Network application change planning method and system

Abstract

The application provides a network application change planning method and system, comprising the following steps: S1, obtaining a set of traffic characteristic description vectors of network entities based on the traffic of each network entity, and generating a network entity description library based on traffic characteristics; S2, obtaining abnormal description information associated with the network entity based on traffic logs, system logs and monitoring information of a preset time period; S3, constructing a network entity influence scope knowledge base based on the network entity description library based on traffic characteristics and the abnormal description information associated with the network entity; and S4, obtaining a change plan list based on the network entity influence scope knowledge base and the network entity description library based on traffic characteristics.

Description

Technical Field

[0001] This invention relates to the field of network application technology, and more specifically, to a method and system for planning network application changes. Background Technology

[0002] Modern enterprise information systems are generally distributed information systems based on networks / local area networks. While such information system environments bring robustness and flexibility, they also bring difficulties in diagnosing problems. In particular, when multiple applications are changed simultaneously and successively (changes here include the release of new applications and the updating of existing applications), it becomes more difficult to troubleshoot errors, and the root cause of the problem is difficult to determine among multiple newly developed applications.

[0003] Patent document CN104516994B (application number: 201310456529.X) discloses a computer-implemented method and apparatus for assisted release planning. The method includes: obtaining requirements to be planned, which are requirements expected to be included in the release plan; obtaining a release plan, which includes release constraints and planned requirements, which are requirements already included in the release plan; in response to a determination that there is a conflict between planned requirements and release constraints, presenting a suggested modification to the release plan generated based on the requirements to be planned and the release plan; and presenting a prediction generated based on the requirements to be planned and the release plan of whether adding additional requirements to the release plan would violate the release constraints.

[0004] This invention proposes a network application change planning method and system. When multiple applications need to be released, the system will provide the most reasonable release plan based on the potential problems and scope of impact of the applications, including the release order and time interval. This avoids the dilemma of root cause diagnosis of multiple applications, improves the speed of troubleshooting, and minimizes the total change time while ensuring safety. Summary of the Invention

[0005] To address the shortcomings of existing technologies, the purpose of this invention is to provide a method and system for planning network application changes.

[0006] A network application change planning method provided by the present invention includes:

[0007] Step S1: Obtain a set of traffic feature description vectors for each network entity based on the traffic corresponding to each network entity, and generate a network entity description library based on traffic features;

[0008] Step S2: Obtain anomaly description information associated with network entities based on traffic logs, system logs, and monitoring information within a preset time period;

[0009] Step S3: Construct a network entity impact surface knowledge base based on the network entity description library of traffic characteristics and the anomaly description information associated with network entities;

[0010] Step S4: Obtain a list of change plans for the network entities to be changed based on the network entity impact knowledge base and the network entity description database of traffic characteristics.

[0011] Preferably, step S1 involves: defining network entities as (entity ID, application layer traffic digest), collecting relevant data, and constructing a network entity description library (entity_library);

[0012] The application layer traffic summary is a key-value dictionary, where the key is the application layer traffic name and the value is an array of data packets with a preset time granularity within a preset time period.

[0013] Preferably, step S2 involves: extracting network entity anomaly information based on traffic logs, system logs, and monitoring information within a preset time period, constructing a network entity anomaly information tuple (anomaly); and summarizing the network entity anomaly information tuples (anomaly) to form an anomaly information description set (anomaly_set).

[0014] Preferably, step S3 employs the following methods:

[0015] Step S3.1: Cluster the samples in the anomaly information description set anomaly_set, and divide the anomalies in the anomaly information description set anomaly_set into k sets, where each set is denoted as cluster, and all clusters constitute a cluster_set;

[0016] Step S3.2: Calculate the impact surface of entity changes based on the clustered traversal network entity description library (entity_library) and cluster_set;

[0017] Step S3.3: Summarize the impact surfaces of all entity changes to obtain the network entity impact surface knowledge base influence_kb.

[0018] Preferably, step S3.1 involves: using the occurrence time (unixtime) of the network entity anomaly information tuple (anomaly id, entity id, occurrence time unixtime) as a feature, clustering it into k classes using Canopy clustering, and then using the k-means algorithm with k as a parameter for further clustering and optimization of the k-class effect; the anomalies in anomaly_set are divided into k sets, where each set is denoted as cluster, and all clusters constitute a cluster_set.

[0019] Preferably, step S3.2 employs the following:

[0020] Step S3.2.1: Obtain a record of an entity from the entity_library, denoted as entity1; construct an empty influence set, denoted as influence_set1;

[0021] Step S3.2.2: Traverse each cluster in cluster_set. If there is an exception that occurred in entity1, find the earliest exception and denote it as anomaly1. Then, transform all exceptions that occurred after anomaly1 in the cluster and anomaly1 into related exception tuples and add them to influence_set1. The form of the related exception tuple is: (exception id, delay time); where the delay time = the occurrence time of the current anomaly - the occurrence time of anomaly1. If there are duplicate exception ids, the delay time is taken as the largest value.

[0022] Preferably, step S4 employs the following methods:

[0023] Step S4.1: Calculate the shortest ordered change time interval between every pair of influence surface records in the influence surface knowledge base;

[0024] Step S4.2: Obtain the set of entities to be changed and calculate the shortest safe release order.

[0025] Preferably, step S4.1 employs the following:

[0026] Step S4.1.1: Suppose that entities1 and entity2 have influence surface records influence_set1 and influence_set2, and there is an anomaly intersection between these two records, denoted as intersect_anomaly_set;

[0027] Step S4.1.2: If the change order is entity1, entity2, then the maximum delay time in the intersection of intersect_anomaly_set and influence_set1 is the ordered change sequence.<entity1,entity2> The shortest safe and orderly change interval is denoted as gap12;

[0028] Step S4.1.3: If the change order is entity2, entity1, then the maximum delay time in the intersection of intersect_anomaly_set and influence_set2 is the ordered change sequence.<entity2,entity1> The shortest safe and orderly change interval is denoted as gap21;

[0029] Step S4.1.4: Calculate the shortest safe and ordered change interval between all pairs of entities based on entity_library and influence_kb. The set formed by these intervals is the shortest safe and ordered change interval set, denoted as gap_set.

[0030] Preferably, step S4.2 employs the following:

[0031] Step S4.2.1: If there is an entity_x to be changed that is not included in entity_library, then obtain the application layer traffic summary of entity_x through local experimentation and speculation, denoted as digist_x; traverse and calculate the application layer traffic summary of all elements in entity_library, calculate the similarity between digist_x and the summary of each element, and obtain the entity_s with the highest similarity.

[0032] Step S4.2.2: Enumerate all possible sortings of the entity to be changed, and calculate the shortest total safe change time interval for each possible sorting;

[0033] Step 4.2.3: Among all possible change orderings, the order with the shortest total change time interval is the optimal change ordering plan. The time interval between adjacent changes is determined by the corresponding value in gap_set.

[0034] A network application change planning system provided by the present invention includes:

[0035] Module M1: Obtains a set of traffic feature description vectors for each network entity based on the traffic corresponding to that network entity, and generates a network entity description library based on traffic features;

[0036] Module M2: Obtains anomaly description information associated with network entities based on traffic logs, system logs, and monitoring information within a preset time period;

[0037] Module M3: Based on the network entity description library of traffic characteristics and the abnormal description information associated with network entities, a knowledge base for the impact surface of network entities is constructed.

[0038] Module M4: Information on network entities to be changed. A list of change plans is obtained based on the network entity impact knowledge base and the network entity description library of traffic characteristics.

[0039] Compared with the prior art, the present invention has the following beneficial effects:

[0040] 1. This invention constructs the influence surface of network entities using historical data, thereby calculating the shortest change time interval between two network entities to obtain the optimal change order among multiple network entities;

[0041] 2. Based on the optimal change order, changes that may cause the same anomalies are avoided from being released in an unreasonable order, thereby reducing the workload of troubleshooting post-change issues;

[0042] 3. Based on the optimal change order, while minimizing unreasonable change order, the system also provides a suggested minimum release interval, achieving the most reasonable arrangement of the total change work time. This avoids introducing difficulties in investigation and ensures that the change work is completed within the shortest safe time. Attached Figure Description

[0043] Other features, objects, and advantages of the present invention will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings:

[0044] Figure 1 Flowchart for planning changes to network applications.

[0045] Figure 2 Flowchart for constructing a knowledge base for the influence of network entities.

[0046] Figure 3 To generate an application change plan flowchart. Detailed Implementation

[0047] The present invention will now be described in detail with reference to specific embodiments. These embodiments will help those skilled in the art to further understand the present invention, but do not limit the invention in any way. It should be noted that those skilled in the art can make several changes and improvements without departing from the concept of the present invention. These all fall within the protection scope of the present invention.

[0048] Example 1

[0049] According to the network application change planning method provided by the present invention, such as Figures 1 to 3 As shown, it includes:

[0050] Step 1: Generate a network entity description library based on traffic features. This step takes the traffic corresponding to each network entity as input and outputs a set of traffic feature description vectors for each network entity.

[0051] Step 2: Collect anomaly information of network entities. The inputs for this step are traffic logs, system logs, monitoring information, etc., over a period of time, and the output is anomaly description information associated with the network entities.

[0052] Step 3: Construct a knowledge base for the impact surface of network entities. The input consists of a network entity description library based on traffic characteristics and network entity anomaly information; the output is knowledge about the impact surface of network entities.

[0053] Step 4: Generate application change plans based on the knowledge base and network entity traffic characteristics. Inputs include the network entity information to be changed, the network entity impact surface knowledge base, and the network entity description library based on traffic characteristics. Output is a list of change plans.

[0054] Step 1 includes the following steps:

[0055] Step 1.1: Define the network entity description method and collect relevant data to build the network entity description library. A network entity is defined in the following tuple form: (entity ID, application layer traffic digest)

[0056] The application layer traffic digest is a key-value dictionary. The keys are the application layer traffic names, such as HTTP, FTP, SMTP, POP3, Telnet, etc., and the values ​​are arrays representing the number of data packets within a recent time period (e.g., 24 / 7) at a specific time granularity (e.g., 1 hour). Each element in the array represents a statistical value for a specific time period.

[0057] {HTTP:[5298000,235222,21237,…],FTP:[5326,6987775,236789,…],…}

[0058] The array following HTTP contains 5298000, which represents the statistics of HTTP data packets sent and received in the first hour, and 235222, which represents the statistics of HTTP data packets sent and received in the second hour.

[0059] Describe the network entities within the system in the above manner, and construct a network entity description library, denoted as entity_library.

[0060] Step 2 includes the following steps:

[0061] Step 2.1: Collect network entity anomaly information. Based on traffic logs, system logs, monitoring information, etc., over a period of time, extract the network entity anomalies contained therein and construct a network entity anomaly information tuple (denoted as anomaly). The tuple can use, but is not limited to, the following format: (anomaly ID, entity ID, occurrence time unixtime).

[0062] The “abnormal ID” is composed of a tuple (“entity ID”, “abnormal type”).

[0063] The tuples described in the above form are combined to form an anomaly information description set, denoted as anomaly_set.

[0064] Step 3 includes the following steps:

[0065] Step 3.1: Anomaly set segmentation based on timeline. The samples in the anomaly_set are clustered. Specifically, the "occurrence time unixtime" is used as a feature, and Canopy clustering is used to divide them into k classes. Then, the k-means algorithm is used with k as a parameter for further clustering and optimization of the k-class effect. At this point, the anomalies in the anomaly_set are divided into k sets, each denoted as a cluster. All clusters constitute a cluster_set.

[0066] Step 3.2: Construct the impact surface record for each entity when it changes. Iterate through each entity in the entity_library and calculate the impact surface when that entity changes:

[0067] Step 3.2.1: Retrieve a record of an entity from the entity_library, denoted as entity_1. Construct an empty influence set, denoted as influence_set1;

[0068] Step 3.2.2: Iterate through each cluster in cluster_set. If an exception occurs in entity_1, find the earliest exception and denote it as anomaly1. Then, transform all exceptions that occurred after anomaly1 in that cluster and anomaly1 into a "related exception tuple" and add it to influence_set1. The "related exception tuple" has the following format: (exception id, delay time).

[0069] Wherein, the delay occurrence time = the occurrence time of the current anomaly - the occurrence time of anomaly1. If there are duplicate anomaly IDs, the delay occurrence time is the largest value among them.

[0070] Step 3.3: Summarize the influence surface records obtained in Step 3.2 to obtain the network entity influence surface knowledge base, denoted as influence_kb.

[0071] Step 4 includes the following steps:

[0072] Step 4.1: Calculate the shortest ordered change time interval between any two impact surface records in the impact surface knowledge base:

[0073] Step 4.1.1: Suppose that entities1 and entity2 have influence set records influence_set1 and influence_set2, and there is an anomaly intersection between these two records, denoted as intersect_anomaly_set;

[0074] Step 4.1.2: If the change order is entity1, entity2, then the maximum value of the "delay occurrence time" in the intersection of intersect_anomaly_set and influence_set1 is the ordered change sequence.<entity1,entity2> The shortest safe and orderly change interval is denoted as gap12;

[0075] Step 4.1.3: If the change order is entity2, entity1, then the maximum value of the "delay occurrence time" in the intersection of intersect_anomaly_set and influence_set2 is the ordered change sequence.<entity2,entity1> The shortest safe and orderly change interval is denoted as gap21;

[0076] Step 4.1.4: Based on `entity_library` and `influence_kb`, calculate the shortest safe ordered change interval between all pairs of entities. The set formed by these intervals is called the shortest safe ordered change interval set, denoted as `gap_set`. Each element in the set has the following form:

[0077] (Entity ID_1, Entity ID_2, Shortest safe and orderly change time interval)

[0078] Step 4.2: Obtain the set of entities to be changed and calculate the shortest safe release order.

[0079] Step 4.2.1: If there is an entity_x to be modified that is not included in entity_library, then obtain the "application layer traffic summary" of entity_x through local experiments, inference, etc., denoted as digist_x. Iterate through all elements in entity_library to calculate the application layer traffic summary, calculate the similarity between digist_x and each element's summary (using methods such as cosine similarity), and obtain the entity_s with the highest similarity.

[0080] Step 4.2.2: Enumerate all possible sortings of the entity to be changed, and calculate the shortest total safe change interval for each possible sorting. If sorting possibilities exist...<entity_3,entity_2,entity5> ,but:

[0081] The shortest total time interval for security changes = gap32 + gap25, where gap32 and gap25 are elements of gap_set. For example, if entity_x is not an element in entity_library, and the entity with the highest similarity to it, calculated in step 4.2.1, is entity_9, then entity_9 is used instead of entity_x for the calculation.<entity_x,entity_8> The shortest security release interval is gap98;

[0082] Step 4.2.3: Among all possible change orderings, the order with the shortest total change time interval is the optimal change order planning. The time interval between adjacent changes is determined by the corresponding value in gap_set. For example, if the adjacent change entities are entity3 and entity5 respectively, then the time interval is gap35.

[0083] According to the network application change planning system provided by the present invention, such as Figures 1 to 3 As shown, it includes:

[0084] Module 1: Generates a network entity description library based on traffic characteristics. This module takes the traffic corresponding to each network entity as input and outputs a set of traffic characteristic description vectors for each network entity.

[0085] Module 2: Collects anomaly information of network entities. This module takes as input traffic logs, system logs, monitoring information, etc., over a period of time, and outputs anomaly descriptions associated with the network entities.

[0086] Module 3: Constructing a knowledge base for the impact of network entities. Inputs include a network entity description library based on traffic characteristics and network entity anomaly information; outputs are knowledge about the impact of network entities.

[0087] Module 4: Generate application change plans based on knowledge base and network entity traffic characteristics. Inputs include network entity information to be changed, a network entity impact knowledge base, and a network entity description library based on traffic characteristics. Output is a list of change plans.

[0088] Module 1 includes the following modules:

[0089] Module 1.1: Defines methods for describing network entities, collects relevant data, and constructs a network entity description library. A network entity is defined in the following tuple format: (entity ID, application layer traffic digest).

[0090] The application layer traffic digest is a key-value dictionary. The keys are the application layer traffic names, such as HTTP, FTP, SMTP, POP3, Telnet, etc., and the values ​​are arrays representing the number of data packets within a recent time period (e.g., 24 / 7) at a specific time granularity (e.g., 1 hour). Each element in the array represents a statistical value for a specific time period.

[0091] {HTTP:[5298000,235222,21237,…],FTP:[5326,6987775,236789,…],…}

[0092] The array following HTTP contains 5298000, which represents the statistics of HTTP data packets sent and received in the first hour, and 235222, which represents the statistics of HTTP data packets sent and received in the second hour.

[0093] Describe the network entities within the system in the above manner, and construct a network entity description library, denoted as entity_library.

[0094] Module 2 includes the following modules:

[0095] Module 2.1: Collect Network Entity Anomaly Information. Based on traffic logs, system logs, monitoring information, etc., over a period of time, extract the network entity anomalies contained therein and construct a network entity anomaly information tuple (denoted as anomaly). The tuple can use, but is not limited to, the following format: (anomaly ID, entity ID, occurrence time unixtime).

[0096] The “abnormal ID” is composed of a tuple (“entity ID”, “abnormal type”).

[0097] The tuples described in the above form are combined to form an anomaly information description set, denoted as anomaly_set.

[0098] Module 3 includes the following modules:

[0099] Module 3.1: Timeline-based anomaly set segmentation. The samples in the anomaly_set are clustered. Specifically, the "occurrence time unixtime" is used as a feature, and Canopy clustering is used to divide them into k classes. Then, the k-means algorithm is used with k as a parameter for further clustering and optimization to improve the k-class effect. At this point, the anomalies in the anomaly_set are divided into k sets, each denoted as a cluster, and all clusters constitute a cluster_set.

[0100] Module 3.2: Constructing the impact surface record for each entity when it changes. Iterate through each entity in the `entity_library` and calculate the impact surface when that entity changes:

[0101] Module 3.2.1: Retrieve a record of an entity from the entity_library, denoted as entity_1. Construct an empty influence set, denoted as influence_set1;

[0102] Module 3.2.2: Iterate through each cluster in cluster_set. If an exception occurs in entity_1, find the earliest exception and denote it as anomaly1. Then, transform all exceptions occurring after anomaly1 in that cluster and anomaly1 into a "related exception tuple" and add it to influence_set1. The "related exception tuple" has the following format: (exception id, delay time).

[0103] Wherein, the delay occurrence time = the occurrence time of the current anomaly - the occurrence time of anomaly1. If there are duplicate anomaly IDs, the delay occurrence time is the largest value among them.

[0104] Module 3.3: Summarize the influence surface records obtained from Module 3.2 to obtain the network entity influence surface knowledge base, denoted as influence_kb.

[0105] Module 4 includes the following modules:

[0106] Module 4.1: Calculate the shortest ordered change time interval between any two impact surfaces in the impact surface knowledge base:

[0107] Module 4.1.1: Suppose that entities1 and entity2 have influence surface records influence_set1 and influence_set2, and there is an anomaly intersection between these two records, denoted as intersect_anomaly_set;

[0108] Module 4.1.2: If the change order is entity1, entity2, then the maximum value of the "delay occurrence time" in the intersection of intersect_anomaly_set and influence_set1 is the ordered change sequence.<entity1,entity2> The shortest safe and orderly change interval is denoted as gap12;

[0109] Module 4.1.3: If the change order is entity2, entity1, then the maximum value of the "delay occurrence time" in the intersection of intersect_anomaly_set and influence_set2 is the ordered change sequence.<entity2,entity1> The shortest safe and orderly change interval is denoted as gap21;

[0110] Module 4.1.4: Based on `entity_library` and `influence_kb`, calculate the shortest safe ordered change interval between all pairs of entities. The set formed by these intervals is called the shortest safe ordered change interval set, denoted as `gap_set`. Each element in the set has the following form:

[0111] (Entity ID_1, Entity ID_2, Shortest safe and orderly change time interval)

[0112] Module 4.2: Obtain the set of entities to be changed and calculate the shortest safe release order.

[0113] Module 4.2.1: If an entity_x to be modified is not included in entity_library, its "application layer traffic summary" is obtained through local experiments, inference, etc., and denoted as digist_x. The application layer traffic summaries of all elements in entity_library are calculated, and the similarity between digist_x and each element's summary is calculated (using methods such as cosine similarity). The entity_s with the highest similarity is obtained.

[0114] Module 4.2.2: Enumerate all possible sortings of the entity to be changed, and calculate the shortest total safe change interval for each possible sorting. If sorting possibilities exist...<entity_3,entity_2,entity5> ,but:

[0115] The shortest total time interval for security changes = gap32 + gap25, where gap32 and gap25 are elements of gap_set. For example, if entity_x is not an element in entity_library, and module 4.2.1 calculates that the entity with the highest similarity to it is entity_9, then entity_9 is used instead of entity_x for the calculation.<entity_x,entity_8> The shortest security release interval is gap98;

[0116] Module 4.2.3: Among all possible change orderings, the order with the shortest total change time interval is the optimal change order planning. The time interval between adjacent changes is determined by the corresponding value in gap_set. For example, if the adjacent change entities are entity3 and entity5 respectively, then the time interval is gap35.

[0117] Those skilled in the art will understand that, in addition to implementing the system, apparatus, and their modules provided by this invention in purely computer-readable program code, the same program can be implemented in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, the system, apparatus, and their modules provided by this invention can be considered a hardware component, and the modules included therein for implementing various programs can also be considered structures within the hardware component; alternatively, modules for implementing various functions can be considered both software programs implementing the method and structures within the hardware component.

[0118] Specific embodiments of the present invention have been described above. It should be understood that the present invention is not limited to the specific embodiments described above, and those skilled in the art can make various changes or modifications within the scope of the claims, which do not affect the essence of the present invention. Unless otherwise specified, the embodiments and features described in this application can be arbitrarily combined with each other.

Claims

1. A method for planning changes in network applications, characterized in that, include: Step S1: Obtain a set of traffic feature description vectors for each network entity based on the traffic corresponding to each network entity, and generate a network entity description library based on traffic features; Step S2: Obtain anomaly description information associated with network entities based on traffic logs, system logs, and monitoring information within a preset time period; Step S3: Construct a network entity impact surface knowledge base based on the network entity description library of traffic characteristics and the anomaly description information associated with network entities; Step S4: Obtain a list of change plans for the network entities to be changed based on the network entity impact knowledge base and the network entity description database of traffic characteristics; Step S4.1: Calculate the shortest ordered change time interval between every pair of influence surface records in the influence surface knowledge base; Step S4.2.2: Enumerate all possible sortings of the entity to be changed, and calculate the shortest total safe change time interval for each possible sorting; Step S4.2.3: Among all possible change orderings, the order with the shortest total change time interval is the optimal change ordering plan. The time interval between adjacent changes is determined by the corresponding value in gap_set, which is the set of shortest safe and ordered change time intervals.

2. The network application change planning method according to claim 1, characterized in that, Step S1 involves defining network entities as (entity ID, application layer traffic digest), collecting relevant data, and constructing a network entity description library (entity_library). The application layer traffic summary is a key-value dictionary, where the key is the application layer traffic name and the value is an array of data packets with a preset time granularity within a preset time period.

3. The network application change planning method according to claim 1, characterized in that, Step S2 involves: extracting network entity anomaly information based on traffic logs, system logs, and monitoring information within a preset time period, and constructing a network entity anomaly information tuple (anomaly); and summarizing the network entity anomaly information tuples (anomaly) to form an anomaly information description set (anomaly_set).

4. The network application change planning method according to claim 1, characterized in that, Step S3 employs the following: Step S3.1: Cluster the samples in the anomaly information description set anomaly_set, and divide the anomalies in the anomaly information description set anomaly_set into k sets, where each set is denoted as cluster, and all clusters constitute a cluster_set; Step S3.2: Calculate the impact surface of entity changes based on the clustered traversal network entity description library (entity_library) and cluster_set; Step S3.3: Summarize the impact surfaces of all entity changes to obtain the network entity impact surface knowledge base influence_kb.

5. The network application change planning method according to claim 4, characterized in that, Step S3.1 involves using the occurrence time (unixtime) of the network entity anomaly information tuple (anomaly id, entity id, occurrence time unixtime) as a feature, clustering it into k classes using Canopy clustering, and then using the k-means algorithm with k as a parameter for further clustering and optimization of the k-class effect; the anomalies in anomaly_set are divided into k sets, each set is denoted as cluster, and all clusters constitute a cluster_set.

6. The network application change planning method according to claim 5, characterized in that, Step S3.2 adopts the following: Step S3.2.1: Obtain a record of an entity from the entity_library, denoted as entity1; construct an empty influence set, denoted as influence_set1; Step S3.2.2: Traverse each cluster in cluster_set. If there is an exception that occurred in entity1, find the earliest exception and denote it as anomaly1. Then, transform all exceptions that occurred after anomaly1 in the cluster and anomaly1 into related exception tuples and add them to influence_set1. The form of the related exception tuple is: (exception id, delay time); where the delay time = the occurrence time of the current anomaly - the occurrence time of anomaly1. If there are duplicate exception ids, the delay time is taken as the largest value.

7. The network application change planning method according to claim 6, characterized in that, Step S4 employs the following: Step S4.2: Obtain the set of entities to be changed and calculate the shortest safe release order.

8. The network application change planning method according to claim 7, characterized in that, Step S4.1 adopts the following: Step S4.1.1: Suppose that entities1 and entity2 have influence surface records influence_set1 and influence_set2, and there is an anomaly intersection between these two records, denoted as intersect_anomaly_set; Step S4.1.2: If the change order is entity1, entity2, then the maximum delay time in the intersection of intersect_anomaly_set and influence_set1 is the ordered change sequence.<entity1,entity2> The shortest safe and orderly change interval is denoted as gap12; Step S4.1.3: If the change order is entity2, entity1, then the maximum delay time in the intersection of intersect_anomaly_set and influence_set2 is the ordered change sequence.<entity2,entity1> The shortest safe and orderly change interval is denoted as gap21; Step S4.1.4: Calculate the shortest safe and ordered change interval between all pairs of entities based on entity_library and influence_kb. The set formed by these intervals is the shortest safe and ordered change interval set, denoted as gap_set.

9. The network application change planning method according to claim 8, characterized in that, Step S4.2 adopts the following: Step S4.2.1: If there is an entity_x to be changed that is not included in entity_library, then obtain the application layer traffic summary of entity_x through local experimentation and speculation, denoted as digist_x; traverse and calculate the application layer traffic summary of all elements in entity_library, calculate the similarity between digist_x and the summaries of each element, and obtain the entity_s with the highest similarity.

10. A network application change planning system, characterized in that, include: Module M1: Obtains a set of traffic feature description vectors for each network entity based on the traffic corresponding to that network entity, and generates a network entity description library based on traffic features; Module M2: Obtains anomaly description information associated with network entities based on traffic logs, system logs, and monitoring information within a preset time period; Module M3: Based on the network entity description library of traffic characteristics and the abnormal description information associated with network entities, a knowledge base for the impact surface of network entities is constructed. Module M4: Information on network entities to be changed. A list of change plans is obtained based on the network entity impact knowledge base and the network entity description library of traffic characteristics. Module M4.1: Calculates the shortest ordered change time interval between every pair of impact surface records in the impact surface knowledge base; Module M4.2.2: Enumerate all possible sortings of the entity to be changed and calculate the shortest total safe change interval for each possible sorting; Module M4.2.3: Among all possible change orderings, the order with the shortest total change time interval is the optimal change ordering plan. The time interval between adjacent changes is determined by the corresponding value in gap_set, which is the set of shortest safe and ordered change time intervals.

Images