Anomaly detection method and apparatus, electronic device, and storage medium
By compiling and recursively tracing the source code files of the Golang microservice framework, the system detects whether parameter values are out of range, thus resolving the business impact caused by timeout settings and achieving fast and automated anomaly detection.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- BEIJING BAIDU NETCOM SCI & TECH CO LTD
- Filing Date
- 2022-11-22
- Publication Date
- 2026-07-24
AI Technical Summary
In Golang, the timeout settings of microservice frameworks may cause the timeout value to increase after the business goes live, affecting business expectations. Existing troubleshooting methods cannot quickly and effectively detect parameter anomalies.
By compiling the source code file, the function to be tested and the range of parameter values in the intermediate code are obtained. The parameter values are determined by recursive tracing, and an exception message is generated to indicate that the value is abnormal.
It enables rapid and automated detection of timeout parameters during compilation, avoiding unexpected impacts on business operations due to excessively long timeouts and improving detection efficiency and accuracy.
Smart Images
Figure CN115729561B_ABST
Abstract
Description
Technical Field
[0001] This disclosure relates to the field of artificial intelligence, specifically to technologies such as intelligent cloud and cloud computing, and in particular to anomaly detection methods, devices, electronic devices, and storage media. Background Technology
[0002] With the rapid development of internet technology, a large number of middleware or network frameworks have emerged. Introducing middleware or network frameworks, such as microservice frameworks, can improve the development efficiency of business programmers. Regarding network interactions within microservice frameworks, upper-layer callers need to set timeouts for network connections when invoking functions. The microservice framework provider has already set the timeout unit internally (such as time.MilliSecond (milliseconds), time.Second (seconds), etc.), so the caller only needs to pass a pure numerical value when setting the timeout, without needing to multiply it by the time unit.
[0003] In Golang (also known as Go, a statically typed, compiled, concurrent programming language with garbage collection), because the underlying type of the time unit is int64, when the upper-level caller sets (or passes in) the timeout, multiplying the set timeout by the time unit will not cause a compilation error. However, this may cause the corresponding timeout value to be larger after the business goes live, thus having an unexpected impact on the business.
[0004] Therefore, it is crucial to pre-detect the values of time-related parameters in the microservice framework's code to identify any abnormal values and avoid unexpected impacts on business operations. Summary of the Invention
[0005] This disclosure provides an anomaly detection method, apparatus, electronic device, and storage medium.
[0006] According to one aspect of this disclosure, an anomaly detection method is provided, comprising:
[0007] Obtain intermediate code obtained by compiling the source code file, wherein the intermediate code includes the function to be tested;
[0008] Obtain the value range of at least one parameter to be detected in the function to be detected;
[0009] For any of the parameters to be detected, the parameter value of the parameter to be detected is determined according to the source of the parameter value of the parameter to be detected in the intermediate code;
[0010] If, among the at least one parameter to be detected, there is a target detection parameter whose value is not within the corresponding value range, an anomaly information is generated and displayed, wherein the anomaly information is used to indicate that there is a value anomaly related to the target detection parameter in the source code file.
[0011] According to another aspect of this disclosure, an anomaly detection device is provided, comprising:
[0012] The first acquisition module is used to acquire intermediate code obtained by compiling the source code file, wherein the intermediate code includes the function to be detected;
[0013] The second acquisition module is used to acquire the value range of at least one parameter to be detected in the function to be detected;
[0014] The determination module is used to determine the parameter value of any of the parameters to be detected based on the source of the parameter value of the parameter to be detected in the intermediate code.
[0015] The processing module is configured to generate and display abnormal information when there is a target detection parameter whose value is not within the corresponding value range among the at least one parameter to be detected, wherein the abnormal information is used to indicate that there is a value abnormality related to the target detection parameter in the source code file.
[0016] According to another aspect of this disclosure, an electronic device is provided, comprising:
[0017] At least one processor; and
[0018] A memory communicatively connected to the at least one processor; wherein,
[0019] The memory stores instructions that can be executed by the at least one processor, which, when executed, enable the at least one processor to perform the anomaly detection method proposed in one aspect of this disclosure.
[0020] According to another aspect of this disclosure, a non-transitory computer-readable storage medium is provided for computer instructions used to cause the computer to perform the anomaly detection method proposed in the foregoing aspect of this disclosure.
[0021] According to another aspect of this disclosure, a computer program product is provided, including a computer program that, when executed by a processor, implements the anomaly detection method proposed in the above aspect of this disclosure.
[0022] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this disclosure, nor is it intended to limit the scope of this disclosure. Other features of this disclosure will become readily apparent from the following description. Attached Figure Description
[0023] The accompanying drawings are provided to better understand this solution and do not constitute a limitation of this disclosure. Wherein:
[0024] Figure 1 This is a flowchart illustrating the anomaly detection method provided in Embodiment 1 of this disclosure;
[0025] Figure 2 This is a schematic diagram illustrating the source of the parameter values provided in the embodiments of this disclosure. Figure 1 ;
[0026] Figure 3 This is a flowchart illustrating the anomaly detection method provided in Embodiment 2 of this disclosure;
[0027] Figure 4 This is a flowchart illustrating the anomaly detection method provided in Embodiment 3 of this disclosure;
[0028] Figure 5 This is a flowchart illustrating the anomaly detection method provided in Embodiment 4 of this disclosure;
[0029] Figure 6 This is a schematic diagram illustrating the source of the parameter values provided in the embodiments of this disclosure. Figure 2 ;
[0030] Figure 7 This is a schematic diagram illustrating the source of the parameter values provided in the embodiments of this disclosure. Figure 3 ;
[0031] Figure 8 This is a flowchart illustrating the anomaly detection method provided in Embodiment 5 of this disclosure;
[0032] Figure 9 This is a schematic diagram illustrating the compilation process of the source code files provided in the embodiments of this disclosure;
[0033] Figure 10 This is a schematic diagram of the anomaly detection device provided in Embodiment Six of this disclosure;
[0034] Figure 11 A schematic block diagram of an example electronic device that can be used to implement embodiments of the present disclosure is shown. Detailed Implementation
[0035] The exemplary embodiments of this disclosure are described below with reference to the accompanying drawings, including various details of the embodiments to aid understanding, and should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of this disclosure. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.
[0036] In terms of network interaction within a microservice framework, when calling a function, the upper-layer caller needs to set a timeout for the network connection. The microservice framework provider has already set the timeout unit internally, so when setting the timeout, the caller only needs to pass in a pure numerical value and does not need to multiply it by the time unit.
[0037] In Golang, since the underlying type of the time unit is int64, when the upper-level caller passes in a timeout, multiplying the timeout by the time unit will not cause a compilation error. However, this may cause the corresponding timeout value to be larger after the business goes live, thus having an unexpected impact on the business.
[0038] For example, suppose the parameter value is equal to the timeout period multiplied by the time unit. If the timeout period passed by the upper-level caller is multiplied by the time unit, the parameter value may be too large, exceeding the upper limit of the range of values corresponding to the parameter.
[0039] For example, suppose the value of a certain parameter is equal to the timeout period multiplied by `time.MilliSecond`, and the timeout period passed by the caller is 100. Since `MilliSecond` = 1000 * `MicroSecond` (microseconds), `MicroSecond` = 1000 * `NanoSecond` (nanoseconds), and `NanoSecond` = 1, then the value of this parameter is 100 * 10^2 ... 6 =10 8 .
[0040] For example, suppose the value of a certain parameter is equal to the timeout period multiplied by time.Second, and the timeout period passed by the caller is 10. Since Second = 1000 * MicroSecond, MilliSecond = 1000 * MicroSecond, MicroSecond = 1000 * NanoSecond, and NanoSecond = 1, then the value of this parameter is 10 * 10. 9 =10 10 .
[0041] In related technologies, abnormal parameters are determined by checking the logs of the microservice framework or other information during runtime (such as the number of connections).
[0042] However, the above screening methods have the following problems:
[0043] First, it has already had an unexpected impact on actual business operations. Setting a request timeout through parameters, and then having the business call the function with a time unit, may result in an excessively long connection timeout. This prevents the connection from being released in time, and the corresponding operating system resources (sockets) from being released in a timely manner, causing subsequent new connections to fail.
[0044] Secondly, the problem needs to be investigated manually, which makes it difficult to quickly, effectively, and automatically detect the problem.
[0045] In view of at least one of the above-mentioned problems, this disclosure proposes an anomaly detection method, apparatus, electronic device and storage medium.
[0046] Anomaly detection methods, apparatus, electronic devices, and storage media according to embodiments of the present disclosure are described below with reference to the accompanying drawings.
[0047] Figure 1 This is a flowchart illustrating the anomaly detection method provided in Embodiment 1 of this disclosure.
[0048] This disclosure illustrates an example of an anomaly detection method configured in an anomaly detection device, which can be applied to any electronic device to enable the electronic device to perform anomaly detection functions.
[0049] Among them, electronic devices can be any device with computing capabilities, such as PCs (Personal Computers), mobile terminals, servers, etc. Mobile terminals can be hardware devices with various operating systems, touch screens and / or displays, such as in-vehicle devices, mobile phones, tablets, personal digital assistants, wearable devices, etc.
[0050] like Figure 1 As shown, the anomaly detection method may include the following steps:
[0051] Step 101: Obtain the intermediate code obtained by compiling the source code file, wherein the intermediate code includes the function to be tested.
[0052] The number of functions to be detected can be at least one.
[0053] In this embodiment of the disclosure, the source code file can be the code file corresponding to middleware, network framework, or microservice framework.
[0054] In this embodiment of the disclosure, the source code file can be compiled to obtain intermediate code.
[0055] Step 102: Obtain the value range of at least one parameter to be detected in the function to be detected.
[0056] In this embodiment of the disclosure, each function to be detected may include at least one parameter to be detected. For example, the parameter to be detected may be a time-related parameter.
[0057] In this embodiment of the disclosure, the function to be detected, the parameter to be detected in the function to be detected, and the value range of the parameter to be detected can be determined according to the configuration information or configuration file.
[0058] Step 103: For any parameter to be detected, determine the parameter value of the parameter to be detected based on the source of the parameter value in the intermediate code.
[0059] In this embodiment of the disclosure, for any parameter to be detected in the function to be detected, the parameter to be detected can be recursively traced to determine the source of the parameter value of the parameter to be detected, so that the parameter value of the parameter to be detected can be determined according to the source of the parameter value of the parameter to be detected.
[0060] As an example, using Go as the programming language for the source code file, the intermediate file obtained by compiling the source code file can be SSA (Static Single Assignment form) intermediate code. Assuming the parameter to be detected is in variable form, the code containing the parameter to be detected, param, is shown below:
[0061]
[0062] By recursively tracing the source of the parameter to be detected (param), we can obtain the following: Figure 2 The parameter values shown are from which ssa.Const is a constant type. Since Second = 10 9 Then d = 10 10 , Hour=3600*Second=3.6*10 12 Finally, the value of the parameter to be detected, param, can be calculated to be 3.6 * 10. 22 .
[0063] Step 104: If at least one of the parameters to be detected contains a target detection parameter whose value is not within the corresponding value range, generate and display abnormal information, wherein the abnormal information is used to indicate that there is an abnormal value related to the target detection parameter in the source code file.
[0064] In this embodiment of the disclosure, when at least one of the parameters to be detected contains a target detection parameter whose value is not within the corresponding value range, anomaly information can be generated and displayed. The anomaly information is used to indicate that there is an anomaly in the value of a parameter related to the target detection parameter in the source code file; that is, it indicates that the value of a parameter related to the target detection parameter in the source code file is abnormal.
[0065] As an example, exception information can be used to indicate at least one of the following:
[0066] The location of functions related to the function to be detected in the source code file;
[0067] The location of parameters related to target detection parameters in the source code file;
[0068] The parameter values of the parameters related to target detection in the source code file;
[0069] The parameter values related to target detection parameters in the source code file are abnormal.
[0070] The anomaly detection method of this disclosure compiles a source code file to obtain intermediate code and acquires the value range of at least one parameter to be detected in the function to be detected within the intermediate code. Based on the source of the parameter value in the intermediate code, the parameter value of the parameter to be detected is determined. If at least one parameter to be detected has a value outside its corresponding value range, an anomaly message is generated and displayed. This anomaly message indicates that there is a value anomaly related to the target parameter in the source code file. Therefore, it is possible to detect the values of parameters related to the parameter to be detected in the function to be detected within the source code file according to business requirements, to determine whether the parameter value exceeds the corresponding value range. If so, a prompt message is generated to prompt relevant personnel to modify the source code file. This avoids situations where the timeout time set by the business party is too long due to multiplying the timeout time by the time unit, reduces the occurrence of source code files not meeting expectations, and thus avoids unexpected impacts on business operations.
[0071] It should be noted that the collection, storage, use, processing, transmission, provision and disclosure of user personal information involved in the technical solution disclosed herein are all carried out with the consent of the user, and all comply with the provisions of relevant laws and regulations, and do not violate public order and good morals.
[0072] To clearly illustrate how the parameter value of the parameter to be detected is determined in the above embodiments of this disclosure, this disclosure also proposes an anomaly detection method.
[0073] Figure 3 This is a flowchart illustrating the anomaly detection method provided in Embodiment 2 of this disclosure.
[0074] like Figure 3 As shown, the anomaly detection method may include the following steps:
[0075] Step 301: Obtain the intermediate code obtained by compiling the source code file, wherein the intermediate code includes the function to be tested.
[0076] Step 302: Obtain the value range of at least one parameter to be detected in the function to be detected.
[0077] The explanation of steps 301 to 302 can be found in the relevant description in any embodiment of this disclosure, and will not be repeated here.
[0078] In any embodiment of this disclosure, the value range of the parameter to be detected in the function to be detected can be recorded in the configuration file of the source code file. In this disclosure, a configuration file of the source code file can be obtained by relevant personnel configuring the value range of at least one parameter to be detected based on the source code file, and the configuration file can be parsed to obtain the value range of at least one parameter to be detected.
[0079] Therefore, relevant personnel can configure the range of values for the parameters to be detected in the function to be detected based on the application or business requirements of the actual application scenario, in order to meet the actual application requirements.
[0080] As an example, the configuration file for the source code file may include the following code snippet:
[0081] "package":"icode.XX.com / XX / netdisk / pcs-go-lib / ufc",
[0082] "func":[
[0083] {
[0084] "name":"NewUfcRequest" / / name is the function name, that is, the function to be tested is named "NewUfcRequest".
[0085] "index":7, / / The parameter index is 7, meaning the parameter to be detected is the 8th parameter in the function to be detected.
[0086] "greater":0, / / The parameter value is greater than 0, meaning the lower limit of the range of values for the parameter to be detected is 0.
[0087] "less":10000, / / The parameter value is less than 10000, meaning the upper limit of the range of values for the parameter to be detected is 10000.
[0088] "param":"ConnectTimeoutMs" / / This parameter represents the connection timeout (milliseconds).
[0089] },
[0090] {
[0091] "name":"NewUfcRequest"
[0092] "index":8, / / The parameter index is 8, meaning the parameter to be detected is the 9th parameter in the function to be detected.
[0093] "greater":0, / / The parameter value is greater than 0, meaning the lower limit of the range of values for the parameter to be detected is 0.
[0094] "less":60000, / / The parameter value is less than 60000, meaning the upper limit of the range of values for the parameter to be detected is 60000.
[0095] "param":"ReadWriteTimeoutMs" / / This parameter specifies the read / write timeout (in milliseconds).
[0096] },
[0097] By parsing the configuration file of the source code file, the function name of the function to be tested, the index of the parameter to be tested, and the upper and lower limits of the value of the parameter to be tested can be obtained. Thus, the function to be tested can be determined based on the function name, the parameter to be tested in the function to be tested can be determined based on the function name and the index of the parameter to be tested, and the value range of the parameter to be tested can be determined based on the upper and lower limits of the value of the parameter to be tested.
[0098] Step 303: For any parameter to be detected, determine the source of the parameter value from the intermediate code.
[0099] In this embodiment of the disclosure, for any parameter to be detected in the function to be detected, the parameter to be detected can be recursively traced to determine the source of the parameter value.
[0100] Step 304: If the source type of the parameter value of the parameter to be detected is a constant type, determine the parameter value of the parameter to be detected based on the source of the parameter value of the parameter to be detected.
[0101] In this embodiment of the disclosure, it can be determined whether the data types from which the values of each parameter of the parameter to be detected originate are all constant types. If the data types from which the values of each parameter of the parameter to be detected originate are all constant types, then the parameter value of the parameter to be detected can be calculated based on the source of each parameter value of the parameter to be detected.
[0102] Taking Go as an example, the intermediate file obtained by compiling the source code file can be the SSA intermediate code. Let's assume the parameter to be detected is... Figure 2 The parameter value of param shown comes from the constant type (ssa.Const) d and time.Hour, since time.Hour = 3.6 * 10 12 The parameter value of d comes from the constant type (ssa.Const) time.Second and 10, where time.Second = 10. 9 After constant calculation, the value of the parameter to be detected, param, can be obtained as 3.6 * 10. 22 .
[0103] Step 305: If at least one of the parameters to be detected contains a target detection parameter whose value is not within the corresponding value range, generate and display abnormal information, wherein the abnormal information is used to indicate that there is an abnormal value related to the target detection parameter in the source code file.
[0104] The explanation of step 305 can be found in the relevant description in any embodiment of this disclosure, and will not be repeated here.
[0105] The anomaly detection method of this disclosure can effectively calculate the parameter value of the parameter to be detected through constant operations during compilation. Thus, by determining whether the parameter value of the parameter to be detected is within the value range corresponding to the parameter to be detected, it can be effectively determined whether the parameter related to the parameter to be detected in the source code file has an abnormal value.
[0106] To clearly illustrate any of the above embodiments, this disclosure also proposes an anomaly detection method.
[0107] Figure 4 This is a flowchart illustrating the anomaly detection method provided in Embodiment 3 of this disclosure.
[0108] like Figure 4 As shown, the anomaly detection method may include the following steps:
[0109] Step 401: Obtain the intermediate code obtained by compiling the source code file, wherein the intermediate code includes the function to be tested.
[0110] The explanation of step 401 can be found in the relevant description in any embodiment of this disclosure, and will not be repeated here.
[0111] Step 402: Identify function call instructions and assignment instructions from multiple instructions in the intermediate code.
[0112] In this embodiment of the disclosure, function call instructions and assignment instructions can be determined from multiple instructions in the intermediate code.
[0113] As an example, taking Go as the programming language of the source code file, the intermediate file obtained by compiling the source code file can be SSA intermediate code. By traversing and analyzing the instructions in the SSA intermediate code, function call instructions (ssa.Call type) and assignment instructions (ssa.Store type) can be obtained.
[0114] Step 403: Generate a function call chain according to the function call instructions, wherein the function call chain is used to indicate the calling relationship between functions in the intermediate code.
[0115] In this embodiment of the disclosure, a function call chain can be generated according to the function call instruction, wherein the function call chain is used to indicate the call relationship between functions in the intermediate code.
[0116] Step 404: According to the assignment instruction, capture each parameter and constant of type constant in the intermediate code.
[0117] In this embodiment of the disclosure, parameters and constants of constant type in the intermediate code can be captured according to the assignment instruction.
[0118] Step 405: Obtain the value range of at least one parameter to be detected in the function to be detected.
[0119] It should be noted that this disclosure only exemplifies step 405 after step 404, but this disclosure is not limited to this. That is, there is no restriction on the execution order of step 405. For example, step 405 can be executed in parallel with step 401, or step 405 can be executed before step 401, or step 405 can be executed after step 401 and before step 402, or step 405 can also be executed in parallel with steps 402 to 404, etc. There are no restrictions in this regard.
[0120] Step 406: For any parameter to be detected, determine the parameter value of the parameter to be detected based on the source of the parameter value in the intermediate code.
[0121] The explanation of steps 405 to 406 can be found in the relevant description in any embodiment of this disclosure, and will not be repeated here.
[0122] Step 407: If at least one of the parameters to be detected contains a target detection parameter whose value is not within the corresponding value range, generate and display abnormal information, wherein the abnormal information is used to indicate that there is an abnormal value related to the target detection parameter in the source code file.
[0123] The explanation of step 407 can be found in the relevant description in any embodiment of this disclosure, and will not be repeated here.
[0124] The anomaly detection method of this disclosure generates a function call chain based on function call instructions, thereby enabling rapid analysis and calculation of parameters in the function call form to obtain parameter values and improving the efficiency of parameter value calculation. By capturing and pre-recording various parameters and constants of constant data type according to assignment instructions, the method can prevent the occurrence of situations where global constants cannot be captured, thus improving the effectiveness of parameter value calculation.
[0125] To clearly illustrate how the parameter value of the parameter to be detected is determined in any embodiment of this disclosure, this disclosure also proposes an anomaly detection method.
[0126] Figure 5 This is a flowchart illustrating the anomaly detection method provided in Embodiment 4 of this disclosure.
[0127] like Figure 5 As shown, the anomaly detection method may include the following steps:
[0128] Step 501: Obtain intermediate code obtained by compiling the source code file, wherein the intermediate code includes the function to be tested, and obtain the value range of at least one parameter to be tested in the function to be tested.
[0129] Step 502: Determine the function call instruction and assignment instruction from the multiple instructions in the intermediate code.
[0130] Step 503: Generate a function call chain according to the function call instructions, wherein the function call chain is used to indicate the call relationship between functions in the intermediate code.
[0131] Step 504: According to the assignment instruction, capture each parameter and constant of type constant in the intermediate code.
[0132] Step 505: For any parameter to be detected, determine the source of the parameter value from the intermediate code.
[0133] The explanation of steps 501 to 505 can be found in the relevant description in any embodiment of this disclosure, and will not be repeated here.
[0134] Step 506: Determine the parameter form of the parameter to be detected in the intermediate code.
[0135] In the disclosed embodiments, the parameter form may include, but is not limited to: variables, elements in a slice, and the return value of a function call (referred to as the function call form in this disclosure).
[0136] Step 507: If the parameter form is not a function call form, determine whether the type of the parameter value source of the parameter to be detected is a constant type.
[0137] In this embodiment of the disclosure, when the parameter form is not a function call form (such as an element in a variable or slice), it can be determined whether the type of the parameter value source of the parameter to be detected is a constant type.
[0138] Step 508: If the type of the parameter value source of the parameter to be detected is constant, determine the parameter value of the parameter to be detected based on the source of the parameter value of the parameter to be detected.
[0139] In this embodiment of the disclosure, when the data types from which the parameter values of the parameter to be detected originate are all constant types, the parameter value of the parameter to be detected can be calculated based on the source of the parameter value of the parameter to be detected.
[0140] As an example, using Go as the programming language in the source code file, and the parameter to be detected as a variable, the code containing the parameter to be detected, param, is shown below:
[0141]
[0142] By recursively tracing the source of the parameter to be detected (param), we can obtain the following: Figure 2 The parameter values shown are from the source, since Second = 10 9 Then d = 10 10 , Hour=3600*Second=3.6*10 12 Finally, the value of the parameter to be detected, param, can be calculated to be 3.6 * 10. 22 .
[0143] As another example, using Go as the programming language in the source code file, and the parameter to be detected as an element in a slice, the code containing the slice containing the parameter to be detected is shown below:
[0144]
[0145] By recursively tracing the parameters to be detected, we can obtain the following results: Figure 6 The parameter value shown is from which the parameter value originates. Since the elements in the slice are of type ssa.Const in the SSA intermediate code, the parameter value to be detected can be obtained during compilation as 10000.
[0146] Step 509: When the parameter is in function call form, determine whether the type of the parameter value source of the parameter to be detected is a constant type.
[0147] In this embodiment of the disclosure, when the parameter is in the form of a function call, it can be determined whether the type of the parameter value source of the parameter to be detected is a constant type.
[0148] Step 510: If the type of the parameter value source of the parameter to be detected is constant, determine the parameter value of the parameter to be detected based on the function call chain and the source of the parameter value of the parameter to be detected.
[0149] In this embodiment of the disclosure, when the data type of the parameter value source of the parameter to be detected is a constant type, the parameter value of the parameter to be detected can be determined according to the function call chain and the source of the parameter value of the parameter to be detected.
[0150] As an example, using Go as the programming language in the source code file, and the parameter to be detected in the form of a function call (i.e., the return value of the function call), the code containing the parameter to be detected, compute(), is shown below:
[0151]
[0152] By recursively tracing the parameters to be detected in the form of function calls, we can obtain, for example... Figure 7 The parameter values shown are from [source]. Figure 7 As can be seen, the final parameter values of the parameters to be detected all originate from constants, which are all constant types in the SSA intermediate code. Therefore, the parameter values can be obtained during compilation. For example, since Second = 10 9 Finally, the calculated value of the parameter to be detected is 1.2 * 10. 12 .
[0153] It should be noted that steps 507 to 508 and steps 509 to 510 are two parallel implementation methods. In actual application, only one needs to be executed.
[0154] Step 511: If at least one of the parameters to be detected contains a target detection parameter whose value is not within the corresponding value range, generate and display abnormal information.
[0155] Among them, the exception information is used to indicate that there are abnormal values related to the target detection parameters in the source code file.
[0156] The anomaly detection method of this disclosure can not only support parameter value calculation for parameters in function call form, but also support parameter value calculation for parameters in non-function call form, which can improve the flexibility and applicability of the method.
[0157] To clearly illustrate any of the above embodiments of this disclosure, this disclosure also proposes an anomaly detection method.
[0158] Figure 8 This is a flowchart illustrating the anomaly detection method provided in Embodiment 5 of this disclosure.
[0159] like Figure 8 As shown, the anomaly detection method may include the following steps:
[0160] Step 801: Obtain the programming language corresponding to the source code file.
[0161] In one possible implementation of this disclosure, the code content of the source code file can be parsed to obtain the programming language corresponding to the source code file.
[0162] In another possible implementation of the embodiments of this disclosure, the source code file may carry tagging information, wherein the tagging information is used to indicate the programming language of the source code file, so that in this disclosure, the tagging information can be extracted from the source code file to determine the programming language corresponding to the source code file based on the tagging information.
[0163] In another possible implementation of the embodiments of this disclosure, the programming language corresponding to the source code file may also be provided by relevant personnel.
[0164] Step 802: Perform at least one of lexical analysis, syntax analysis, and semantic analysis on the source code file to determine whether the source code file conforms to the code specification of the programming language.
[0165] In this embodiment of the disclosure, at least one of lexical analysis, syntax analysis, and semantic analysis can be performed on each character in the source code file to determine whether the source code file conforms to the code specification of the programming language.
[0166] Step 803: If the source code file conforms to the code style, compile the source code file to obtain intermediate code, which includes the function to be tested.
[0167] In this embodiment of the disclosure, if the source code file conforms to the code style of the programming language, the source code file can be compiled to obtain intermediate code.
[0168] In one possible implementation of this disclosure, an error message can be generated if the source code file does not conform to coding standards; wherein the error message is used to indicate that the programming language of the source code file does not conform to coding standards.
[0169] Furthermore, the error message can be displayed, and / or sent.
[0170] This allows relevant personnel to promptly modify source code files that do not conform to coding standards, thereby improving the standardization of source code files and further reducing any unexpected impact on business operations.
[0171] Step 804: Obtain the value range of at least one parameter to be detected in the function to be detected.
[0172] Step 805: For any parameter to be detected, determine the parameter value of the parameter to be detected based on the source of the parameter value in the intermediate code.
[0173] Step 806: If at least one of the parameters to be detected contains a target detection parameter whose value is not within the corresponding value range, generate and display abnormal information, wherein the abnormal information is used to indicate that there is an abnormal value related to the target detection parameter in the source code file.
[0174] The explanation of steps 804 to 805 can be found in the relevant description in any embodiment of this disclosure, and will not be repeated here.
[0175] In any embodiment of this disclosure, information generated during the compilation process can be used to detect the parameters to be detected in the function to be detected (such as those with underlying numeric types, uint64, int64, etc.) and calculate the specific parameter values of the parameters to be detected.
[0176] Using Go as an example, this example demonstrates how fault prevention in high-availability environments can be implemented at the code level through static analysis of Go code. This fault prevention can be categorized into several levels: code, architecture, testing, and deployment.
[0177] In the Go language, such as Figure 9 As shown, the compilation process mainly consists of lexical analysis, syntax analysis, semantic analysis, type checking, SSA intermediate code generation, intermediate code optimization, and machine code generation. This disclosure allows for the analysis and acquisition of the SSA intermediate code generated during compilation, thereby obtaining the parameter values of the parameters to be detected in the corresponding functions during compilation. In other words, the parameter values of the parameters to be detected can be traced back using the SSA intermediate code of the Go language. The main logic includes the following parts:
[0178] The first part involves recording the parameters to be tested for a specific function in the configuration file. For example, the configuration file can record the function name, the parameters to be tested in the function, and the range of values for the parameters.
[0179] In the second part, when the source code file is submitted, the Go language analysis package (go / analysis package) can be used to generate SSA intermediate code for each code package of the module to which the source code file belongs. Then, the SSA intermediate code is analyzed and relevant information is recorded for each instruction. During the instruction traversal process, two instructions are mainly focused on: function call instructions (ssa.Call type) and assignment instructions (ssa.Store type).
[0180] The purpose of focusing on function call instructions is to generate a function call chain, which is used to indicate the call relationship between functions in the SSA intermediate code, so that the function to be detected can be analyzed quickly in the future.
[0181] The purpose of focusing on assignment instructions is to prevent global constants from being missed later and to record and save each global constant in advance.
[0182] The third part recursively traces the source of the parameter to be detected in the first part to find the origin of its value. If the source of the parameter value is a constant type (ssa.Const), the parameter value can be calculated based on its source. The parameter forms can include: variables (whose value originates from the ssa.Const type), elements in a slice (whose value originates from the ssa.Const type), and the return value of a function call (whose return value originates from the ssa.Const type). These three parameter forms will be explained in detail below.
[0183] A) For parameters that are variables and whose values originate from the type ssa.Const, a constant of type ssa.Const can be found through recursive tracing. After constant operations, the parameter value can be obtained during compilation.
[0184] As an example, with the parameter to be detected as param, the code containing the parameter to be detected is shown below:
[0185]
[0186] like Figure 2 As shown, the parameter `param` to be detected is recursively traced back, and its final parameter value originates from a constant, which is of type `ssa.Const` in the SSA intermediate code. Since d = 10 10 , Hour=3600*Second=3.6*10 12 Finally, the parameter value to be detected can be calculated as param = 3.6 * 10. 22 .
[0187] B) For parameters that are elements in a slice and whose values are of type ssa.Const, the code containing the parameter to be detected is shown below, using the slice as the parameter to be detected:
[0188]
[0189] The elements in the slice are of type ssa.Const in the SSA intermediate code, therefore, the parameter value of the parameter to be detected can be obtained during compilation as 10000.
[0190] C) For parameters that are function call return values and whose values are of type ssa.Const, the code example containing the parameter to be detected is shown below, using compute() as the parameter to be detected:
[0191]
[0192] By recursively tracing the parameters to be tested in function call forms, the final parameter values all originate from constants, which are of type ssa.Const in the SSA intermediate code. Therefore, the parameter values can be obtained during compilation. For example, since Second = 10 9 Finally, the calculated value of the parameter to be detected is 1.2 * 10. 12 .
[0193] In summary, the system can detect the parameter values of specific parameters in a function before the code goes live and determine whether the parameter values exceed the corresponding range. This allows the system to detect situations where the timeout is too long due to the business side multiplying the timeout time by the time unit, thus reducing the likelihood of code not meeting expectations.
[0194] The anomaly detection method of this disclosure only performs parameter value detection based on the intermediate code obtained by compiling the source code file if the source code file conforms to the code specification, which can improve the accuracy and reliability of the anomaly detection results of the source code file.
[0195] With the above Figures 1 to 8 Corresponding to the anomaly detection method provided in the embodiments, this disclosure also provides an anomaly detection device. Because the anomaly detection device provided in the embodiments of this disclosure is similar to the one described above… Figures 1 to 8 The anomaly detection method provided in the embodiments corresponds to the anomaly detection method provided in the embodiments of this disclosure, and therefore the implementation of the anomaly detection method is also applicable to the anomaly detection device provided in the embodiments of this disclosure, and will not be described in detail in the embodiments of this disclosure.
[0196] Figure 10 This is a schematic diagram of the anomaly detection device provided in Embodiment Six of this disclosure.
[0197] like Figure 10 As shown, the anomaly detection device 1000 may include: a first acquisition module 1001, a second acquisition module 1002, a determination module 1003, and a processing module 1004.
[0198] The first acquisition module 1001 is used to acquire intermediate code obtained by compiling the source code file, wherein the intermediate code includes the function to be detected.
[0199] The second acquisition module 1002 is used to acquire the value range of at least one parameter to be detected in the function to be detected.
[0200] The first determining module 1003 is used to determine the parameter value of any parameter to be detected based on the source of the parameter value in the intermediate code.
[0201] The processing module 1004 is used to generate and display abnormal information when there is a target detection parameter whose value is not within the corresponding value range in at least one of the parameters to be detected. The abnormal information is used to indicate that there is a value abnormality related to the target detection parameter in the source code file.
[0202] In one possible implementation of this disclosure, the first determining module 1003 is configured to: determine the source of the parameter value of any parameter to be detected from intermediate code; and, if the type of the source of the parameter value of the parameter to be detected is a constant type, determine the parameter value of the parameter to be detected based on the source of the parameter value of the parameter to be detected.
[0203] In one possible implementation of this disclosure, the anomaly detection device 1000 may further include:
[0204] The second determining module is used to determine function call instructions and assignment instructions from multiple instructions in the intermediate code.
[0205] The first generation module is used to generate a function call chain based on the function call instructions. The function call chain is used to indicate the calling relationship between functions in the intermediate code.
[0206] The capture module is used to capture parameters and constants of constant type in the intermediate code according to the assignment instructions.
[0207] In one possible implementation of this disclosure, the anomaly detection device 1000 may further include:
[0208] The third determination module is used to determine whether the parameter to be detected is in a non-function call form in the intermediate code.
[0209] In one possible implementation of this disclosure, the anomaly detection device 1000 may further include:
[0210] The fourth determining module is used to determine that the parameter to be detected is in the form of a function call in the intermediate code. Correspondingly, the first determining module 1003 is used to determine the parameter value of the parameter to be detected based on the function call chain and the source of the parameter value of the parameter to be detected when the type of the parameter value source of the parameter to be detected is a constant type.
[0211] In one possible implementation of this disclosure, the second acquisition module 1002 is used to: parse the configuration file of the source code file to obtain the value range of at least one parameter to be detected.
[0212] In one possible implementation of this disclosure, the anomaly detection device 1000 may further include:
[0213] The third acquisition module is used to obtain the programming language corresponding to the source code file.
[0214] The execution module is used to perform at least one of lexical analysis, syntax analysis, and semantic analysis on the source code file to determine whether the source code file conforms to the code specification of the programming language.
[0215] The fifth module is used to determine whether the source code file conforms to coding standards.
[0216] In one possible implementation of this disclosure, the anomaly detection device 1000 may further include:
[0217] The second generation module is used to generate error messages when the source code file does not conform to the code style guidelines; the error messages are used to indicate that the programming language of the source code file does not conform to the code style guidelines.
[0218] The anomaly detection device of this embodiment compiles source code files to obtain intermediate code and acquires the value range of at least one parameter to be detected in the function to be detected within the intermediate code. Based on the source of the parameter value in the intermediate code, the device determines the parameter value of the parameter to be detected. If at least one parameter to be detected has a value outside its corresponding value range, an anomaly message is generated and displayed. This anomaly message indicates that the source code file contains an anomaly related to the target parameter. Therefore, it can detect the values of parameters related to the parameter to be detected in the source code file according to business requirements, to determine whether the parameter value exceeds the corresponding value range. If so, a prompt message is generated to prompt relevant personnel to modify the source code file. This avoids situations where the timeout time set by the business party is too long due to multiplying the timeout time by the time unit, reduces the occurrence of source code files not meeting expectations, and thus avoids unexpected impacts on business operations.
[0219] To implement the above embodiments, this disclosure also provides an electronic device, which may include at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the anomaly detection method proposed in any of the above embodiments of this disclosure.
[0220] To implement the above embodiments, this disclosure also provides a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to cause a computer to execute the anomaly detection method proposed in any of the above embodiments of this disclosure.
[0221] To implement the above embodiments, this disclosure also provides a computer program product, which includes a computer program that, when executed by a processor, implements the anomaly detection method proposed in any of the above embodiments of this disclosure.
[0222] According to embodiments of this disclosure, this disclosure also provides an electronic device, a readable storage medium, and a computer program product.
[0223] Figure 11A schematic block diagram of an example electronic device that can be used to implement embodiments of the present disclosure is shown. The electronic device may include the server and client described in the above embodiments. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or claimed herein.
[0224] like Figure 11 As shown, the electronic device 1100 includes a computing unit 1101, which can perform various appropriate actions and processes according to a computer program stored in ROM (Read-Only Memory) 1102 or loaded from storage unit 1108 into RAM (Random Access Memory) 1103. The RAM 1103 may also store various programs and data required for the operation of the electronic device 1100. The computing unit 1101, ROM 1102, and RAM 1103 are interconnected via bus 1104. An I / O (Input / Output) interface 1105 is also connected to bus 1104.
[0225] Multiple components in electronic device 1100 are connected to I / O interface 1105, including: input unit 1106, such as keyboard, mouse, etc.; output unit 1107, such as various types of displays, speakers, etc.; storage unit 1108, such as disk, optical disk, etc.; and communication unit 1109, such as network card, modem, wireless transceiver, etc. Communication unit 1109 allows electronic device 1100 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.
[0226] The computing unit 1101 can be various general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 1101 include, but are not limited to, CPUs (Central Processing Units), GPUs (Graphics Processing Units), various special-purpose AI (Artificial Intelligence) computing chips, various computing units running machine learning model algorithms, DSPs (Digital Signal Processors), and any suitable processor, controller, microcontroller, etc. The computing unit 1101 performs the various methods and processes described above, such as the anomaly detection methods described above. For example, in some embodiments, the anomaly detection methods described above can be implemented as computer software programs tangibly contained in a machine-readable medium, such as storage unit 1108. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 1100 via ROM 1102 and / or communication unit 1109. When the computer program is loaded into RAM 1103 and executed by the computing unit 1101, one or more steps of the anomaly detection methods described above can be performed. Alternatively, in other embodiments, the computing unit 1101 may be configured to perform the above-described anomaly detection method by any other suitable means (e.g., by means of firmware).
[0227] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, FPGAs (Field Programmable Gate Arrays), ASICs (Application-Specific Integrated Circuits), ASSPs (Application-Specific Standard Products), SOCs (System-on-Chips), CPLDs (Complex Programmable Logic Devices), computer hardware, firmware, software, and / or combinations thereof. These various implementations may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.
[0228] The program code used to implement the methods of this disclosure may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.
[0229] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, RAM, ROM, EPROM (Electrically Programmable Read-Only Memory) or flash memory, optical fiber, CD-ROM (Compact Disc Read-Only Memory), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.
[0230] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user (e.g., a CRT (Cathode-Ray Tube) or LCD (Liquid Crystal Display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).
[0231] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication (e.g., communication networks) of any form or medium. Examples of communication networks include LANs (Local Area Networks), WANs (Wide Area Networks), the Internet, and blockchain networks.
[0232] Computer systems can include clients and servers. Clients and servers are generally geographically separated and typically interact via communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. A server can be a cloud server, also known as a cloud computing server or cloud host, a hosting product within the cloud computing service system that addresses the shortcomings of traditional physical hosts and VPS (Virtual Private Server) services, such as high management difficulty and weak business scalability. Servers can also be servers for distributed systems or servers integrated with blockchain technology.
[0233] It's important to note that artificial intelligence (AI) is the study of enabling computers to simulate certain human thought processes and intelligent behaviors (such as learning, reasoning, thinking, and planning). It encompasses both hardware and software technologies. AI hardware technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, and big data processing. AI software technologies primarily include computer vision, speech recognition, natural language processing, machine learning / deep learning, big data processing, and knowledge graph technologies.
[0234] Cloud computing refers to a technology system that provides access to a shared pool of physical or virtual resources via a network. These resources can include servers, operating systems, networks, software, applications, and storage devices, and can be deployed and managed on demand and in a self-service manner. Cloud computing technology can provide efficient and powerful data processing capabilities for applications such as artificial intelligence and blockchain, as well as for model training.
[0235] According to the technical solution of this disclosure, intermediate code is obtained by compiling source code files, and the value range of at least one parameter to be detected in the function to be detected in the intermediate code is obtained. The parameter value of the parameter to be detected is determined based on the source of the parameter value in the intermediate code. If at least one parameter to be detected has a target detection parameter whose value is not within the corresponding value range, an exception message is generated and displayed. The exception message indicates that there is a value anomaly related to the target detection parameter in the source code file. Therefore, it is possible to detect the values of parameters related to the parameter to be detected in the function to be detected in the source code file according to business requirements, to determine whether the parameter value exceeds the corresponding value range. If so, a prompt message is generated to prompt relevant personnel to modify the source code file, avoiding situations where the timeout time set by the business party is too long due to multiplying the timeout time by the time unit, reducing the occurrence of source code files not meeting expectations, and thus avoiding unexpected impacts on the business.
[0236] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution proposed in this disclosure can be achieved, and this is not limited herein.
[0237] The specific embodiments described above do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.
Claims
1. An anomaly detection method, the method comprising: Obtain intermediate code obtained by compiling the source code file, wherein the intermediate code includes the function to be tested; The function call instruction and assignment instruction are determined from the multiple instructions in the intermediate code; Based on the function call instruction, a function call chain is generated, wherein the function call chain is used to indicate the call relationship between functions in the intermediate code; According to the assignment instruction, capture each parameter and each constant of type constant in the intermediate code; Obtain the value range of at least one parameter to be detected in the function to be detected; For any of the parameters to be detected, the parameter to be detected is recursively traced to determine the source of the parameter value of the parameter to be detected. Based on the source of the parameter value of the parameter to be detected in the intermediate code, the parameter value of the parameter to be detected is determined. If, among the at least one parameter to be detected, there is a target detection parameter whose value is not within the corresponding value range, an anomaly information is generated and displayed, wherein the anomaly information is used to indicate that there is a value anomaly related to the target detection parameter in the source code file.
2. The method according to claim 1, wherein, For any of the parameters to be detected, determining the parameter value of the parameter to be detected based on the source of the parameter value in the intermediate code includes: For any of the parameters to be detected, the source of the parameter value of the parameter to be detected is determined from the intermediate code; If the type of the parameter value source of the parameter to be detected is constant, the parameter value of the parameter to be detected is determined according to the source of the parameter value of the parameter to be detected.
3. The method according to claim 1, wherein, When the type of the parameter value source of the parameter to be detected is constant, before determining the parameter value of the parameter to be detected based on the source of the parameter value, the method further includes: It is determined that the parameter to be detected in the intermediate code is in a non-function call form.
4. The method according to claim 1, wherein, When the type of the parameter value source of the parameter to be detected is constant, before determining the parameter value of the parameter to be detected based on the source of the parameter value, the method further includes: The parameter to be detected is determined to be in function call form in the intermediate code; Accordingly, when the type of the parameter value source of the parameter to be detected is a constant type, determining the parameter value of the parameter to be detected based on the source of the parameter value includes: If the type of the parameter value source of the parameter to be detected is constant, the parameter value of the parameter to be detected is determined according to the function call chain and the source of the parameter value of the parameter to be detected.
5. The method according to any one of claims 1-4, wherein, The step of obtaining the value range of at least one parameter to be detected in the function to be detected includes: The configuration file of the source code file is parsed to obtain the value range of the at least one parameter to be detected.
6. The method according to any one of claims 1-4, wherein, Before obtaining the intermediate code obtained by compiling the source code file, the method further includes: Obtain the programming language corresponding to the source code file; Perform at least one of lexical analysis, syntax analysis, and semantic analysis on the source code file to determine whether the source code file conforms to the code specification of the programming language; Determine that the source code file conforms to the code style guidelines.
7. The method according to claim 6, wherein, The method further includes: If the source code file does not conform to the specified code standards, an error message will be generated. The error message indicates that the programming language of the source code file does not conform to the code specification.
8. An anomaly detection device, the device comprising: The first acquisition module is used to acquire intermediate code obtained by compiling the source code file, wherein the intermediate code includes the function to be detected; The second acquisition module is used to acquire the value range of at least one parameter to be detected in the function to be detected; The first determining module is used to recursively trace the source of any of the parameters to be detected in order to determine the source of the parameter value of the parameter to be detected, and to determine the parameter value of the parameter to be detected based on the source of the parameter value of the parameter to be detected in the intermediate code. The processing module is configured to generate and display abnormal information when there is a target detection parameter whose value is not within the corresponding value range among the at least one parameter to be detected, wherein the abnormal information is used to indicate that there is a value abnormality related to the target detection parameter in the source code file; The second determining module is used to determine function call instructions and assignment instructions from multiple instructions in the intermediate code; The first generation module is used to generate a function call chain according to the function call instruction, wherein the function call chain is used to indicate the call relationship between functions in the intermediate code; The capture module is used to capture each parameter and each constant of type constant in the intermediate code according to the assignment instruction.
9. The apparatus according to claim 8, wherein, The first determining module is used for: For any of the parameters to be detected, the source of the parameter value of the parameter to be detected is determined from the intermediate code; If the type of the parameter value source of the parameter to be detected is constant, the parameter value of the parameter to be detected is determined according to the source of the parameter value of the parameter to be detected.
10. The apparatus according to claim 8, wherein, The device further includes: The third determining module is used to determine whether the parameter to be detected in the intermediate code is in a non-function call form.
11. The apparatus according to claim 10, wherein, The device further includes: The fourth determining module is used to determine whether the parameter to be detected in the intermediate code is in the form of a function call. Accordingly, the first determining module is used to: If the type of the parameter value source of the parameter to be detected is constant, the parameter value of the parameter to be detected is determined according to the function call chain and the source of the parameter value of the parameter to be detected.
12. The apparatus according to any one of claims 8-11, wherein, The second acquisition module is used for: The configuration file of the source code file is parsed to obtain the value range of the at least one parameter to be detected.
13. The apparatus according to any one of claims 8-11, wherein, The device further includes: The third acquisition module is used to acquire the programming language corresponding to the source code file; An execution module is used to perform at least one of lexical analysis, syntax analysis, and semantic analysis on the source code file to determine whether the source code file is a code specification corresponding to the programming language. The fifth determining module is used to determine whether the source code file conforms to the code specification.
14. The apparatus according to claim 13, wherein, The device further includes: The second generation module is used to generate error messages when the source code file does not conform to the code specifications. The error message indicates that the programming language of the source code file does not conform to the code specification.
15. An electronic device comprising: At least one processor; as well as A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the anomaly detection method according to any one of claims 1-7.
16. A non-transitory computer-readable storage medium storing computer instructions, wherein, The computer instructions are used to cause the computer to execute the anomaly detection method according to any one of claims 1-7.
17. A computer program product comprising a computer program that, when executed by a processor, implements the steps of the anomaly detection method according to any one of claims 1-7.