a historical database that stores configuration file exception data.

[0181] In other embodiments, the preset abnormality type can also be determined by analyzing the configuration file to be detected. Figure 9 As shown, the above method further includes S900-S950 between S220 and S250.

[0182] S900: randomly select two or more adjacent corpus samples from the configuration file.

[0183] The corpus sample includes at least one of a paragraph, a sentence and a word.

[0184] S910, counting the co-occurrence frequencies of adjacent corpus combinations in the configuration file.

[0185] Among them, the adjacent corpus combination consists of adjacent corpus samples of the same type.

[0186] The frequency with which adjacent corpus combinations appear in the configuration file is the co-occurrence frequency of the adjacent corpus combination. For example, if the corpus samples include words, adjacent corpus refers to adjacent word samples, and the co-occurrence frequency of the adjacent corpus combination indicates how often the adjacent word samples appear together in the configuration file. For example, in the sentence "ABCABC" in the configuration file, words A and B are adjacent, forming the adjacent word combination "A-B". The frequency of "A-B" appearing in the configuration file is the co-occurrence frequency of the adjacent word combination. Similarly, the sentence "ABCABC" also contains the adjacent word combinations "BA" and "CA". The co-occurrence frequencies of "BA" and "CA" can be counted separately.

[0187] For example, the co-occurrence frequency of adjacent word samples can be counted. Specifically, the number of occurrences of the adjacent word combination "A-B" in the configuration file can be counted, and the number of all adjacent word combinations in the configuration file can be counted. The ratio of the number of occurrences of "A-B" to the number of all adjacent word combinations is used as the co-occurrence frequency of the adjacent sentence combination "A-B".

[0188] It is understandable that when the corpus includes paragraph samples or sentence samples, the occurrence frequencies of adjacent paragraph combinations or adjacent sentence combinations in the configuration file can be counted by a method similar to counting the co-occurrence frequencies of adjacent word combinations.

[0189] In some embodiments, the corpus sample may include words, sentences, and paragraphs. That is, for the configuration file to be tested, the co-occurrence frequencies of adjacent word combinations, adjacent sentence combinations, and adjacent paragraph combinations are counted separately. In this way, the possible anomaly types in the configuration file can be determined at the word, sentence, and paragraph levels.

[0190] Furthermore, in some embodiments, after scanning the configuration file and obtaining the co-occurrence frequencies between adjacent corpus combinations, each adjacent corpus combination and its corresponding co-occurrence frequency are stored in a database. In some embodiments, the database storing adjacent corpus combinations and co-occurrence frequencies can be referred to as a co-occurrence corpus.

[0191] In some embodiments, when counting the co-occurrence frequencies between adjacent corpus combinations, the co-occurrence frequencies of each adjacent corpus combination in all configuration files to be detected are counted.

[0192] S920: Calculate the similarity between the same corpus samples in the configuration file.

[0193] The two words / two sentences / two paragraphs all belong to the same corpus sample. Calculating the similarity between two samples of the same corpus can be achieved in any manner. In some embodiments, the similarity between two samples of the same corpus is calculated using edit distance.

[0194] S930 : Determine candidate anomaly types for the configuration file based on the co-occurrence frequencies of adjacent corpus combinations and the similarities between pairs of samples of the same corpus.

[0195] The candidate anomaly types in the configuration file may be determined based on the co-occurrence frequency of adjacent corpus combinations and / or the similarity between two samples of the same corpus.

[0196] In some embodiments, the candidate anomaly types present in the configuration file are determined based on the co-occurrence frequencies of adjacent corpus combinations, which may specifically include: searching for adjacent corpus combinations in each adjacent corpus combination to determine whether the corpus order is reversed. If there is a first adjacent word combination and a second adjacent corpus combination with reversed corpus order, the first co-occurrence frequency of the first adjacent word combination and the second co-occurrence frequency of the second adjacent corpus combination are obtained respectively. If the first co-occurrence frequency exceeds the first frequency threshold and the second co-occurrence frequency does not exceed the second frequency threshold, it is determined that the configuration file contains a candidate anomaly type with abnormal corpus order. The first frequency threshold is greater than the second frequency threshold.

[0197] For example, the corpus order in the first adjacent word combination "AB" and the second adjacent word combination "BA" is opposite.

[0198] In some embodiments, if the first co-occurrence frequency exceeds the first frequency threshold and the second co-occurrence frequency does not exceed the second frequency threshold, it is determined that the adjacent corpus combination corresponding to the second co-occurrence frequency has a sequence anomaly. It is understandable that if the second co-occurrence frequency exceeds the first frequency threshold and the first co-occurrence frequency does not exceed the second frequency threshold, it can also be determined that the configuration file contains a candidate anomaly type for corpus sequence anomaly. Specifically, it is determined that the adjacent corpus combination corresponding to the first co-occurrence frequency has a sequence anomaly.

[0199] In other embodiments, determining candidate anomaly types in the configuration file based on similarity between corpus samples of the same type may include selecting a corpus sample as a reference corpus sample and calculating similarity between other corpus samples and the reference corpus sample. If other corpus samples exist whose similarity falls within a preset similarity range, then determining that a candidate anomaly type exists in the configuration file as a spelling anomaly.

[0200] Here, taking the preset similarity range of 0-5% as an example, and using the edit distance to represent the similarity between corpora, after calculating the similarity between other corpus samples and the reference corpus sample, if there is a similarity between 0-5%, it is determined that there is a candidate anomaly type of spelling anomaly in the configuration file.

[0201] When the corpus sample includes words, the reference corpus sample can be selected from a keyword corpus. In this way, it can be determined whether there is an abnormal type of keyword spelling abnormality in the configuration file.

[0202] It should be noted that, in other embodiments, other abnormal types of the configuration file may also be determined based on the co-occurrence frequency of adjacent corpus combinations and the similarity between corpus of the same type.

[0203] S940: Issue a prompt message according to the candidate exception type, and obtain user feedback information regarding the prompt message.

[0204] S950: Use the target candidate abnormality type determined in the feedback information as a preset abnormality type of the configuration file.

[0205] The above-mentioned process of scanning the configuration file and determining the anomaly type present in the configuration file based on the co-occurrence frequency of adjacent corpora and the similarity between the corpora may result in false detection. That is, the corpus itself does not contain anomalies, but is determined to contain anomalies by the above-mentioned method. In order to reduce the occurrence of this situation, after obtaining the candidate anomaly type, relevant personnel can review whether the above-mentioned candidate anomaly type actually exists. Therefore, in an embodiment of the present application, after determining the candidate anomaly type, a prompt message is issued based on the candidate anomaly type. And based on the feedback information of the prompt message, it is determined which candidate anomaly types are indeed the anomaly types present in the configuration file, and recorded as the preset anomaly type.

[0206] It should be noted that this application does not limit the execution order between the above-mentioned S900-S950 and S230-S240.

[0207] In the technical solution provided by the embodiments of this application, a portion of the corpus is selected from the configuration file as a sample, and the possible anomaly types in the configuration file are determined by analyzing the corpus sample. Then, based on the experience of relevant personnel, the anomaly type confirmed by the relevant personnel is used as the preset anomaly type for the configuration file. This facilitates the determination of the anomaly type at the abnormal location in the configuration file when performing anomaly detection on the configuration file.

[0208] In some embodiments, after S250, the method further includes: issuing a detection result reminder message based on the configuration anomaly detection result, wherein the detection result reminder message is used to display the configuration anomaly detection result to relevant personnel. In this way, relevant personnel can quickly understand the anomaly in the configuration file, including the location and type of the anomaly.

[0209] In some embodiments, after S250, the method further includes: generating a recommended solution based on the exception type; and feeding back the recommended solution to relevant personnel, so that relevant personnel can quickly modify or adjust the abnormal location of the configuration file.

[0210] In some embodiments, after S250, the above method may further classify the determined abnormality types into different levels. This allows relevant personnel to better understand the abnormalities in the configuration file and thus determine whether the abnormalities in the configuration file need to be modified or adjusted, as well as the solutions for the modifications and adjustments.

[0211] In other embodiments of the present application, a configuration abnormality detection device is also provided, such as Figure 10 As shown, the device includes: an acquisition module 1010, an extraction module 1011, an attribute determination module 1012, a construction module 1013 and a detection module 1014.

[0212] The acquisition module 1010 is configured to execute the acquisition of the configuration file to be detected. For example, the acquisition module 1010 can be used to execute the following Figure 2 S210 shown.

[0213] The extraction module 1011 is configured to perform word extraction on each configuration file to obtain the words in each configuration file. For example, the extraction module 1011 can be used to perform the following steps: Figure 2 S220 shown.

[0214] The attribute determination module 1012 is configured to determine the attribute of each word. For example, the attribute determination module 1012 can be used to perform the following steps: Figure 2 S230 shown.

[0215] The construction module 1013 is configured to execute the syntax analysis tree corresponding to each configuration file based on the preset rules, each word and the word attribute of each word. For example, the construction module 1013 can be used to execute the following Figure 2 S240 shown.

[0216] The detection module 1014 is configured to perform anomaly detection on each configuration file according to the syntax analysis tree corresponding to each configuration file, and obtain a configuration anomaly detection result. For example, the detection module 1014 can be used to perform the following Figure 2 S250 shown.

[0217] In the technical solution provided by the embodiments of the present application, a grammatical analysis tree corresponding to the configuration file to be detected is constructed using the words and the word attributes of each word. Anomaly detection is then performed for each configuration file based on the grammatical analysis tree corresponding to the configuration file. In this way, a computer automatically analyzes the word attributes of the words contained in the configuration file based on the configuration file, and completes anomaly detection for the configuration file based on the word attributes, eliminating the need for time-consuming maintenance by relevant personnel and reducing labor costs.

[0218] In some embodiments, the configuration anomaly detection device further includes: a screening module 1015 configured to screen target words that do not conform to a preset format from each word. In this embodiment, the attribute determination module 1012 is specifically configured to determine the attribute of each target word.

[0219] In some embodiments, the word attributes of the target word include: the number of consecutive repetitions of the target word in the configuration file and the word type. The above-mentioned attribute determination module 1012 includes: a statistics submodule configured to perform statistics on the number of consecutive repetitions and the frequency of occurrence of each target word in the configuration file; and a type determination submodule configured to determine the word type corresponding to each target word in the configuration file based on the frequency of occurrence.

[0220] In some embodiments, the frequency of occurrence includes word frequency and document frequency. The type determination submodule of the configuration anomaly detection device is specifically configured to execute: if the word frequency of a first word in the target words is greater than a first threshold and the document frequency is greater than a second threshold, then determine that the word type of the first word is a keyword type; if the word frequency of a second word in the target words is less than or equal to the first threshold and / or the document frequency is less than or equal to the second threshold, then determine that the word type of the second word is a common type.

[0221] In some embodiments, the construction module 1013 of the above-mentioned configuration anomaly detection device includes: a first storage submodule, configured to execute the storage of the file identifier of the configuration file in the first-level node of the grammatical analysis tree; a word node creation submodule, configured to execute the creation of word nodes according to the target words, and store the word content and word attributes of the target words in the word nodes; a first concatenation submodule, configured to execute the concatenation of each word node belonging to the same sentence in the order of appearance of each target word in the configuration file to obtain a sentence node; a second concatenation submodule, configured to execute the concatenation of each sentence node belonging to the same paragraph to obtain a paragraph node; a statistics submodule, configured to execute The first submodule is configured to count the consecutive repetition times of each sentence node and paragraph node respectively; the second storage submodule is configured to execute the storage of the paragraph node and the consecutive repetition times of the paragraph node in the second-level node of the grammatical analysis tree; the third storage submodule is configured to execute the connection of each sentence node to the paragraph node corresponding to the sentence node according to the paragraph to which each sentence node belongs in the configuration file, and store them together with the consecutive repetition times of the sentence node as the third-level node of the grammatical analysis tree; the fourth storage submodule is configured to execute the connection of each word node to the sentence node corresponding to the word node according to the sentence to which each target word belongs in the configuration file, as the fourth-level node of the grammatical analysis tree.

[0222] In some embodiments, the configuration anomaly detection result includes: an abnormal configuration file in which an anomaly occurs in the configuration file, an abnormal location in the abnormal configuration file, and an abnormality type corresponding to the abnormal location. The detection module 1014 of the configuration anomaly detection apparatus includes: a clustering submodule configured to determine an abnormal configuration file in each configuration file by clustering the grammatical analysis trees corresponding to each configuration file; an abnormal location determination submodule configured to compare a configuration file template with the abnormal configuration file to determine the abnormal location of the abnormal configuration file; the configuration file template and the abnormal configuration file belong to the same type; and an abnormality type determination submodule configured to match the file content of the abnormal location of the abnormal configuration file with a preset abnormality type to obtain the abnormality type corresponding to the file content at the abnormal location.

[0223] In some embodiments, the above-mentioned configuration anomaly detection device also includes: a sample selection module 1016, configured to randomly select two or more groups of adjacent corpus samples from the configuration file; wherein the corpus samples include at least one of paragraphs, sentences and words; a statistical module 1017, configured to perform statistical calculations of the co-occurrence frequency of adjacent corpus combinations in the configuration file; adjacent corpus combinations are composed of adjacent corpus samples of the same type; a similarity calculation module 1018, configured to perform calculations of the similarity between the same type of corpus samples in the configuration file; a candidate type determination module 1019, configured to determine the candidate anomaly type of each configuration file based on the co-occurrence frequency of adjacent corpus combinations and the similarity between the same type of corpus samples; a confirmation module 1020, configured to issue prompt information based on the candidate anomaly type and obtain user feedback information on the prompt information; a preset anomaly type determination module 1021, configured to use the target candidate anomaly type determined in the feedback information as the preset anomaly type of the configuration file.

[0224] In some embodiments, the clustering submodule of the above-mentioned configuration anomaly detection device is specifically configured to perform: clustering each grammatical analysis tree using the K-means clustering algorithm to obtain a clustering result; obtaining abnormal data points in the clustering result; wherein the abnormal configuration file includes a configuration file corresponding to the abnormal data point.

[0225] In some embodiments, the clustering submodule of the above-mentioned configuration anomaly detection device is specifically configured to perform: determining the number of paragraph types, sentence types, and word types included in each configuration file based on the grammatical analysis tree; generating an array corresponding to each grammatical analysis tree based on the number of paragraph types, sentence types, and word types in each configuration file; and clustering the arrays corresponding to each grammatical analysis tree using the K-means clustering algorithm to obtain a clustering result.

[0226] In some embodiments, the configuration anomaly detection apparatus further includes a K value determination module 1022 configured to execute: obtaining the number of types of each configuration file as a K value.

[0227] Regarding the apparatus in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0228] Figure 11 FIG. 1 is a block diagram of a computer device 1100 according to an exemplary embodiment. Figure 11 The computer device 1100 may include at least one processor 1101 and a memory 1103 for storing instructions executable by the processor 1101. The processor 1101 is configured to execute the instructions in the memory 1103 to implement the configuration anomaly detection and identification method in the above embodiment. In some embodiments, the memory 1103 is used to store the program code and data of the above configuration anomaly detection device; the processor 1101 is used to execute the instructions in the memory 1103 to implement the configuration anomaly detection and identification method in the above embodiment. Figure 2 In some embodiments, the computer device 1100 may be the server in the above embodiments.

[0229] Computer device 1100 may also include a communication bus 1102 and at least one communication interface 1104 .

[0230] The processor 1101 may be a central processing unit (CPU), a microprocessor unit, an ASIC, or one or more integrated circuits for controlling the execution of the program of the disclosed solution.

[0231] The communication bus 1102 may include a pathway for transmitting information between the aforementioned components.

[0232] The communication interface 1104 uses any transceiver or other device for communicating with other devices or communication networks, such as Ethernet, radio access network (RAN), wireless local area network (WLAN), etc.

[0233] The memory 1103 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory can be independent and connected to the processing unit via a bus. The memory can also be integrated with the processing unit and be a volatile storage medium in the CPU.

[0234] The memory 1103 is used to store the computer program for executing the solution of the present disclosure, and the execution is controlled by the processor 1101. The processor 1101 is used to execute the computer program stored in the memory 1103, thereby realizing the functions of the method of the present disclosure.

[0235] In a specific implementation, as an embodiment, the processor 1101 may include one or more CPUs, such as Figure 11 CPU0 and CPU1 in.

[0236] In a specific implementation, as an embodiment, the computer device 1100 may include multiple processors, such as Figure 11 1 and 1107. Each of these processors may be a single-CPU processor or a multi-CPU processor. A processor herein may refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).

[0237] In a specific implementation, as an embodiment, the computer device 1100 may further include an output device 1105 and an input device 1106. The output device 1105 communicates with the processor 1101 and can display information in a variety of ways. For example, the output device 1105 can be a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector. The input device 1106 communicates with the processor 1101 and can receive user input in a variety of ways. For example, the input device 1106 can be a mouse, a keyboard, a touch screen device, or a sensor device.

[0238] Those skilled in the art will understand that Figure 11 The structure shown in the figure does not constitute a limitation on the computer device 1100, and the computer device 1100 may include more or fewer components than shown in the figure, or combine some components, or adopt a different component arrangement.

[0239] In an exemplary embodiment, a computer program product is further provided, including a computer program. When the computer program is executed by a processor, the resource request processing method provided in any one of the above embodiments is implemented.

[0240] Other embodiments of the present disclosure will readily occur to those skilled in the art after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art not disclosed herein. The description and examples are to be considered as exemplary only, with the true scope and spirit of the present disclosure being indicated by the following claims.

[0241] It should be understood that the present disclosure is not limited to the exact structures that have been described above and shown in the drawings, and that various modifications and changes can be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

Claims

1. A configuration anomaly detection method, characterized in that: include: Get the configuration file to be tested; Performing word extraction on each of the configuration files to obtain the words in each of the configuration files; Filtering out words that do not belong to a preset format from the words to obtain target words; Determining the word attributes of each of the words, including: determining the word attributes of each of the target words; Based on preset rules, each target word and the word attribute of each target word, a syntax analysis tree corresponding to each configuration file is constructed, including: For any of the above configuration files: storing the file identifier of the configuration file in the first-level node of the syntax analysis tree; Creating a word node according to the target word, and storing the word content and the target word attribute of the target word in the word node; Concatenate the word nodes belonging to the same sentence according to the order in which the target words appear in the configuration file to obtain a sentence node; Concatenate the sentence nodes belonging to the same paragraph in order of appearance to obtain a paragraph node; Counting the number of consecutive repetitions of each sentence node and paragraph node respectively; storing the paragraph node and the number of consecutive repetitions of the paragraph node in the second-level nodes of the grammar analysis tree; According to the paragraph to which each sentence node belongs in the configuration file, each sentence node is connected to the paragraph node corresponding to the sentence node, and stored together with the number of consecutive repetitions of the sentence node as a third-level node of the grammatical analysis tree; According to the sentences to which the target words belong in the configuration file, each word node is connected to the sentence node corresponding to the word node as a fourth-level node of the grammatical analysis tree; According to the syntax analysis tree corresponding to each of the configuration files, anomaly detection is performed on each of the configuration files to obtain a configuration anomaly detection result.

2. The method according to claim 1, characterized in that The word attributes of the target word include: the number of consecutive repetitions of the target word in the configuration file and the word type; The step of determining the word attributes of each target word includes: Counting the number of consecutive repetitions and the frequency of occurrence of each target word in the configuration file; The word type corresponding to each target word in the configuration file is determined according to the occurrence frequency.

3. The method according to claim 2, characterized in that The occurrence frequency includes word frequency and document frequency; The step of determining the word type corresponding to each target word in the configuration file according to the occurrence frequency includes: If a first word in the target words meets a preset condition, determining that the word type of the first word is a keyword type; the preset condition includes that the word frequency of the word is greater than a first threshold and the document frequency is greater than a second threshold; If the second word in the target words does not meet the preset condition, it is determined that the word type of the second word is a common type.

4. The method according to claim 1, wherein The configuration anomaly detection result includes: an abnormal configuration file in which an anomaly occurs in the configuration file, an abnormal position in the abnormal configuration file, and an abnormality type corresponding to the abnormal position; The step of performing anomaly detection on each configuration file according to the syntax analysis tree corresponding to each configuration file to obtain a configuration anomaly detection result includes: Determining the abnormal configuration files in each of the configuration files by clustering the syntax analysis trees corresponding to each of the configuration files; Comparing the configuration file template with the abnormal configuration file to determine the abnormal position of the abnormal configuration file; the configuration file template and the abnormal configuration file belong to the same type; The file content at the abnormal position of the abnormal configuration file is matched with a preset abnormal type to obtain the abnormal type corresponding to the file content at the abnormal position.

5. The method according to claim 4, characterized in that After extracting words from each of the configuration files to obtain words in each of the configuration files, and before performing anomaly detection on each of the configuration files based on the grammatical analysis trees corresponding to each of the configuration files to obtain a configuration anomaly detection result, the method further includes: Randomly selecting two or more adjacent corpus samples from the configuration file; wherein the corpus samples include at least one of paragraphs, sentences, and words; Counting the co-occurrence frequencies of adjacent corpus combinations in the configuration file; the adjacent corpus combinations are composed of adjacent corpus samples of the same type; Calculating the similarity between the same corpus samples in the configuration file; Determining candidate anomaly types of the configuration file based on the co-occurrence frequency of the adjacent corpus combinations and the similarity between the corpus samples of the same type; issuing a prompt message according to the candidate exception type, and obtaining user feedback information regarding the prompt message; The target candidate abnormality type determined in the feedback information is used as the preset abnormality type of the configuration file.

6. The method according to claim 4 or 5, characterized in that The determining the abnormal configuration file in each of the configuration files by clustering the syntax analysis trees corresponding to the configuration files includes: Clustering the parse trees using a K-means clustering algorithm to obtain clustering results; Abnormal data points in the clustering result are obtained; wherein the abnormal configuration file includes a configuration file corresponding to the abnormal data point.

7. The method according to claim 6, characterized in that The K-means clustering algorithm is used to cluster the grammar analysis trees to obtain clustering results, including: Determining the number of paragraph types, sentence types, and word types included in each of the configuration files based on the grammatical analysis tree; generating an array corresponding to each of the grammatical analysis trees based on the number of paragraph types, the number of sentence types, and the number of word types in each of the configuration files; The K-means clustering algorithm is used to cluster the arrays corresponding to the grammar analysis trees to obtain the clustering result.

8. The method according to claim 6, characterized in that The process of determining the K value in the K-means clustering algorithm includes: The number of types of each of the configuration files is obtained as the K value.

9. A configuration anomaly detection device, characterized in that: include: An acquisition module is configured to acquire a configuration file to be detected; An extraction module is configured to perform word extraction on each of the configuration files to obtain words in each of the configuration files; and to filter out words that do not belong to a preset format from each of the words to obtain a target word; The attribute determination module is configured to determine the attribute of each of the words, including: determining the attribute of each of the target words; The construction module is configured to execute a syntax analysis tree corresponding to each of the configuration files based on preset rules, each of the target words and the word attributes of each of the target words, including: for any of the configuration files: storing the file identifier of the configuration file in the first-level node of the syntax analysis tree; creating a word node according to the target word, and storing the word content and the target word attributes of the target word in the word node; according to the order of appearance of each of the target words in the configuration file, concatenating the word nodes belonging to the same sentence to obtain a sentence node; concatenating the sentence nodes belonging to the same paragraph in the order of appearance to obtain a sentence node. paragraph nodes; respectively counting the number of consecutive repetitions of each of the sentence nodes and the paragraph nodes; storing the paragraph nodes and the number of consecutive repetitions of the paragraph nodes in the second-level nodes of the grammatical analysis tree; connecting each of the sentence nodes to the paragraph nodes corresponding to the sentence nodes according to the paragraphs to which each of the sentence nodes belongs in the configuration file, and storing them together with the number of consecutive repetitions of the sentence nodes as third-level nodes of the grammatical analysis tree; connecting each of the word nodes to the sentence nodes corresponding to the word nodes according to the sentences to which each of the target words belongs in the configuration file, as fourth-level nodes of the grammatical analysis tree; The detection module is configured to execute a syntax analysis tree corresponding to each of the configuration files, perform anomaly detection on each of the configuration files, and obtain a configuration anomaly detection result.

10. A computer device, characterized in that: include: A processor and a memory for storing instructions executable by the processor; wherein the processor is configured to execute instructions to implement the configuration anomaly detection method according to any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that When the instructions in the computer-readable storage medium are executed by a processor of a computer device, the computer device is enabled to execute the configuration anomaly detection method according to any one of claims 1 to 8.

Images