Method and apparatus for detecting abnormal values ​​in kernel configuration items

Abstract

This invention discloses a method and apparatus for detecting outliers in kernel configuration items. The method includes: constructing a kernel default configuration dataset; traversing the names and values ​​of all kernel configuration items in the kernel configuration file to be detected, and supplementing the kernel default configuration dataset with configuration item values ​​that do not appear in the kernel configuration file to be detected, to construct a configuration dataset V to be detected; comparing the configuration dataset V to be detected with the configuration items in the kernel default configuration dataset to obtain the anomaly detection result of the kernel configuration file to be detected. This invention establishes an anomaly detection dataset based on the kernel default configurations of the kernel community and mainstream distributions, which can detect outliers that satisfy configuration item dependencies but are improperly configured, reducing the possibility of configuration errors or omissions and improving the success rate of kernel configuration.

Description

Technical Field

[0001] This invention belongs to the field of computer software technology; it relates to the scenario of checking Linux kernel configuration files, and proposes a method and device for detecting abnormal values ​​of kernel configuration items. Background Technology

[0002] The Linux kernel is one of the most well-known large, complex, and highly configurable open-source systems. The kernel community has a massive and rapidly growing number of contributors, with the kernel source code and its subsystems exhibiting superlinear growth, exceeding 28 million lines of code and containing nearly 18,000 configuration options. Linux kernel configuration involves kernel setup, including CPU architecture, block devices, encryption, device drivers, file systems, memory management, networking, security, virtualization, and many other aspects. Few developers possess a comprehensive understanding of all these issues and features. In addition to the kernel's vast configuration space, complex dependencies exist between configuration items, making manual kernel configuration prone to errors. Abnormal kernel configuration can easily lead to system malfunctions, impact software performance, and other unpredictable problems.

[0003] Existing kernel configuration item detection technologies mainly address two types of problems. One type is configuration-implementation consistency defects, which are caused by code implementation defects due to the large-scale variability of kernel configurations. By checking for mismatches between the kernel configuration model and the configuration items implemented in the code, the aim is to improve the quality of Linux source code. The other type is configuration item conflicts. Many tools detect configuration items that violate the constraints of the Kconfig file by parsing the dependencies of kernel configuration items and find the erroneous values ​​that cause conflicts.

[0004] However, in practical kernel configurations, there are still outliers where configuration item dependencies are satisfied but the values ​​are not appropriate. For example, some configuration items used for debugging or special application scenarios are generally disabled in the official release version. If they are accidentally enabled, although there is no violation of constraints in terms of logical relationships, unnecessary functions are compiled into the kernel, which not only increases the kernel size but may also consume more memory and CPU, leading to a decrease in system performance. Furthermore, some basic functions, common devices, or security-related configuration items, if accidentally disabled, may affect the normal use of the system or introduce unexpected security risks. The aforementioned kernel configuration item detection techniques cannot detect these inappropriate settings. Therefore, a kernel configuration item outlier detection method is needed to solve these problems of inappropriate configuration. Summary of the Invention

[0005] To address the issues of a large number of kernel configuration items and inappropriate configurations, this invention aims to provide a method and apparatus for detecting outliers in kernel configuration items. This method can detect outliers in target kernel configuration files based on a dataset of default configurations from mainstream distributions, providing technicians with a secondary check and confirmation for setting kernel configuration items, thereby improving the accuracy of kernel configuration.

[0006] The technical content of this invention includes:

[0007] A method for detecting outliers in kernel configuration items, the method comprising:

[0008] Collect the kernel source code and the corresponding default kernel configuration files to obtain kernel configuration data;

[0009] Based on CPU architecture and application scenarios, the kernel configuration data is categorized, and then sorted according to kernel version development.

[0010] The changes in the values ​​of each configuration item in the kernel configuration data in historical versions are statistically analyzed, and outliers that jump in intermediate versions and outliers that jump in the latest version are repaired to generate a kernel default configuration dataset.

[0011] Iterate through the names and values ​​of all kernel configuration items in the kernel configuration file to be detected, and supplement the values ​​of configuration items that do not appear in the kernel configuration file to be detected by combining the kernel default configuration dataset to construct the configuration dataset V to be detected;

[0012] The configuration dataset V to be detected is compared with the configuration items in the kernel default configuration dataset to obtain the anomaly detection result of the kernel configuration file to be detected.

[0013] Furthermore, the collection of kernel source code and corresponding default kernel configuration files to obtain kernel configuration data includes:

[0014] Based on the CPU architecture and application scenario, we collected the kernel source code and corresponding default kernel configuration files from the Linux kernel community and mainstream distributions.

[0015] Extract configuration item names from the kernel source code and construct a complete set of configuration items;

[0016] Based on the kernel default configuration file, obtain the values ​​of some configuration item names in the full set of configuration items;

[0017] For configuration items that have no values ​​in the complete set of configuration items, the configuration item is set to "off" to obtain kernel configuration data.

[0018] Furthermore, based on CPU architecture and application scenarios, the kernel configuration data is categorized as follows:

[0019] Based on the commented lines in the kernel configuration file, the CPU architecture corresponding to the kernel configuration data is obtained;

[0020] Based on the kernel config file name in the kernel configuration file, the application scenario corresponding to the kernel configuration data is obtained;

[0021] Kernel configuration data that cannot identify the CPU architecture or application scenario is manually renamed.

[0022] Furthermore, the repair of outliers in the intermediate version includes:

[0023] Compare the configuration item values ​​of intermediate versions with those of earlier and later versions;

[0024] If the configuration item values ​​in the intermediate version are the same as those in the preceding and following versions, it is determined that the intermediate version has not changed.

[0025] When the configuration item values ​​of the intermediate version and the versions before and after are different, calculate the number of versions of the intermediate version and the versions before and after for the new values ​​of the configuration items in the intermediate version;

[0026] If the number of versions in the intermediate version is greater than the number of versions in the preceding and following versions, or if the ratio of the number of versions in the intermediate version to the sum of the number of versions in the preceding and following versions is not less than a first threshold, it is determined that the intermediate version has not changed.

[0027] If the number of versions in the intermediate version is less than the number of versions in any of the preceding and following versions, and the ratio of the number of versions in the intermediate version to the sum of the number of versions in the preceding and following versions is less than a first threshold, then the value of the configuration item in the intermediate version is compared with the final value of the configuration and the historical value of the configuration in other releases.

[0028] If the value of an intermediate version configuration item is the same as the final configuration value, or if the value of an intermediate version configuration item is the same as the historical configuration value of other distributions, it is determined that the intermediate version has not changed.

[0029] If the value of the intermediate version configuration item is different from the final configuration value, and the value of the intermediate version configuration item is different from the historical configuration value of other distributions, then an intermediate version jump is determined.

[0030] Check for outliers in the configuration items in the intermediate version and correct them.

[0031] Furthermore, the repair of outliers in the latest version includes:

[0032] Compare the configuration item values ​​in the latest and historical versions;

[0033] If the configuration item values ​​are the same in the latest version and in previous versions, it is determined that the latest version has not changed.

[0034] Calculate the number of versions in the latest and historical versions when the configuration item values ​​are different in the latest and historical versions.

[0035] If the number of versions in the latest version is greater than the number of versions in a previous version, or if the ratio of the number of versions in the latest version to the number of versions in previous versions is not less than a second threshold, then the latest version is determined not to have changed.

[0036] If the number of versions in the latest version is less than the number of versions in any of the previous and subsequent versions, and the ratio of the number of versions in the latest version to the number of versions in previous versions is less than a second threshold, the value of the configuration item in the latest version is compared with the latest value of the configuration item in the same version range of other release versions.

[0037] If the latest version configuration item has the same value as the latest value of the configuration item in the same version range of other releases, or if the latest version configuration item has the value y / m and the latest value of the configuration item in the same version range of other releases is m / y, or if the latest version configuration item does not exist in the same version range of other releases, then it is determined that the latest version has not changed; where y indicates that the configuration item is enabled, and m indicates that the configuration item is set as a module.

[0038] If the value of the latest version configuration item is different from the latest value of the configuration item in the same version range of other releases, and the value of the latest version configuration item is y and the latest value of the configuration item in the same version range of other releases is n, or the value of the latest version configuration item is n and the latest value of the configuration item in the same version range of other releases is y / m, then it is determined that the latest version jumps; where n indicates that the configuration item is turned off.

[0039] Check for outliers in the configuration items in the latest version and correct them.

[0040] Further, the step of comparing the configuration dataset V to be detected with the configuration items in the kernel default configuration dataset to obtain the anomaly detection result of the kernel configuration file to be detected includes:

[0041] Iterate through the configuration dataset V to be tested, one configuration item V at a time. i Compare the values ​​of configuration items with the same distribution and version number in the kernel default configuration dataset;

[0042] In each configuration item V i If the values ​​of configuration items with the same distribution and version number are the same as those in the kernel default configuration dataset, the kernel configuration file to be tested is considered normal.

[0043] In each configuration item Vi If at least one configuration item has a different value from the same distribution and version number in the kernel default configuration dataset, calculate the probability of configuration item Vi taking a value in the same distribution and subsequent version range in the kernel default configuration dataset.

[0044] If the probability of configuration item Vi taking a value within the same distribution and subsequent version range in the kernel default configuration dataset is greater than a third threshold, the kernel configuration file to be detected is determined to be normal.

[0045] If the probability of configuration item Vi taking a value within the same distribution and subsequent version range in the kernel default configuration dataset is less than a third threshold, calculate the probability of configuration item Vi taking a value within the same distribution and version range in the kernel default configuration dataset.

[0046] If the probability of configuration item Vi taking a value in other distributions or the same version range in the kernel default configuration dataset is greater than a fourth threshold, the kernel configuration file to be detected is determined to be normal.

[0047] If the probability of configuration item Vi taking a value within the range of other distributions and the same version in the kernel default configuration dataset is less than a fourth threshold, the kernel configuration file to be detected is determined to be abnormal.

[0048] Furthermore, the method also includes:

[0049] If the anomaly detection result of the kernel configuration file to be detected indicates that the kernel configuration file to be detected is abnormal, output a list of configuration items that determine the abnormal value.

[0050] Furthermore, the list of configuration items includes: reference values, enable rates, and recommended values ​​from the kernel default configuration dataset.

[0051] A kernel configuration item outlier detection device, characterized in that the device comprises:

[0052] The data acquisition module is used to collect kernel source code and corresponding default kernel configuration files to obtain kernel configuration data;

[0053] The data preparation module is used to classify the kernel configuration data based on CPU architecture and application scenarios, and sort the classified kernel configuration data according to kernel version development.

[0054] The data processing module is used to statistically analyze the changes of each configuration item value in the kernel configuration data in historical versions, and to repair abnormal values ​​that jump in intermediate versions and abnormal values ​​that jump in the latest version, so as to generate a kernel default configuration dataset.

[0055] The data detection module is used to traverse the names and values ​​of all kernel configuration items in the kernel configuration file to be detected, and supplement the configuration item values ​​that do not appear in the kernel configuration file to be detected by combining the kernel default configuration dataset, so as to construct the configuration dataset V to be detected; the configuration dataset V to be detected is compared with the configuration items in the kernel default configuration dataset to obtain the anomaly detection result of the kernel configuration file to be detected.

[0056] A storage medium storing a computer program, wherein the computer program is configured to execute any of the methods described above when run.

[0057] Compared with the prior art, the positive effects of the present invention are as follows:

[0058] (1) This invention is the first to detect outliers from the perspective of default values ​​of kernel configuration items in practical applications. It establishes a dataset based on the default kernel configuration of the kernel community and mainstream distributions, which has a solid and reliable data basis.

[0059] (2) Unlike traditional configuration item conflict detection, this invention can detect abnormal values ​​that satisfy configuration item dependencies but are improperly configured, reducing the possibility of configuration errors or omissions and improving the kernel configuration success rate.

[0060] (3) The detection method of the present invention is not limited to a single system architecture or application scenario, and has a wider range of applications. Attached Figure Description

[0061] Figure 1 Overall architecture of kernel configuration item outlier detection method.

[0062] Figure 2 The kernel default configuration includes a dataset intermediate value jump detection process.

[0063] Figure 3 The kernel default configuration includes a process for detecting jumps in the latest value of the dataset. Detailed Implementation

[0064] The technical solutions of the present invention will be clearly and completely described below with reference to the embodiments of the present invention. Obviously, the described embodiments are only specific embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0065] Typically, if the default value of a configuration item is always Value a It was suddenly changed to Value b It was then restored to Value in a later version. aAnd only a small portion of the versions are Value b Then Value b This refers to the outlier value of the configuration item. Based on the above scenario, the kernel configuration item outlier detection method of this invention comprehensively considers the changes in the configuration item value over version development time and horizontal comparisons between multiple distributions to determine outliers. Its technical solution is as follows: Figure 1 As shown, it includes:

[0066] ① During the data collection phase, default kernel configuration files from the Linux kernel community and several mainstream distributions were collected through three methods: first, multiple versions of default configuration files were generated from the kernel community source code using `make config`; second, the default configuration files were obtained from the kernel installation packages provided by the distribution's package repositories through package managers; and third, default kernel configuration files were obtained from some distribution's Git or GitHub repositories. These three methods yielded the initial dataset of default kernel configuration files.

[0067] ② In the data preparation phase, it is first considered that the default kernel configuration file only contains all configuration items with values ​​of 'y', 'm', character, and numeric types, as well as some configuration items with values ​​of 'n'. Some child items that are not directly set to 'n' but are disabled due to their parent item being 'n' are not recorded in the .config file. Therefore, to obtain complete kernel configuration data, it is necessary to extract the complete set of configuration items from the kernel source code, record the values ​​of configuration items that do not appear in the .config file as 'n', and merge them with the values ​​of existing configuration items to obtain complete kernel configuration data. Secondly, the kernel configuration differs under different CPU architectures and application scenarios. When organizing the dataset, it is necessary to classify it according to the following criteria: First, the distinction of system architecture. In the first few lines of the kernel configuration file, there is usually "#Linux / arch xx.xx.xxKernel". The configuration is categorized into two types of kernel configurations: First, by the comment line formatted as "Configuration," where the content after "Linux / " indicates the applicable system architecture. Second, by the application scenario, kernel configuration files can be categorized by filename. General versions typically have "generic," "default," or no special identifier; server versions typically have "server"; real-time versions typically have "rt"; low-latency versions typically have "lowlatency" or "preempt"; and cloud versions typically have "cloud." If the original filename does not conform to these rules, it can be manually renamed when added to the dataset. Finally, the configuration is sorted by version development sequence number and keywords, setting the version order, for example, 1.0rc1 < 1.0 < 1.0-1 < 1.0.1 < 1.1, to prepare for discovering historical version time jumps in the next stage.

[0068] ③ During the data processing phase, firstly, the changes in the values ​​of each configuration item in historical versions are statistically analyzed, recording the number of versions with the same value, the number of versions with a value jump, and the range of versions with changes; secondly, configuration items with changes are filtered out to check for jumps, which can be divided into two types based on the time point of the jump version:

[0069] First, if the value of a configuration item changes abruptly in historical versions, such as a configuration item that was always open becoming closed and then reopening in some versions, or a configuration item that was always closed suddenly becoming open and then reopening in some versions, it can be determined that the configuration item values ​​in those versions are abnormal. The specific calculation formula for determining whether the configuration item value has changed abruptly is as follows.

[0070]

[0071] Where V represents the values ​​of all configuration items for a single kernel version, U represents the values ​​of the configuration item being enabled, set as a module, or disabled, and T represents the kernel version (total number z). i The value of configuration item i, u j Let i represent the j-th value of the set U, and let function f1 indicate whether the configuration item is enabled, disabled, or set as a module. Let i represent the configuration item, t represent the version number, and v represent the configuration item. i,t This indicates the default value of configuration item i in version t, v i,t-x The default value of configuration item i in versions x prior to version t, v i,t+x The default value for configuration item i in versions x after version t, s t This indicates the number of versions with the same configuration item value. The functions f2, f3, and f4 represent three conditions for exception detection. If the exception condition is met, the value is 1; otherwise, it is considered normal and the value is 0. Figure 2 The process of determining whether an intermediate value jump is abnormal is demonstrated: 1) Function f2 checks whether the values ​​of configuration items in the preceding and following versions are consistent, and examines the changes in configuration item values ​​in intermediate versions; 2) Function f3 compares the proportion of intermediate values ​​of configuration items that have changed to the number of versions with the preceding and following values. If the number of intermediate versions is s... t Compare the number of versions before and after the value s t-x s t+x If the values ​​are all low and less than a certain threshold r, it indicates that the median value of the configuration item is an occasional, small-scale jump in value, and proceed to the next step of judgment; 3) Function f4 compares the median value with the final value v of the configuration. i,z Other distribution configuration historical values ​​w i In the comparison, W represents the set of configuration item values ​​from other distributions. If the values ​​are consistent within the same version range, it is considered normal; otherwise, the intermediate value is considered abnormal.

[0072] Second, there's the issue of sudden value changes. For example, a configuration that was always disabled might suddenly be enabled in the latest versions, while remaining disabled in the same version of other distributions, resulting in an abnormal value for this configuration item in the latest version. In this process, it's necessary to consider the configuration item values ​​in different historical kernel versions of the same distribution under the same system architecture and application scenario, as well as the configuration item values ​​in different distributions of the same kernel version, as the basis for judgment. The specific formula for determining whether a configuration item value has changed due to a sudden value change is shown below.

[0073]

[0074] Among them, function f5 compares whether the configuration item values ​​of the latest version and the historical version are equal, function f6 compares the number of the latest value version with the number of the historical value version, and function f7 compares the latest value with the values ​​of other releases. These three functions represent the conditions for judging the abnormal jump of the latest value. If the abnormal conditions are met, the value is 1; otherwise, it is judged as normal and the value is 0. Figure 3 The method for determining whether a change in the latest value is abnormal is demonstrated as follows: 1) Function f5 checks whether the value of the configuration item in the new version is consistent with that of the historical version to obtain the status of the latest value change of the configuration item; 2) Function f6 compares the proportion of the number of versions of the configuration item that have changed to the number of historical versions. If the proportion is less than a certain threshold, it means that the new value of the configuration item is an occasional small-scale change, and proceeds to the next step of judgment; 3) Function f7 compares the value with the value of the same version range in other distributions. If it is the same as the value of the distribution, the latest value is judged to be normal; if the new value is y / m and the value of other distributions is m / y, it is also judged to be normal; if the new value is y and the value of other distributions is n, or the new value is n and the value of other distributions is y / m, the latest value is judged to be abnormal; if the distribution does not have the configuration item, it is judged to be normal.

[0075] In the above determination method, the variable measuring the size of the versions before and after the change in configuration item value—the proportion threshold 'r'—identifies the proportion of versions with different configuration item values. A value less than this threshold is considered a jump. In this paper, the rule for assigning the proportion threshold is as follows: when the sum of the number of changed configuration item versions and the number of versions before and after is less than 100, the proportion threshold 'r' is set to 0.1; when the sum of the number of versions exceeds 100, the proportion threshold 'r' is set to 0.01.

[0076] Then, using the method described above, all collected kernel default configuration files are traversed to find abnormal configuration items that match the two types of intermediate value jumps and latest value jumps. If a configuration item has a reasonable or special reason in the search results, it is manually marked as normal. All abnormal values ​​of the identified configuration items are then corrected to normal values, and the dataset is updated as a data source for anomaly detection to eliminate the impact of abnormal fluctuations.

[0077] As mentioned above, the specific steps for constructing the kernel default configuration dataset are as follows:

[0078] (1) Collect the default kernel configuration files from the Linux kernel community and mainstream distributions to form an initial dataset;

[0079] (2) Extract the complete set of kernel configuration items, supplement the configuration items that are not shown in the configuration file and are turned off, and obtain the complete kernel configuration dataset;

[0080] (3) Classify kernel configuration data according to CPU architecture and application scenarios;

[0081] (4) Sort the kernel configuration data according to the kernel version development sequence number and keyword;

[0082] (5) Statistically analyze the changes in configuration item values ​​as the version evolves, and find the fixed abnormal values ​​that jumped in the middle version and the unfixed abnormal values ​​that jumped in the latest version;

[0083] (6) Manually mark the configuration items with reasonable or special reasons for the outliers found in step (5) as normal, and automatically correct other outliers and update the dataset.

[0084] In one example, suppose there is a kernel configuration file f to be inspected, and a kernel default configuration dataset S with f on the same CPU architecture and in the same application scenario. The dataset S contains all the outliers found in multiple historical versions of mainstream distributions that have been fixed.

[0085] The implementation steps for the kernel configuration file f to be detected are as follows:

[0086] (1) Traverse the names and values ​​of all kernel configuration items in the kernel configuration file f, and combine the dataset S to supplement the configuration item values ​​'n' that do not appear in f, and construct a complete configuration dataset V to be detected;

[0087] (2) Traverse the configuration dataset V to be tested, and check each configuration item V. i Compare the configuration item values ​​with the same release and version number in dataset S. If they are the same, the process is considered normal; otherwise, proceed to the next step.

[0088] (3) Calculate the probability of configuration item Vi in the same release version and subsequent version range in dataset S. If the value of Vi is consistent with the range of values ​​with a higher probability, it is considered normal; otherwise, continue to the next step.

[0089] (4) Calculate the probability of configuration item Vi in other releases and the same version range in dataset S. If the value of Vi is consistent with the range of values ​​with a higher probability, it is judged as normal; otherwise, it is judged as abnormal.

[0090] (5) Obtain the anomaly detection results of the final kernel configuration file f, and output the list of configuration items for determining anomalies, including reference values, enable rates, suggested values, etc. in the dataset S.

[0091] Specifically, based on the distribution and kernel version of the configuration to be detected, the probability of the configuration item's value is calculated. The probability of the value in different kernel versions within the same distribution and in different distributions within the same kernel version is combined to determine whether the configuration item is an outlier. The specific calculation formula is shown below.

[0092]

[0093] Among them, P i,t (u k The ) represents the proportion of versions in which configuration item i takes the values ​​'y', 'm', and 'n' in subsequent versions of t, respectively. i,j The value of configuration item i in version j of the modified dataset, d i,tThe configuration item value to be detected is identified. The function f8 determines that when the proportion of versions is less than r, it is a low-probability event and is judged as an outlier. The values ​​with a higher proportion of versions are used as suggested values.

[0094] In summary, this invention, for the first time, focuses on outlier detection from the perspective of default kernel configuration items in practical applications. It establishes a dataset based on the default kernel configurations of the kernel community and mainstream distributions, providing a solid and reliable data foundation. Unlike traditional configuration item conflict detection, this invention can detect outliers that satisfy configuration item dependencies but are improperly configured, reducing the possibility of configuration errors or omissions and improving the success rate of kernel configuration.

[0095] In an exemplary embodiment, the present invention also discloses a kernel configuration item outlier detection device, the device comprising:

[0096] The data acquisition module is used to collect kernel source code and corresponding default kernel configuration files to obtain kernel configuration data;

[0097] The data preparation module is used to classify the kernel configuration data based on CPU architecture and application scenarios, and sort the classified kernel configuration data according to kernel version development.

[0098] The data processing module is used to statistically analyze the changes of each configuration item value in the kernel configuration data in historical versions, and to repair abnormal values ​​that jump in intermediate versions and abnormal values ​​that jump in the latest version, so as to generate a kernel default configuration dataset.

[0099] The data detection module is used to traverse the names and values ​​of all kernel configuration items in the kernel configuration file to be detected, and supplement the configuration item values ​​that do not appear in the kernel configuration file to be detected by combining the kernel default configuration dataset, so as to construct the configuration dataset V to be detected; the configuration dataset V to be detected is compared with the configuration items in the kernel default configuration dataset to obtain the anomaly detection result of the kernel configuration file to be detected.

[0100] For details regarding the specific execution process and beneficial effects of the device module, please refer to the description of the above method embodiments; further details will not be provided here.

[0101] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for detecting an abnormal value of a kernel configuration item, characterized in that, The method comprises: collecting kernel source code and corresponding kernel default configuration files to obtain kernel configuration data; classifying the kernel configuration data based on CPU architecture and application scenarios, and sorting the classified kernel configuration data according to kernel version development; statistically analyzing the change of each configuration item value in the kernel configuration data in the historical version, repairing the abnormal values jumping in the intermediate version and the abnormal values jumping in the latest version, to generate a kernel default configuration data set; traversing the name and value of each kernel configuration item in the kernel configuration file to be detected, and supplementing the configuration item value not appearing in the kernel configuration file to be detected by combining the kernel default configuration data set, to construct a configuration data set V to be detected; comparing the configuration item in the configuration data set V to be detected with the kernel default configuration data set, to obtain the abnormal detection result of the kernel configuration file to be detected; wherein the comparison of the configuration data set V to be detected with the configuration item in the kernel default configuration data set to obtain the abnormal detection result of the kernel configuration file to be detected comprises: Traverse the to-be-detected configuration dataset V, configuration item V by configuration item i Compare the values of the configuration items in the same distribution and version number in the kernel default configuration dataset; In each configuration item V i If the value of the configuration item of the same distribution and version number in the kernel default configuration data set is the same as that of the kernel configuration file to be detected, it is determined that the kernel configuration file to be detected is normal. In each configuration item V i If the value of at least one configuration item of the same distribution and version number in the kernel default configuration data set is different, the probability of the value of the configuration item V in the kernel default configuration data set of the same distribution and the subsequent version range is calculated. in the case that the value probability of the configuration item Vi in the same release and subsequent version range in the kernel default configuration data set is greater than a third threshold value, it is determined that the kernel configuration file to be detected is normal; in the case that the value probability of the configuration item Vi in the same release and subsequent version range in the kernel default configuration data set is less than a third threshold value, the value probability of the configuration item Vi in the same release and other version range in the kernel default configuration data set is calculated; in the case that the value probability of the configuration item Vi in the same release and other version range in the kernel default configuration data set is greater than a fourth threshold value, it is determined that the kernel configuration file to be detected is normal; in the case that the value probability of the configuration item Vi in the same release and other version range in the kernel default configuration data set is less than a fourth threshold value, it is determined that the kernel configuration file to be detected is abnormal.

2. The method of claim 1, wherein, The collection of kernel source code and corresponding kernel default configuration files to obtain kernel configuration data comprises: collecting kernel source code and corresponding kernel default configuration files of the Linux kernel community and mainstream distributions based on the CPU architecture and the application scenario; extracting configuration item names from the kernel source code to construct a configuration item universe; obtaining the values of part of the configuration item names in the configuration item universe based on the kernel default configuration files; assigning the configuration item to be closed for the configuration item without value in the configuration item universe, to obtain kernel configuration data.

3. The method of claim 1, wherein, The classification of the kernel configuration data based on CPU architecture and application scenario comprises: obtaining the CPU architecture corresponding to the kernel configuration data based on the comment line in the kernel configuration file; obtaining the application scenario corresponding to the kernel configuration data based on the kernel config file name in the kernel configuration file; renaming the kernel configuration data which cannot be identified as CPU architecture or application scenario manually.

4. The method of claim 1, wherein, The repair of the abnormal values jumping in the intermediate version comprises: comparing the configuration item values of the intermediate version and the previous and subsequent versions; In the case that the configuration item value of the intermediate version is the same as that of the previous and next versions, it is determined that the intermediate version does not jump; In the case that the configuration item value of the intermediate version is not the same as that of the previous and next versions, the version number of the intermediate version and the previous and next versions is calculated according to the new value of the configuration item in the intermediate version; In the case that the version number of the intermediate version is greater than the version number of one of the previous and next versions, or the ratio of the version number of the intermediate version to the sum of the version numbers of the previous and next versions is not less than a first threshold value, it is determined that the intermediate version does not jump; In the case that the version number of the intermediate version is less than the version number of any one of the previous and next versions, and the ratio of the version number of the intermediate version to the sum of the version numbers of the previous and next versions is less than a first threshold value, the value of the configuration item of the intermediate version is compared with the final value of the configuration and the historical value of the configuration of the other release; In the case that the value of the configuration item of the intermediate version is the same as the final value of the configuration, or the value of the configuration item of the intermediate version is the same as the historical value of the configuration of the other release, it is determined that the intermediate version does not jump; In the case that the value of the configuration item of the intermediate version is not the same as the final value of the configuration, and the value of the configuration item of the intermediate version is not the same as the historical value of the configuration of the other release, it is determined that the intermediate version jumps; The abnormal value of the configuration item in the intermediate version is checked and corrected.

5. The method of claim 1, wherein, The repairing of the abnormal value of the jump in the latest version includes: Comparing the configuration item value in the latest version with that in the historical version; In the case that the configuration item value in the latest version is the same as that in the historical version, it is determined that the latest version does not jump; In the case that the configuration item value in the latest version is not the same as that in the historical version, the version number of the latest version and the historical version is calculated; In the case that the version number of the latest version is greater than the version number of one of the historical versions, or the ratio of the version number of the latest version to the version number of the historical versions is not less than a second threshold value, it is determined that the latest version does not jump; In the case that the version number of the latest version is less than the version number of any one of the historical versions, and the ratio of the version number of the latest version to the version number of the historical versions is less than a second threshold value, the value of the configuration item of the latest version is compared with the latest value of the configuration item in the same version range of the other release version; In the case that the value of the configuration item of the latest version is the same as the latest value of the configuration item in the same version range of the other release version, or the value of the configuration item of the latest version is y / m and the latest value of the configuration item in the same version range of the other release version is m / y, or the configuration item of the latest version does not exist in the configuration item of the other release version, it is determined that the latest version does not jump; wherein y represents that the configuration item is opened, and m represents that the configuration item is set as a module; In the case that the value of the configuration item of the latest version is not the same as the latest value of the configuration item in the same version range of the other release version, if the value of the configuration item of the latest version is y and the latest value of the configuration item in the same version range of the other release version is n, or the value of the configuration item of the latest version is n and the latest value of the configuration item in the same version range of the other release version is y / m, it is determined that the latest version jumps; wherein n represents that the configuration item is closed; The abnormal value of the configuration item in the latest version is checked and corrected.

6. The method according to any one of claims 1 to 5, wherein, The method further includes: In a case where the abnormality detection result of the to-be-detected kernel configuration file is abnormal, a configuration item list of a determination abnormal value is output.

7. The method of claim 6, wherein, The configuration item list includes a reference value, an enabling rate and a suggestion value in the kernel default configuration dataset.

8. A kernel configuration item outlier detection apparatus, characterized by, The apparatus comprises: a data acquisition module configured to collect kernel source code and a corresponding kernel default configuration file to obtain kernel configuration data; a data preparation module configured to classify the kernel configuration data based on CPU architecture and application scenarios, and sort the classified kernel configuration data according to kernel version development; a data processing module configured to count changes of values of each configuration item in the kernel configuration data in historical versions, repair abnormal values that jump in intermediate versions and abnormal values that jump in the latest version, and generate a kernel default configuration dataset; a data detection module configured to traverse names and values of all kernel configuration items in a to-be-detected kernel configuration file, supplement values of configuration items that do not appear in the to-be-detected kernel configuration file in combination with the kernel default configuration dataset, to construct a to-be-detected configuration dataset V, compare the to-be-detected configuration dataset V with configuration items in the kernel default configuration dataset, and obtain an abnormality detection result of the to-be-detected kernel configuration file; wherein the comparison of the to-be-detected configuration dataset V with the configuration items in the kernel default configuration dataset to obtain the abnormality detection result of the to-be-detected kernel configuration file comprises: Traverse the to-be-detected configuration dataset V, configuration item V by configuration item i Compare the values of the configuration items in the same distribution and version number in the kernel default configuration dataset; In each configuration item V i If the value of the configuration item of the same distribution and version number in the kernel default configuration data set is the same as that of the kernel configuration file to be detected, it is determined that the kernel configuration file to be detected is normal. In each configuration item V i If the value of at least one configuration item of the same distribution and version number in the kernel default configuration data set is different, the probability of the value of the configuration item V in the kernel default configuration data set of the same distribution and the subsequent version range is calculated. in a case where a value probability of the configuration item Vi in the same release and subsequent version range in the kernel default configuration dataset is greater than a third threshold value, determining that the to-be-detected kernel configuration file is normal; in a case where the value probability of the configuration item Vi in the same release and subsequent version range in the kernel default configuration dataset is less than the third threshold value, calculating a value probability of the configuration item Vi in other releases and the same version range in the kernel default configuration dataset; in a case where the value probability of the configuration item Vi in other releases and the same version range in the kernel default configuration dataset is greater than a fourth threshold value, determining that the to-be-detected kernel configuration file is normal; in a case where the value probability of the configuration item Vi in other releases and the same version range in the kernel default configuration dataset is less than the fourth threshold value, determining that the to-be-detected kernel configuration file is abnormal.

9. A storage medium having stored therein a computer program, wherein, The computer program is configured to execute the method of any one of claims 1-7 when running.

Images