Abnormality detection method and device

Abstract

The application provides an application anomaly detection method and device, and particularly relates to the field of big data.The method comprises the following steps: determining a normal call chain and an abnormal call chain based on abnormal stack information and a preset error code, and determining a positive call frequency and a negative call frequency; determining an overall anomaly rate and a method anomaly rate based on the positive call frequency and the negative call frequency, and obtaining an anomaly weight threshold based on the overall anomaly rate, the method anomaly rate, the positive call frequency and the negative call frequency; determining a target frequency of a plurality of method types of methods being called by a target call chain, and judging whether the target call chain has an abnormal risk based on the target frequency, the method anomaly rate and the anomaly weight threshold; and if yes, an alarm is given.The application can improve the speed and accuracy of application anomaly detection, reduce the cost of application anomaly detection, and thus improve the efficiency of application anomaly detection.

Description

Technical Field

[0001] This invention relates to the field of application development technology, particularly to the field of big data, and especially to an application anomaly detection method and apparatus. Background Technology

[0002] In the overall development process of an application, in order to reduce application errors and improve application quality and user experience, application anomaly detection is often involved. In existing technologies, the main method of application anomaly detection involves relevant personnel reviewing and examining the relevant code of the target application to identify risk points within the code, thus completing the detection. After identifying the risk points in the code, relevant personnel can notify the developers, enabling them to rectify the corresponding locations in the application code.

[0003] However, the aforementioned methods of application anomaly detection are time-consuming due to their reliance on manual labor, resulting in slow detection speeds. Furthermore, the accuracy of manual detection is related to the experience and ability of the personnel, and oversights are inevitable when inspecting massive amounts of code, leading to lower accuracy. Additionally, the significant manpower required results in high costs associated with application anomaly detection.

[0004] In summary, existing technologies suffer from slow speed, low accuracy, and high cost in anomaly detection, which hinders the improvement of anomaly detection efficiency. Summary of the Invention

[0005] One object of this invention is to provide an application anomaly detection method to address the problems of slow speed, low accuracy, and high cost in existing application anomaly detection technologies, which hinder the improvement of application anomaly detection efficiency. Another object of this invention is to provide an application anomaly detection device. A further object of this invention is to provide a computer device. A still other object of this invention is to provide a readable medium.

[0006] To achieve the above objectives, one aspect of the present invention discloses an application anomaly detection method, the method comprising:

[0007] Based on the exception stack information and the preset error code, multiple normal call chains and multiple exception call chains in the reference call chain are identified, and the number of positive calls and the number of negative calls of methods of multiple method types in each of the normal call chains are determined.

[0008] Based on the corresponding number of positive calls and the number of negative calls, the overall anomaly rate and the method anomaly rate corresponding to the method type are determined, and based on the overall anomaly rate, the method anomaly rate, the number of positive calls and the number of negative calls, the corresponding anomaly weight threshold is obtained.

[0009] Determine the target number of times that multiple methods of the aforementioned method type are called by the target call chain of the target application, and based on the target number of times, the corresponding method anomaly rate, and the anomaly weight threshold, determine whether there is an anomaly risk in the target call chain. If so, issue a corresponding alarm.

[0010] Optionally, it may further include:

[0011] Before determining multiple normal call chains and multiple abnormal call chains in the reference call chain based on the exception stack information and preset error codes.

[0012] Based on historical application code, multiple historical call chains are obtained, and based on the latest running time point corresponding to the historical call chain and the preset sample time period, multiple call chains to be processed are determined from the historical call chains.

[0013] Determine the method package name corresponding to each method in the pending call chain, and based on the preset original method package name format and the corresponding method package name, determine the original method in the pending call chain method of the pending call chain;

[0014] Based on the original methods in the call chain to be processed, the corresponding reference call chain is determined.

[0015] Optionally, determining the original methods in the call chain methods to be processed based on a preset original method package name format and the corresponding method package name includes:

[0016] Based on the original method package name format, determine the corresponding original method package name prefix information;

[0017] Determine the method package name prefix information corresponding to the method package name;

[0018] Determine whether the method package name prefix information corresponding to the method in the call chain to be processed matches the original method package name prefix information. If so, determine the corresponding method in the call chain to be processed as the original method.

[0019] Optionally, determining the corresponding reference call chain based on the original method in the call chain to be processed includes:

[0020] The original method level corresponding to the original method in the call chain to be processed is determined, and the call chain method of the next level after the lowest original method level is taken as the corresponding reference call chain termination method, wherein multiple original method levels are sequentially adjacent;

[0021] Based on the reference call chain termination method and the corresponding start method in the call chain to be processed, the corresponding call chain to be processed is intercepted to obtain the corresponding reference call chain, wherein the start method in the call chain to be processed is an original method.

[0022] Optionally, determining multiple normal call chains and multiple abnormal call chains in the reference call chain based on exception stack information and preset error codes includes:

[0023] Determine multiple reference call chain methods in the reference call chain;

[0024] Determine whether the reference call chain satisfies the condition that there is a reference call chain method with corresponding exception stack information or a reference call chain method including the error code in the reference call chain. If so, determine the corresponding reference call chain as the exception call chain.

[0025] Other reference call chains besides the abnormal call chain are identified as the normal call chains.

[0026] Optionally, determining the number of positive calls to methods of multiple method types in each normal call chain and the number of negative calls to methods of multiple method types in each abnormal call chain includes:

[0027] Identify multiple normal call chain methods in the normal call chain, and identify multiple abnormal call chain methods in the abnormal call chain;

[0028] The number of normal call chain methods corresponding to the method type in the normal call chain is determined as the corresponding positive call count, and the number of abnormal call chain methods corresponding to the method type in the abnormal call chain is determined as the corresponding negative call count.

[0029] Optionally, it may further include:

[0030] Before determining the number of normal call chain methods corresponding to the method type in the normal call chain as the corresponding positive call count, and determining the number of abnormal call chain methods corresponding to the method type in the abnormal call chain as the corresponding negative call count...

[0031] Determine the reference package name, reference class name, reference method name, and reference parameter type corresponding to the method type;

[0032] Determine the package name, class name, name, and parameter types of the normal call chain method corresponding to the normal call chain method;

[0033] Determine the package name, class name, name, and parameter types of the exception call chain method corresponding to the exception call chain method.

[0034] Determine whether the normal call chain method satisfies the following conditions: the normal call chain method package name matches the reference package name, the normal call chain method class name matches the reference class name, the normal call chain method name matches the reference method name, and the normal call chain method input parameter type matches the reference input parameter type. If so, determine the normal call chain method as the normal call chain method corresponding to the method type.

[0035] Determine whether the exception call chain method satisfies the following conditions: the package name of the exception call chain method matches the reference package name, the class name of the exception call chain method matches the reference class name, the name of the exception call chain method matches the reference method name, and the input parameter type of the exception call chain method matches the reference input parameter type. If so, determine the exception call chain method as the exception call chain method corresponding to the method type.

[0036] Optionally, based on the corresponding number of positive calls and the number of negative calls, the overall anomaly rate is determined, including:

[0037] The total number of methods in the exception call chain is obtained by summing the negative call counts corresponding to each of the above method types.

[0038] The total number of abnormal call chain methods and the number of positive calls for each normal call chain corresponding to each method type are added together to obtain the total number of reference call chain methods.

[0039] The overall exception rate is determined by dividing the total number of methods in the exception call chain by the total number of methods in the reference call chain.

[0040] Optionally, based on the corresponding number of positive calls and the number of negative calls, the method exception rate corresponding to the method type is determined, including:

[0041] The cumulative negative call counts corresponding to the method type are summed to obtain the cumulative negative call counts corresponding to the method type.

[0042] The cumulative negative call count is added together with the multiple positive call counts corresponding to the method type to obtain the cumulative call count corresponding to the method type;

[0043] Divide the cumulative number of negative calls corresponding to the method type by the cumulative number of calls to obtain the corresponding method anomaly rate.

[0044] Optionally, the step of obtaining the corresponding anomaly weight threshold based on the overall anomaly rate, method anomaly rate, positive call count, and negative call count includes:

[0045] Based on the method's anomaly rate and the overall anomaly rate, the corresponding overall deviation coefficient is obtained;

[0046] Based on the number of positive calls to multiple method types corresponding to the normal call chain and the method anomaly rate of the method type corresponding to the normal call chain, the risk weight of the normal call chain is obtained; based on the number of negative calls to multiple method types corresponding to the abnormal call chain and the method anomaly rate of the method type corresponding to the abnormal call chain, the risk weight of the abnormal call chain is obtained.

[0047] Based on the overall deviation coefficient, the overall anomaly rate, the risk weights of the normal call chains corresponding to the multiple normal call chains, and the risk weights of the abnormal call chains corresponding to the multiple abnormal call chains, the corresponding anomaly weight thresholds are obtained.

[0048] Optionally, obtaining the corresponding overall deviation coefficient based on the method's anomaly rate and the overall anomaly rate includes:

[0049] The absolute value of the difference between the method anomaly rate corresponding to the method type and the overall anomaly rate is used as the sub-deviation coefficient corresponding to the method type.

[0050] The sub-deviation coefficients corresponding to multiple method types are summed to obtain the total sub-deviation coefficients.

[0051] The overall deviation coefficient is obtained based on the sum of the sub-deviation coefficients and the number of method types.

[0052] Optionally, the step of obtaining the normal call chain risk weight corresponding to the normal call chain based on the number of positive calls to multiple method types corresponding to the normal call chain and the method anomalous rate of the method type corresponding to the normal call chain includes:

[0053] Multiply the number of positive calls to the method type corresponding to the normal call chain by the method anomaly rate corresponding to the method type to obtain the normal call chain sub-risk parameter of the normal call chain corresponding to the method type.

[0054] The risk parameters of the normal call chain sub-risk parameters corresponding to multiple method types of the normal call chain are superimposed to obtain the normal call chain risk parameters corresponding to the normal call chain.

[0055] The number of positive calls corresponding to multiple method types in the normal call chain is summed to obtain the number of normal call chain methods in the normal call chain;

[0056] Divide the normal call chain risk parameter by the number of normal call chain methods to obtain the normal call chain risk weight corresponding to the normal call chain.

[0057] Optionally, the step of obtaining the abnormal call chain risk weight corresponding to the abnormal call chain based on the number of negative calls to multiple method types corresponding to the abnormal call chain and the method abnormality rate of the method type corresponding to the abnormal call chain includes:

[0058] Multiply the number of negative calls corresponding to the method type in the abnormal call chain by the method anomaly rate corresponding to the method type to obtain the sub-risk parameter of the abnormal call chain corresponding to the method type in the abnormal call chain.

[0059] The abnormal call chain risk parameters corresponding to multiple method types of the abnormal call chain are superimposed to obtain the abnormal call chain risk parameters corresponding to the abnormal call chain.

[0060] The number of exception calls corresponding to multiple method types in the exception call chain is summed to obtain the number of exception call chain methods in the exception call chain.

[0061] Divide the abnormal call chain risk parameter by the number of abnormal call chain methods to obtain the abnormal call chain risk weight corresponding to the abnormal call chain.

[0062] Optionally, obtaining the corresponding anomaly weight threshold based on the overall deviation coefficient, the overall anomaly rate, the risk weights of the normal call chains corresponding to the multiple normal call chains, and the risk weights of the abnormal call chains corresponding to the multiple abnormal call chains includes:

[0063] Based on the preset correction coefficient and the overall deviation coefficient, the historical risk level correction weight is obtained;

[0064] Based on the risk weights of the normal call chains corresponding to the multiple normal call chains and the risk weights of the abnormal call chains corresponding to the multiple abnormal call chains, the corresponding relative risk weights are obtained.

[0065] Based on the historical risk level correction weight, relative risk weight, and overall anomaly rate, the corresponding anomaly weight threshold is obtained.

[0066] Optionally, the step of obtaining the corresponding relative risk weight based on the risk weights of the normal call chains corresponding to the multiple normal call chains and the risk weights of the abnormal call chains corresponding to the multiple abnormal call chains includes:

[0067] The risk weights of multiple normal call chains and multiple abnormal call chains are superimposed to obtain the total call chain risk weight. The total call chain risk weight is then divided by the number of reference call chains to obtain the average call chain risk weight.

[0068] The corresponding relative risk weight is obtained based on the absolute value of the difference between the risk weight of each normal call chain and the risk weight of the average call chain, and the absolute value of the difference between the risk weight of each abnormal call chain and the risk weight of the average call chain.

[0069] Optionally, determining whether the target call chain has anomaly risk based on the target number of times, the corresponding method anomaly rate, and the anomaly weight threshold includes:

[0070] Multiply the number of times the target call chain corresponds to the method type by the method exception rate corresponding to the method type to obtain the target call chain sub-risk parameter of the target call chain corresponding to the method type.

[0071] The target call chain risk parameters corresponding to the target call chain of multiple method types are superimposed to obtain the target call chain risk parameters corresponding to the target call chain.

[0072] The number of target calls for the target call chain corresponding to the multiple method types in the target call chain is summed to obtain the number of target call chain methods in the target call chain.

[0073] Divide the target call chain risk parameter by the number of methods in the target call chain to obtain the target call chain anomaly weight corresponding to the target call chain;

[0074] Determine whether the abnormal weight of the target call chain is greater than the abnormal weight threshold. If so, issue a corresponding alarm.

[0075] To achieve the above objectives, another aspect of the present invention discloses an application anomaly detection device, the device comprising:

[0076] The historical call chain parsing module is used to determine multiple normal call chains and multiple abnormal call chains in the reference call chain based on exception stack information and preset error codes, and to determine the number of positive calls and the number of negative calls of methods of multiple method types in each of the normal call chains.

[0077] The anomaly weight threshold determination module is used to determine the overall anomaly rate and the method anomaly rate corresponding to the method type based on the corresponding positive call count and negative call count, and to obtain the corresponding anomaly weight threshold based on the overall anomaly rate, method anomaly rate, positive call count and negative call count;

[0078] An anomaly detection module is used to determine the target number of times that multiple methods of the aforementioned method type are called by the target call chain of the target application, and based on the target number of times, the corresponding method anomaly rate, and the anomaly weight threshold, to determine whether there is an anomaly risk in the target call chain. If so, a corresponding alarm is issued.

[0079] The present invention also discloses a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method described above.

[0080] The present invention also discloses a computer-readable medium having a computer program stored thereon, which, when executed by a processor, implements the method described above.

[0081] The application anomaly detection method and apparatus provided by this invention, based on anomaly stack information and preset error codes, determines multiple normal call chains and multiple abnormal call chains in a reference call chain, and determines the number of positive calls and negative calls of methods of multiple method types in each of the normal call chains. This comprehensively and accurately determines the normal and abnormal call chains used as reference, and quickly and accurately determines the number of times different methods are called in call chains of different natures, thereby improving the speed and accuracy of determining the anomaly weight threshold, and thus improving the overall speed and accuracy of application anomaly detection. By determining the overall anomaly rate and the method anomaly rate corresponding to the method type based on the corresponding positive and negative call counts, and obtaining the corresponding anomaly weight threshold based on the overall anomaly rate, method anomaly rate, positive call count, and negative call count, this method fully considers the relationship between the anomaly situation of the corresponding method in the code and the frequency and ratio of its occurrence in abnormal and normal call chains, and fully considers the correlation of call chains (if a call chain has anomalies, its corresponding methods at different levels will also be more or less affected), thus associating the anomaly weight threshold with the historical anomalies of different types of methods. This approach helps ensure that the anomaly weight threshold is fully aligned with the overall anomaly level of the existing application code used as a reference. Since the existing application code has often undergone relevant verification and reached a level suitable for formal production use, the anomaly weight threshold determined in the above steps can match the upper limit of acceptable call chain anomalies during application development. This results in a high accuracy of the determined anomaly weight threshold, thereby improving the overall accuracy of application anomaly detection. By determining the target number of times that methods of multiple method types are called by the target call chain of the target application, and based on the target number of times, the corresponding method anomaly rate, and the anomaly weight threshold, it is determined whether the target call chain has anomaly risks. If so, a corresponding alarm is issued. This approach uses the method call type, number of times, and anomaly rate of the corresponding call chain in the target application as the basis, and the highly accurate anomaly weight threshold as the judgment standard. Through simple processing, it achieves fast and accurate anomaly detection of the corresponding call chain of the target application. Refining the granularity of application anomaly detection to the detection of specific call chains (call chains, to some extent, represent different components of the application) can also improve the accuracy of application anomaly detection and make it easier to locate relevant risk points in the target application, thereby improving the speed and accuracy of overall application anomaly detection.

[0082] The application anomaly detection method and apparatus provided by this invention can be automated in the form of software, applications, programs, systems or algorithms, thereby greatly reducing the reliance on manual labor, thus reducing the corresponding processing time, error rate and human resource costs. Therefore, it significantly improves the speed and accuracy of application anomaly detection as a whole, and significantly reduces the cost of application anomaly detection.

[0083] In summary, the application anomaly detection method and apparatus provided by the present invention can improve the speed and accuracy of application anomaly detection and reduce the cost of application anomaly detection, thereby improving the efficiency of application anomaly detection. Attached Figure Description

[0084] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0085] Figure 1 A flowchart illustrating an application anomaly detection method according to an embodiment of the present invention is shown;

[0086] Figure 2 The diagram illustrates an optional step in determining normal and abnormal call chains according to an embodiment of the present invention.

[0087] Figure 3 A schematic diagram illustrating an optional step in determining the number of positive calls and the number of negative calls according to an embodiment of the present invention is shown.

[0088] Figure 4 A schematic diagram illustrating an optional step in determining an anomaly weight threshold according to an embodiment of the present invention is shown;

[0089] Figure 5 A schematic diagram illustrating an optional anomaly detection step according to an embodiment of the present invention is shown;

[0090] Figure 6 A schematic diagram of a module of an application anomaly detection device according to an embodiment of the present invention is shown;

[0091] Figure 7 A schematic diagram of a computer device suitable for implementing embodiments of the present invention is shown. Detailed Implementation

[0092] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0093] The terms "first," "second," etc., used in this document do not specifically refer to any order or sequence, nor are they intended to limit the invention; they are merely used to distinguish elements or operations described using the same technical terms.

[0094] The terms “include,” “including,” “have,” “contain,” etc., used in this article are all open-ended terms, meaning that they include but are not limited to.

[0095] The term "and / or" as used herein includes any or all of the things mentioned.

[0096] It should be noted that the acquisition, storage, use, and processing of data in the technical solution of this invention all comply with the relevant provisions of national laws and regulations.

[0097] It should be noted that the application anomaly detection method and apparatus disclosed in this application can be used in the field of big data, or in any field other than big data. The application field of the application anomaly detection method and apparatus disclosed in this application is not limited.

[0098] This invention discloses an application anomaly detection method, such as... Figure 1 As shown, the method specifically includes the following steps:

[0099] S101: Based on the exception stack information and the preset error code, determine multiple normal call chains and multiple exception call chains in the reference call chain, and determine the number of positive calls of multiple method types to each of the normal call chains and the number of negative calls of multiple method types to each of the exception call chains.

[0100] S102: Based on the corresponding number of positive calls and the number of negative calls, determine the overall anomaly rate and the method anomaly rate corresponding to the method type, and based on the overall anomaly rate, the method anomaly rate, the number of positive calls and the number of negative calls, obtain the corresponding anomaly weight threshold.

[0101] S103: Determine the target number of times that multiple methods of the aforementioned method type are called by the target call chain of the target application, and based on the target number of times, the corresponding method anomaly rate, and the anomaly weight threshold, determine whether there is an anomaly risk in the target call chain. If so, issue a corresponding alarm.

[0102] For example, the target application can be, but is not limited to, the current application to be inspected that has completed preliminary development or has not completed preliminary development. It should be noted that the nature of the target application can be determined by those skilled in the art based on the actual situation; the above description is merely an example and does not constitute a limitation. One target application may correspond to multiple target call chains.

[0103] For example, the call chain in the embodiments of the present invention can be a method call chain.

[0104] For example, determining the target number of times that methods of multiple method types are called by the target call chain of the target application can be, but is not limited to, determining the corresponding target number by parsing the target call chain through relevant programs, software, or tools. Each target number corresponds to one method type and one target call chain. The target call chain can be directly obtained by parsing the target application through, but is not limited to, built-in functional modules of the corresponding development environment, relevant programs, software, or tools. It should be noted that the specific implementation method for determining the target number of times methods of multiple method types are called by the target call chain of the target application, and the method for obtaining the target call chain, can be determined by those skilled in the art based on the actual situation. The above description is merely an example and does not constitute a limitation.

[0105] Preferably, the target call chain can also be, but is not limited to, a target call chain obtained by intercepting the call chain of the acquired target application. Specifically, after obtaining the call chain of the target application, the highest-level method among all methods in the call chain can be set as the starting interception method, and then the highest-level method among methods developed outside the current project or outside the current unit (such as a company or development team) in the call chain can be set as the ending interception method. Then, the corresponding target call chain is obtained by interception (the highest-level method in the target call chain is the aforementioned starting interception method, and the lowest-level method is the aforementioned ending interception method). For example, the complete call chain of the target application is A→B→C→D→E (A, B, C, D, and E represent methods at different levels, with A being the highest level method, which can be understood as A calling but not limited to B, B calling but not limited to C, C calling but not limited to D, and D calling but not limited to E). A, B, and C are methods developed in the current project or unit, while D and E are existing conventional methods (i.e., methods not developed in the current project or unit). Among the methods not developed in the current project or unit, the highest level method is D. Then, by performing corresponding interception, the corresponding target call chain is A→B→C→D. In a complete call chain, the original methods developed by the current project or unit are generally at the highest level and adjacent to each other in the call chain, while the conventional methods developed by other projects or units are generally at the lowest level and adjacent to each other in the call chain. It is almost impossible for a conventional method level to be interspersed between several levels of original methods developed by the current project or unit, or for an original method level to be interspersed between several levels of conventional methods developed by other projects or units (for example, in the call chain A→B→C→D→E, A, B, and C are the highest and adjacent levels of original methods, and D and E are the lowest and adjacent levels of conventional methods. This can be simply understood as original methods being at a higher level in the call chain, and non-original conventional methods being at a lower level). This is because in actual development, self-designed methods often need to call relatively low-level conventional methods or other self-developed methods, and conventional methods almost never call self-designed methods, but may call other lower-level conventional methods. It should be noted that the preprocessing methods and specific rules of the target call chain can be determined by those skilled in the art based on the actual situation. The above description is only an example and does not constitute a limitation.

[0106] The application anomaly detection method and apparatus provided by this invention, based on anomaly stack information and preset error codes, determines multiple normal call chains and multiple abnormal call chains in a reference call chain, and determines the number of positive calls and negative calls of methods of multiple method types in each of the normal call chains. This comprehensively and accurately determines the normal and abnormal call chains used as reference, and quickly and accurately determines the number of times different methods are called in call chains of different natures, thereby improving the speed and accuracy of determining the anomaly weight threshold, and thus improving the overall speed and accuracy of application anomaly detection. By determining the overall anomaly rate and the method anomaly rate corresponding to the method type based on the corresponding positive and negative call counts, and obtaining the corresponding anomaly weight threshold based on the overall anomaly rate, method anomaly rate, positive call count, and negative call count, this method fully considers the relationship between the anomaly situation of the corresponding method in the code and the frequency and ratio of its occurrence in abnormal and normal call chains, and fully considers the correlation of call chains (if a call chain has anomalies, its corresponding methods at different levels will also be more or less affected), thus associating the anomaly weight threshold with the historical anomalies of different types of methods. This approach helps ensure that the anomaly weight threshold is fully aligned with the overall anomaly level of the existing application code used as a reference. Since the existing application code has often undergone relevant verification and reached a level suitable for formal production use, the anomaly weight threshold determined in the above steps can match the upper limit of acceptable call chain anomalies during application development. This results in a high accuracy of the determined anomaly weight threshold, thereby improving the overall accuracy of application anomaly detection. By determining the target number of times that methods of multiple method types are called by the target call chain of the target application, and based on the target number of times, the corresponding method anomaly rate, and the anomaly weight threshold, it is determined whether the target call chain has anomaly risks. If so, a corresponding alarm is issued. This approach uses the method call type, number of times, and anomaly rate of the corresponding call chain in the target application as the basis, and the highly accurate anomaly weight threshold as the judgment standard. Through simple processing, it achieves fast and accurate anomaly detection of the corresponding call chain of the target application. Refining the granularity of application anomaly detection to the detection of specific call chains (call chains, to some extent, represent different components of the application) can also improve the accuracy of application anomaly detection and make it easier to locate relevant risk points in the target application, thereby improving the speed and accuracy of overall application anomaly detection.

[0107] The application anomaly detection method and apparatus provided by this invention can be automated in the form of software, applications, programs, systems or algorithms, thereby greatly reducing the reliance on manual labor, thus reducing the corresponding processing time, error rate and human resource costs. Therefore, it significantly improves the speed and accuracy of application anomaly detection as a whole, and significantly reduces the cost of application anomaly detection.

[0108] In summary, the application anomaly detection method and apparatus provided by the present invention can improve the speed and accuracy of application anomaly detection and reduce the cost of application anomaly detection, thereby improving the efficiency of application anomaly detection.

[0109] In an optional implementation, it further includes:

[0110] Before determining multiple normal call chains and multiple abnormal call chains in the reference call chain based on the exception stack information and preset error codes.

[0111] Based on historical application code, multiple historical call chains are obtained, and based on the latest running time point corresponding to the historical call chain and the preset sample time period, multiple call chains to be processed are determined from the historical call chains.

[0112] Determine the method package name corresponding to each method in the pending call chain, and based on the preset original method package name format and the corresponding method package name, determine the original method in the pending call chain method of the pending call chain;

[0113] Based on the original methods in the call chain to be processed, the corresponding reference call chain is determined.

[0114] For example, the historical application code can be, but is not limited to, existing application code that has been put into actual use and production by the current unit (e.g., a company or development team) or the current application project. It should be noted that the specific scope and nature of the historical application code can be determined by those skilled in the art based on the actual situation; the above description is merely an example and does not constitute a limitation.

[0115] For example, obtaining multiple historical call chains based on historical application code can be achieved, but is not limited to, directly obtaining multiple historical call chains by parsing the historical application code using built-in functional modules, related programs, software, or tools within the corresponding development environment. It should be noted that the specific implementation method for obtaining multiple historical call chains based on historical application code can be determined by those skilled in the art based on the actual situation; the above description is merely an example and does not constitute a limitation.

[0116] For example, determining multiple pending call chains from the historical call chain based on the latest execution time point corresponding to the historical call chain and a preset sample time period can be, but is not limited to, determining the historical call chains whose latest execution time point falls within the sample time period as the corresponding pending call chains. The latest execution time point can be, but is not limited to, the time point of the last execution of the historical call chain, and can be determined using, but is not limited to, existing call chain analysis methods. The sample time period can be, but is not limited to, a specific historical time period. The specific characteristics of this historical time period can be, but is not limited to, a time period whose start time point is not too far from the current time and whose end time point is more than a certain duration from the current time. For example, the sample time period can be, but is not limited to, a time period from, but is not limited to, a time period from, four years ago to, one year ago. It should be noted that the specific implementation method, the nature and determination method of the latest execution time point, and the nature and specific value of the sample time period for determining multiple pending call chains from the historical call chain based on the latest execution time point corresponding to the historical call chain and the preset sample time period can be determined by those skilled in the art based on the actual situation. The above description is merely an example and does not constitute a limitation.

[0117] For example, determining the package name corresponding to each method in the pending call chain can be, but is not limited to, performing relevant parsing to determine the package name of the package to which each method belongs (specifically, it can be, but is not limited to, the package name of the package to which the class corresponding to the method belongs). Here, the pending call chain method refers to the methods included in the pending call chain; one pending call chain corresponds to multiple pending call chain methods, and each pending call chain method corresponds to the package name of its respective package. It should be noted that the specific implementation method and the nature of the package name for determining the package name corresponding to each method in the pending call chain can be determined by those skilled in the art based on the actual situation. The above description is merely an example and does not constitute a limitation.

[0118] Through the above steps, the reference call chain can be made to be a mature, deployed, and outdated call chain, primarily covering self-designed or modified methods (non-original methods are relatively existing conventional methods and do not need to be considered as references for determining anomaly thresholds, thus reducing their interference with the overall detection process. This is because the basis and focus of detection are mainly on the self-designed relevant code parts; conventional existing methods are already mature and reliable and therefore do not need to be considered). This improves the reliability and accuracy of the subsequently obtained anomaly weight thresholds, reduces the impact of unimportant and interfering data on the overall process, and decreases the corresponding data processing volume. It also increases the speed of obtaining the anomaly weight thresholds, thereby improving the overall accuracy and speed of anomaly detection.

[0119] In an optional implementation, determining the original methods in the call chain methods to be processed based on a preset original method package name format and the corresponding method package name includes:

[0120] Based on the original method package name format, determine the corresponding original method package name prefix information;

[0121] Determine the method package name prefix information corresponding to the method package name;

[0122] Determine whether the method package name prefix information corresponding to the method in the call chain to be processed matches the original method package name prefix information. If so, determine the corresponding method in the call chain to be processed as the original method.

[0123] For example, the original method package name format refers to the package name format information of the original package to which the method designed during the development process belongs (this package can also be designed and encapsulated by the developer, specifically it can be, but is not limited to, the package to which the class corresponding to the self-designed method belongs) is determined in advance based on the relevant application development situation, development requirements, and development policies. It should be noted that the nature and source of the original method package name format can be determined by those skilled in the art based on the actual situation, and the above description is only an example and does not constitute a limitation.

[0124] For example, determining the corresponding original method package name prefix information based on the original method package name format can be, but is not limited to, parsing the original method package name format to obtain the original method package name prefix information corresponding to or included in the original method package name format. For example, if the original method package name format is "abc.xxx", then the corresponding original method package name prefix information is "abc". It should be noted that the specific implementation method for determining the corresponding original method package name prefix information based on the original method package name format can be determined by those skilled in the art according to the actual situation. The above description is only an example and does not constitute a limitation.

[0125] For example, determining the method package name prefix information corresponding to the method package name can be, but is not limited to, parsing the method package name to determine the method package name including or corresponding method package name prefix information. It should be noted that the specific implementation method for determining the method package name prefix information corresponding to the method package name can be determined by those skilled in the art based on the actual situation; the above description is merely an example and does not constitute a limitation.

[0126] For example, determining whether the method package name prefix information corresponding to the method in the call chain to be processed matches the original method package name prefix information can be, but is not limited to, determining whether the method package name prefix information corresponding to the method in the call chain to be processed is consistent with or similar in nature to the original method package name prefix information. If so, the corresponding method in the call chain to be processed is determined as the original method. It should be noted that the specific implementation of determining whether the method package name prefix information corresponding to the method in the call chain to be processed matches the original method package name prefix information can be determined by those skilled in the art based on the actual situation. The above description is merely an example and does not constitute a limitation.

[0127] For example, the original method may be, but is not limited to, a method developed and designed by the current project or organization, and is not a conventional existing method. It should be noted that the specific nature of the original method can be determined by those skilled in the art based on the actual situation; the above description is merely illustrative and does not constitute a limitation.

[0128] By taking the above steps into full account, the relationship between package name prefix information and the properties of the method body can be fully considered. This allows for a more detailed, comprehensive, and accurate selection of original methods designed by the corresponding project or unit from multiple pending call chain methods. This improves the accuracy and speed of subsequent threshold determination based on original methods, thereby enhancing the overall accuracy and speed of application anomaly detection.

[0129] In an optional implementation, determining the corresponding reference call chain based on the original method in the call chain to be processed includes:

[0130] The original method level corresponding to the original method in the call chain to be processed is determined, and the call chain method of the next level after the lowest original method level is taken as the corresponding reference call chain termination method, wherein multiple original method levels are sequentially adjacent;

[0131] Based on the reference call chain termination method and the corresponding start method in the call chain to be processed, the corresponding call chain to be processed is intercepted to obtain the corresponding reference call chain, wherein the start method in the call chain to be processed is an original method.

[0132] For example, determining the original method level corresponding to the original method in the call chain to be processed can be, but is not limited to, performing corresponding call chain parsing on the call chain to be processed based on the identified original method, thereby determining the original method level corresponding to the original method in the call chain to be processed. For example, a call chain to be processed may be F→G→H→I→J (F, G, H, I, and J represent methods at different levels, F, G, and H are original methods, while I and J are not original methods), and for the original method H, its original method level is the lowest original method level. It should be noted that the specific implementation of determining the original method level corresponding to the original method in the call chain to be processed can be determined by those skilled in the art based on the actual situation. The above description is only an example and does not constitute a limitation.

[0133] For example, the step of using the next level of the pending call chain method after the lowest original method level as the corresponding reference call chain termination method can be exemplified by the following:

[0134] In the pending call chain F→G→H→I→J, the level where method H is located is the lowest original method level. Therefore, the method in the next pending call chain is method I, which is determined as the corresponding reference call chain termination method.

[0135] The pending call chain method at the next level below the lowest original method level can be, but is not limited to, the pending call chain method at a level lower than and adjacent to the lowest original method level. Although the pending call chain method at the next level below the lowest original method level is a non-original conventional method, the original method at the lowest original method level is often determined by inheritance or implementation based on the class to which the non-original conventional method belongs. Therefore, the pending call chain method at the next level below the lowest original method level is also more or less related to the original development logic, and it is best to take it into account when determining the exception threshold and performing overall detection.

[0136] It should be noted that the specific implementation of using the next level of the original method hierarchy as the corresponding reference call chain termination method can be determined by those skilled in the art based on the actual situation. The above description is merely an example and does not constitute a limitation.

[0137] For example, the hierarchy of the call chain involved in the embodiments of the present invention is determined based on the relevant call relationships. For instance, if the call chain involves method A calling method B, or method A is an inheritance (extends) or implementation (implements) of the class to which method B belongs, then the hierarchy of method A is one unit higher than that of method B.

[0138] For example, the specific principles of the adjacent levels of original methods and the starting method in the call chain to be a single original method, as well as the correspondence between the method type and level of the call chain, can be found in the description of the relevant preprocessing methods and specific rules of the call chain in the embodiments of this invention, which will not be repeated here.

[0139] For example, the step of intercepting the corresponding reference call chain based on the reference call chain termination method and the corresponding start method in the call chain to be processed can be, but is not limited to, using the start method of the call chain to be processed as the highest-level method in the reference call chain and the termination method of the reference call chain as the lowest-level method in the reference call chain, and using this as the demarcation basis to intercept the corresponding reference call chain in the call chain to be processed. For example, if the call chain to be processed is F→G→H→I→J, and F is the start method and I is the reference call chain termination method, then the intercepted corresponding reference call chain is F→G→H→I. Here, one call chain to be processed corresponds to one reference call chain. It should be noted that the specific implementation of intercepting the corresponding reference call chain based on the reference call chain termination method and the corresponding start method in the call chain to be processed can be determined by those skilled in the art according to the actual situation. The above description is only an example and does not constitute a limitation.

[0140] Through the above steps, the reference call chain can be determined more accurately and in greater detail. This ensures that the reference call chain fully covers the relevant self-developed or designed method logic, without including excessive redundant information (such as conventional existing methods that are not very meaningful for measuring development anomalies). Therefore, it further helps to reduce related interference and unnecessary data calculations, thereby further improving the speed and accuracy of determining the anomaly weight threshold, and thus improving the speed and accuracy of overall application anomaly detection.

[0141] In one alternative implementation, such as Figure 2 As shown, determining multiple normal call chains and multiple abnormal call chains in the reference call chain based on exception stack information and preset error codes includes the following steps:

[0142] S201: Determine multiple reference call chain methods in the reference call chain.

[0143] S202: Determine whether the reference call chain satisfies the condition that there is a reference call chain method corresponding to the exception stack information in the reference call chain or that there is a reference call chain method including the error code in the reference call chain. If so, determine the corresponding reference call chain as the exception call chain.

[0144] S203: Identify the reference call chains other than the abnormal call chain as the normal call chain.

[0145] For example, the reference call chain method corresponding to the exception stack information can be, but is not limited to, the reference call chain method indicating the location of the problem in the exception stack information. It should be noted that the specific nature of the reference call chain method corresponding to the exception stack information can be determined by those skilled in the art based on the actual situation; the above description is merely illustrative and does not constitute a limitation.

[0146] For example, the error code may be, but is not limited to, relevant historical codes that have been collected and identified by relevant personnel, and may take the form of, but is not limited to, code lines or code segments, and can be located by the identified error code position. It should be noted that the nature and source of the preset error code can be determined by those skilled in the art based on the actual situation, and the above description is only an example and does not constitute a limitation.

[0147] Through the above steps, the reference call chain can be quickly and accurately divided into normal call chains and abnormal call chains through simple comparison and processing. Based on both exception stack information and manually marked error codes, the comprehensiveness of identifying abnormal call chains can be improved, thereby increasing the speed and accuracy of determining the exception weight threshold, and thus improving the speed and accuracy of overall application exception detection.

[0148] In one alternative implementation, such as Figure 3 As shown, determining the number of positive calls to methods of multiple method types in each normal call chain and the number of negative calls to methods of multiple method types in each abnormal call chain includes the following steps:

[0149] S301: Determine the multiple normal call chain methods corresponding to the normal call chain, and determine the multiple abnormal call chain methods corresponding to the abnormal call chain.

[0150] S302: The number of normal call chain methods corresponding to the method type in the normal call chain is determined as the corresponding positive call count, and the number of abnormal call chain methods corresponding to the method type in the abnormal call chain is determined as the corresponding negative call count.

[0151] For example, the normal call chain method specifically refers to the method included in the normal call chain, and the abnormal call chain method specifically refers to the method included in the abnormal call chain. One normal call chain corresponds to multiple normal call chain methods, and one abnormal call chain corresponds to multiple abnormal call chain methods.

[0152] For example, a positive call count corresponds to a normal call chain and a specific method type. For instance, a method type A corresponds to a positive call count of x in a normal call chain A (that is, the method of method type A is called x times in normal call chain A).

[0153] For example, a negative call count corresponds to an exception call chain and a specific method type. For instance, a method type B corresponds to a negative call count of y in a certain exception call chain B (that is, the method of method type B is called y times in exception call chain B).

[0154] By following the steps above, we can more precisely and accurately determine the number of times a method of a specific type is called in different property-specific call chains, thereby improving the accuracy of determining the anomaly weight threshold and thus improving the overall accuracy of application detection.

[0155] In an optional implementation, it further includes:

[0156] Before determining the number of normal call chain methods corresponding to the method type in the normal call chain as the corresponding positive call count, and determining the number of abnormal call chain methods corresponding to the method type in the abnormal call chain as the corresponding negative call count...

[0157] Determine the reference package name, reference class name, reference method name, and reference parameter type corresponding to the method type;

[0158] Determine the package name, class name, name, and parameter types of the normal call chain method corresponding to the normal call chain method;

[0159] Determine the package name, class name, name, and parameter types of the exception call chain method corresponding to the exception call chain method.

[0160] Determine whether the normal call chain method satisfies the following conditions: the normal call chain method package name matches the reference package name, the normal call chain method class name matches the reference class name, the normal call chain method name matches the reference method name, and the normal call chain method input parameter type matches the reference input parameter type. If so, determine the normal call chain method as the normal call chain method corresponding to the method type.

[0161] Determine whether the exception call chain method satisfies the following conditions: the package name of the exception call chain method matches the reference package name, the class name of the exception call chain method matches the reference class name, the name of the exception call chain method matches the reference method name, and the input parameter type of the exception call chain method matches the reference input parameter type. If so, determine the exception call chain method as the exception call chain method corresponding to the method type.

[0162] For example, the range of the method types can be determined by those skilled in the art based on the corresponding development needs, plans and actual situations, and the embodiments of the present invention do not impose any limitations on this.

[0163] For example, determining the reference package name, reference class name, reference method name, and reference parameter type corresponding to the method type can be, but is not limited to, parsing the relevant information of the method type to obtain the corresponding reference package name, reference class name, reference method name, and reference parameter type. It should be noted that the specific implementation method for determining the reference package name, reference class name, reference method name, and reference parameter type corresponding to the method type can be determined by those skilled in the art based on the actual situation. The above description is merely an example and does not constitute a limitation.

[0164] For example, determining the package name, class name, name, and parameter type of the normal call chain method corresponding to the normal call chain method can be, but is not limited to, parsing the normal call chain method to determine these parameters. It should be noted that the specific implementation for determining these parameters can be determined by those skilled in the art based on the actual situation; the above description is merely illustrative and does not constitute a limitation.

[0165] For example, determining the package name, class name, name, and parameter types of the exception call chain method corresponding to the exception call chain method can be, but is not limited to, parsing the exception call chain method to determine these parameters. It should be noted that the specific implementation for determining these parameters can be determined by those skilled in the art based on the actual situation; the above description is merely illustrative and does not constitute a limitation.

[0166] Preferably, when determining the method corresponding to the method type, the version number can be further considered (if the corresponding normal call chain method and / or abnormal call chain method includes a version number, and the information of the corresponding method type also includes the reference method version number). That is, in addition to comparing whether the normal call chain method package name matches the reference package name, the normal call chain method class name matches the reference class name, the normal call chain method name matches the reference method name, and the normal call chain method input parameter type matches the reference input parameter type, the version number of the normal call chain method also matches the reference version number. In addition to comparing whether the abnormal call chain method package name matches the reference package name, the abnormal call chain method class name matches the reference class name, the abnormal call chain method name matches the reference method name, and the abnormal call chain method input parameter type matches the reference input parameter type, the version number of the abnormal call chain method also matches the reference version number.

[0167] By following the steps above, we can refine and accurately classify methods in the normal call chain and methods in the abnormal call chain based on the characteristics of the relevant methods, thereby improving the accuracy of determining the abnormal weight threshold and thus improving the overall accuracy of application detection.

[0168] In an optional implementation, the overall anomaly rate is determined based on the corresponding number of positive calls and the number of negative calls, including:

[0169] The total number of methods in the exception call chain is obtained by summing the negative call counts corresponding to each of the above method types.

[0170] The total number of abnormal call chain methods and the number of positive calls for each normal call chain corresponding to each method type are added together to obtain the total number of reference call chain methods.

[0171] The overall exception rate is determined by dividing the total number of methods in the exception call chain by the total number of methods in the reference call chain.

[0172] For example, a method type corresponds to a negative call count in an exception call chain. For instance, the negative call count of method type A in exception call chain A is x, which means that the method of method type A is called x times in exception call chain A.

[0173] For example, the step of summing up the negative call counts corresponding to each of the method types for each of the exception call chains to obtain the total number of methods in the exception call chain can be illustrated by the following example:

[0174] There exist method types A and B, and exception call chains A and B. Method type A and exception call chain A have a corresponding negative call count x, method type A and exception call chain B have a corresponding negative call count y, method type B and exception call chain A have a corresponding negative call count z, and method type B and exception call chain B have a corresponding negative call count w. Then the total number of exception call chain methods is (x + y + z + w).

[0175] It should be noted that the specific implementation of summing the negative call counts corresponding to each of the above-mentioned method types to obtain the total number of methods in the abnormal call chain can be determined by those skilled in the art based on the actual situation. The above description is only an example and does not constitute a limitation.

[0176] For example, a method type corresponds to a positive call count in a normal call chain. For instance, the positive call count of method type A in normal call chain C is e, meaning that the method of method type A is called e times in normal call chain C.

[0177] For example, the total number of methods in the abnormal call chain and the number of positive calls corresponding to each normal call chain for each method type are summed to obtain the total number of methods in the reference call chain, as shown in the following example:

[0178] Given that the total number of methods in an abnormal call chain is (x+y+z+w), there exist method types A and B, and normal call chains C and D. Method type A and normal call chain C have a corresponding positive call count e, method type A and normal call chain D have a corresponding positive call count f, method type B and normal call chain C have a corresponding positive call count g, and method type B and normal call chain D have a corresponding positive call count h. Then the total number of corresponding reference call chains is (x+y+z+w+e+f+g+h).

[0179] It should be noted that the specific implementation of summing the total number of abnormal call chain methods and the number of positive calls for each normal call chain corresponding to each method type to obtain the total number of reference call chain methods can be determined by those skilled in the art based on the actual situation. The above description is only an example and does not constitute a limitation.

[0180] Preferably, the number of abnormal call chain methods in each abnormal call chain can be summed to obtain the total number of abnormal call chain methods, and then the total number of abnormal call chain methods can be summed with the number of normal call chain methods in each normal call chain to obtain the total number of reference call chain methods. The number of abnormal call chain methods in a single abnormal call chain and the number of normal call chain methods in a single normal call chain can be directly obtained and determined through, but not limited to, existing call chain parsing or analysis methods.

[0181] Through the above steps, relevant detailed calculations that conform to relevant principles and development characteristics can be performed, more accurately determining the overall baseline anomaly situation of the application code currently in actual use. Moreover, the computational complexity of these detailed calculations is not high, making it faster to determine the overall anomaly rate, thereby improving the accuracy and speed of determining the anomaly weight threshold, and thus improving the accuracy and speed of overall application detection.

[0182] In an optional implementation, the method exception rate corresponding to the method type is determined based on the corresponding number of positive calls and the number of negative calls, including:

[0183] The cumulative negative call counts corresponding to the method type are summed to obtain the cumulative negative call counts corresponding to the method type.

[0184] The cumulative negative call count is added together with the multiple positive call counts corresponding to the method type to obtain the cumulative call count corresponding to the method type;

[0185] Divide the cumulative number of negative calls corresponding to the method type by the cumulative number of calls to obtain the corresponding method anomaly rate.

[0186] For example, a method type may correspond to multiple negative call counts and multiple positive call counts, and a method type may correspond to a cumulative negative call count, a cumulative call count, and a method exception rate.

[0187] By following the steps described above, the correlation between the number of times a method appears in the normal call chain and the number of times it appears in the abnormal call chain and the degree of abnormality of the method can be fully considered. Through a refined yet simple calculation method, the method abnormality rate (representing the historical degree of abnormality of a certain method type) corresponding to different method types can be accurately and quickly determined. This improves the accuracy and speed of determining the abnormality weight threshold, and thus improves the accuracy and speed of overall application anomaly detection.

[0188] In one alternative implementation, such as Figure 4 As shown, the process of obtaining the corresponding anomaly weight threshold based on the overall anomaly rate, method anomaly rate, number of positive calls, and number of negative calls includes the following steps:

[0189] S401: Based on the abnormality rate of the method and the overall abnormality rate, obtain the corresponding overall deviation coefficient.

[0190] S402: Based on the number of positive calls to multiple method types corresponding to the normal call chain and the method anomaly rate of the method type corresponding to the normal call chain, obtain the normal call chain risk weight corresponding to the normal call chain; based on the number of negative calls to multiple method types corresponding to the abnormal call chain and the method anomaly rate of the method type corresponding to the abnormal call chain, obtain the abnormal call chain risk weight corresponding to the abnormal call chain.

[0191] S403: Based on the overall deviation coefficient, the overall anomaly rate, the risk weights of the normal call chains corresponding to the multiple normal call chains, and the risk weights of the abnormal call chains corresponding to the multiple abnormal call chains, the corresponding anomaly weight threshold is obtained.

[0192] Through the above steps, the anomaly weight threshold not only fully represents the average anomalies of historical application code that has reached production standards, but also takes into account the significant impact of deviations, extreme values, and the specific risks of each call chain on the overall anomaly representation. Corresponding adaptive adjustments and corrections are made to obtain the anomaly weight threshold, making it more consistent with the overall anomaly level of the existing, referenced application code. This further improves the accuracy of obtaining the anomaly weight threshold. Furthermore, the calculation is not complex, thus increasing the speed of obtaining the anomaly weight threshold. Consequently, the accuracy and speed of overall application anomaly detection are improved.

[0193] In an optional implementation, obtaining the corresponding overall deviation coefficient based on the method's anomaly rate and the overall anomaly rate includes:

[0194] The absolute value of the difference between the method anomaly rate corresponding to the method type and the overall anomaly rate is used as the sub-deviation coefficient corresponding to the method type.

[0195] The sub-deviation coefficients corresponding to multiple method types are summed to obtain the total sub-deviation coefficients.

[0196] The overall deviation coefficient is obtained based on the sum of the sub-deviation coefficients and the number of method types.

[0197] For example, a method type corresponds to a method exception rate and a sub-bias coefficient.

[0198] For example, the overall deviation coefficient, obtained based on the sum of the sub-deviation coefficients and the number of method types, can be expressed as, but is not limited to, the following formula:

[0199]

[0200] in, RX represents the sum of sub-deviation coefficients, where n represents the number of method types. i σ represents the sub-deviation coefficient corresponding to the i-th method type. RX This represents the coefficient indicating the overall degree of deviation.

[0201] It should be noted that the specific implementation of obtaining the overall deviation coefficient based on the sum of the sub-deviation coefficients and the number of method types can be determined by those skilled in the art based on the actual situation. The above description is only an example and does not constitute a limitation.

[0202] By following the steps described above, based on relevant mathematical principles, the determined overall deviation coefficient can be closely correlated with the deviation of different method types in terms of anomaly degree from the overall situation. This improves the accuracy of determining the overall deviation coefficient, and the relatively simple calculation also increases the speed of determining the overall deviation coefficient. This, in turn, improves the accuracy and speed of determining the anomaly weight threshold, and consequently improves the overall accuracy and speed of anomaly detection.

[0203] In an optional implementation, obtaining the normal call chain risk weight based on the number of positive calls to multiple method types corresponding to the normal call chain and the method anomalous rate of the method types corresponding to the normal call chain includes:

[0204] Multiply the number of positive calls to the method type corresponding to the normal call chain by the method anomaly rate corresponding to the method type to obtain the normal call chain sub-risk parameter of the normal call chain corresponding to the method type.

[0205] The risk parameters of the normal call chain sub-risk parameters corresponding to multiple method types of the normal call chain are superimposed to obtain the normal call chain risk parameters corresponding to the normal call chain.

[0206] The number of positive calls corresponding to multiple method types in the normal call chain is summed to obtain the number of normal call chain methods in the normal call chain;

[0207] Divide the normal call chain risk parameter by the number of normal call chain methods to obtain the normal call chain risk weight corresponding to the normal call chain.

[0208] For example, a normal call chain corresponds to a normal call chain risk parameter with respect to a method type, and a normal call chain corresponds to a normal call chain risk parameter, a normal call chain method count, and a normal call chain risk weight.

[0209] For example, the step of multiplying the number of positive calls corresponding to the method type in the normal call chain by the method failure rate corresponding to the method type to obtain the normal call chain sub-risk parameter for the method type has the following examples:

[0210] There exists a normal call chain A, and there exist method type A (method exception rate a) and method type B (method exception rate b). Method type A is called x times in normal call chain A, and method type B is called y times in normal call chain A. Then, the risk parameter of normal call chain A corresponding to method type A is ax, and the risk parameter of normal call chain B corresponding to method type B is by.

[0211] It should be noted that the specific implementation of multiplying the number of positive calls corresponding to the method type in the normal call chain by the method anomaly rate corresponding to the method type to obtain the normal call chain sub-risk parameter of the normal call chain corresponding to the method type can be determined by those skilled in the art based on the actual situation. The above description is only an example and does not constitute a limitation.

[0212] For example, the step of superimposing the risk parameters of the normal call chain sub-steps corresponding to multiple method types of the normal call chain to obtain the normal call chain risk parameter corresponding to the normal call chain can be exemplified by the following example:

[0213] Given that the risk parameter of normal call chain A corresponding to method type A is ax, and the risk parameter of normal call chain B corresponding to method type B is by, then the risk parameter of normal call chain A is (ax+by).

[0214] It should be noted that the specific implementation method for superimposing the risk parameters of the normal call chain sub-methods corresponding to the normal call chain to obtain the normal call chain risk parameters corresponding to the normal call chain can be determined by those skilled in the art based on the actual situation. The above description is only an example and does not constitute a limitation.

[0215] By combining the method anomaly rate and call count of the corresponding method type, a normal call chain risk weight that fully characterizes the probability of risk in the corresponding normal call chain can be obtained. This fully considers the relevant application development rules and mathematical principles, improving the accuracy of determining the normal call chain risk weight. Moreover, the above calculation is relatively simple, thus improving the speed of determining the normal call chain risk weight. Therefore, the above steps improve the accuracy and speed of determining the anomaly weight threshold, thereby improving the accuracy and speed of overall application anomaly detection.

[0216] In an optional implementation, obtaining the abnormal call chain risk weight based on the number of negative calls to multiple method types corresponding to the abnormal call chain and the method anomalous rate of the method type corresponding to the abnormal call chain includes:

[0217] Multiply the number of negative calls corresponding to the method type in the abnormal call chain by the method anomaly rate corresponding to the method type to obtain the sub-risk parameter of the abnormal call chain corresponding to the method type in the abnormal call chain.

[0218] The abnormal call chain risk parameters corresponding to multiple method types of the abnormal call chain are superimposed to obtain the abnormal call chain risk parameters corresponding to the abnormal call chain.

[0219] The number of exception calls corresponding to multiple method types in the exception call chain is summed to obtain the number of exception call chain methods in the exception call chain.

[0220] Divide the abnormal call chain risk parameter by the number of abnormal call chain methods to obtain the abnormal call chain risk weight corresponding to the abnormal call chain.

[0221] For example, an exception call chain corresponds to an exception call chain risk parameter with respect to a method type. An exception call chain also corresponds to an exception call chain risk parameter, the number of methods in the exception call chain, and an exception call chain risk weight.

[0222] For example, the step of multiplying the number of negative calls corresponding to the method type in the abnormal call chain by the method anomaly rate corresponding to the method type to obtain the sub-risk parameter of the abnormal call chain corresponding to the method type can be exemplified by the following example:

[0223] There exists an exception call chain A, and there exist method type A (method exception rate a) and method type B (method exception rate b). The number of times method type A is called in exception call chain A is x, and the number of times method type B is called in exception call chain A is y. Then the exception call chain risk parameter of exception call chain A corresponding to method type A is ax, and the exception call chain risk parameter of exception call chain B corresponding to method type B is by.

[0224] It should be noted that the specific implementation of multiplying the number of negative calls corresponding to the method type of the abnormal call chain by the method anomaly rate corresponding to the method type to obtain the sub-risk parameter of the abnormal call chain corresponding to the method type can be determined by those skilled in the art based on the actual situation. The above description is only an example and does not constitute a limitation.

[0225] For example, the step of superimposing the sub-risk parameters of the exception call chain corresponding to multiple method types in the exception call chain to obtain the exception call chain risk parameter corresponding to the exception call chain can be exemplified by the following example:

[0226] Given that the risk parameter of exception call chain A corresponding to method type A is ax, and the risk parameter of exception call chain B corresponding to method type B is by, then the risk parameter of exception call chain A is (ax+by).

[0227] It should be noted that the specific implementation method for superimposing the sub-risk parameters of the abnormal call chain corresponding to multiple method types of the abnormal call chain to obtain the abnormal call chain risk parameter can be determined by those skilled in the art based on the actual situation. The above description is only an example and does not constitute a limitation.

[0228] By combining the method anomaly rate and the number of calls for the corresponding method type, an anomaly call chain risk weight that fully characterizes the probability of risk in the corresponding anomaly call chain can be obtained. This fully considers the relevant application development rules and mathematical principles, improving the accuracy of determining the anomaly call chain risk weight. Moreover, the above calculation is relatively simple, thus improving the speed of determining the anomaly call chain risk weight. Therefore, the above steps improve the accuracy and speed of determining the anomaly weight threshold, thereby improving the accuracy and speed of overall application anomaly detection.

[0229] In an optional implementation, obtaining the corresponding anomaly weight threshold based on the overall deviation coefficient, the overall anomaly rate, the risk weights of the normal call chains corresponding to the multiple normal call chains, and the risk weights of the abnormal call chains corresponding to the multiple abnormal call chains includes:

[0230] Based on the preset correction coefficient and the overall deviation coefficient, the historical risk level correction weight is obtained;

[0231] Based on the risk weights of the normal call chains corresponding to the multiple normal call chains and the risk weights of the abnormal call chains corresponding to the multiple abnormal call chains, the corresponding relative risk weights are obtained.

[0232] Based on the historical risk level correction weight, relative risk weight, and overall anomaly rate, the corresponding anomaly weight threshold is obtained.

[0233] For example, the historical risk level correction weight obtained based on the preset correction coefficient and the overall deviation coefficient can be expressed as, but is not limited to, the following formula:

[0234] Historical risk level adjustment weight = m(1+σ) RX )

[0235] Where m represents the correction factor, σ RX This represents the coefficient indicating the overall degree of deviation.

[0236] The correction coefficient can be set and determined by those skilled in the art based on actual circumstances, and this embodiment of the invention does not impose any limitations on it. For example, the correction coefficient can be a coefficient greater than 0.

[0237] It should be noted that the specific implementation method for obtaining the historical risk level correction weight based on the preset correction coefficient and the overall deviation degree coefficient can be determined by those skilled in the art according to the actual situation. The above description is only an example and does not constitute a limitation.

[0238] For example, the anomalous weight threshold obtained based on the historical risk level adjustment weight, relative risk weight, and overall anomalous rate can be expressed as, but is not limited to, the following formula:

[0239]

[0240] Where L represents the anomaly weight threshold, m(1+σ) RX () indicates the historical risk level adjustment weight. R represents the relative risk weight. t This represents the overall anomaly rate.

[0241] It should be noted that the specific implementation method for obtaining the corresponding abnormality weight threshold based on the historical risk level adjustment weight, relative risk weight, and overall abnormality rate can be determined by those skilled in the art according to the actual situation. The above description is only an example and does not constitute a limitation.

[0242] By following the steps above, based on relevant application development requirements, characteristics, and principles, and through more detailed calculations and processing, the determined anomaly weight threshold can be made more consistent with the upper limit of acceptable call chain anomalies during application development. This further improves the accuracy of the determined anomaly weight threshold, and consequently, the overall accuracy of application anomaly detection.

[0243] In an optional implementation, obtaining the corresponding relative risk weight based on the risk weights of the normal call chains corresponding to the multiple normal call chains and the risk weights of the abnormal call chains corresponding to the multiple abnormal call chains includes:

[0244] The risk weights of multiple normal call chains and multiple abnormal call chains are superimposed to obtain the total call chain risk weight. The total call chain risk weight is then divided by the number of reference call chains to obtain the average call chain risk weight.

[0245] The corresponding relative risk weight is obtained based on the absolute value of the difference between the risk weight of each normal call chain and the risk weight of the average call chain, and the absolute value of the difference between the risk weight of each abnormal call chain and the risk weight of the average call chain.

[0246] For example, the step of summing up the risk weights of multiple normal call chains and multiple abnormal call chains to obtain a total call chain risk weight, and then dividing the total call chain risk weight by the number of reference call chains to obtain an average call chain risk weight, can be, but is not limited to, summing up the risk weights of all normal call chains and the risk weights of all abnormal call chains to obtain a total call chain risk weight, and then dividing the total call chain risk weight by the number of reference call chains (i.e., the sum of the number of normal call chains and the number of abnormal call chains) to obtain the average call chain risk weight. It should be noted that the specific implementation of summing up the risk weights of multiple normal call chains and multiple abnormal call chains to obtain a total call chain risk weight, and then dividing the total call chain risk weight by the number of reference call chains to obtain an average call chain risk weight, can be determined by those skilled in the art based on the actual situation. The above description is merely an example and does not constitute a limitation.

[0247] For example, the relative risk weight obtained based on the absolute value of the difference between the risk weight of each normal call chain and the average call chain risk weight, and the absolute value of the difference between the risk weight of each abnormal call chain and the average call chain risk weight, can be expressed as, but is not limited to, the following formula:

[0248]

[0249] Among them, y i This represents the i-th reference call chain (normal call chain or abnormal call chain, however, all y...) i The set must cover the corresponding risk weights of all normal and abnormal call chains (if the i-th reference call chain is a normal call chain, then it corresponds to the normal call chain risk weight; if the i-th reference call chain is an abnormal call chain, then it corresponds to the abnormal call chain risk weight), μ is the average call chain risk weight, and n is the number of reference call chains.

[0250] It should be noted that the specific implementation of obtaining the corresponding relative risk weight based on the absolute value of the difference between the risk weight of each normal call chain and the average call chain risk weight, and the absolute value of the difference between the risk weight of each abnormal call chain and the average call chain risk weight, can be determined by those skilled in the art based on the actual situation. The above description is only an example and does not constitute a limitation.

[0251] Through the above steps, the relative risk weights can be more closely correlated with the difference between the individual risk probability and the average risk probability of the call chain. This takes into account the principles and mathematical principles of application development more deeply, improves the accuracy of determining the relative risk weights, thereby improving the accuracy and speed of determining the anomaly weight threshold, and ultimately improving the accuracy and speed of overall application anomaly detection.

[0252] In one alternative implementation, such as Figure 5 As shown, determining whether the target call chain has anomaly risks based on the target number of times, the corresponding method anomaly rate, and the anomaly weight threshold includes the following steps:

[0253] S501: Multiply the target number of the method type corresponding to the target call chain by the method exception rate corresponding to the method type to obtain the target call chain sub-risk parameter corresponding to the method type.

[0254] S502: The target call chain sub-risk parameters corresponding to multiple method types of the target call chain are superimposed to obtain the target call chain risk parameters corresponding to the target call chain.

[0255] S503: The number of target calls corresponding to multiple method types in the target call chain is summed to obtain the number of target call chain methods in the target call chain.

[0256] S504: Divide the target call chain risk parameter by the number of methods in the target call chain to obtain the target call chain anomaly weight corresponding to the target call chain.

[0257] S505: Determine whether the abnormal weight of the target call chain is greater than the abnormal weight threshold. If so, issue a corresponding alarm.

[0258] For example, a target call chain corresponds to a target call chain sub-risk parameter with respect to a method type, and a target call chain corresponds to a target call chain risk parameter, a target call chain method count, and a target call chain risk weight.

[0259] For example, the specific implementation of step S501 can be referred to the description of the step in the embodiment of the present invention of multiplying the number of positive calls corresponding to the method type of the normal call chain by the method anomaly rate corresponding to the method type to obtain the normal call chain sub-risk parameter of the normal call chain corresponding to the method type. The implementation is similar and will not be repeated here.

[0260] For example, the specific implementation of step S502 can be referred to the description of the step in the embodiment of the present invention of superimposing the risk parameters of the normal call chain sub-methods corresponding to the normal call chain to obtain the risk parameters of the normal call chain corresponding to the normal call chain. The implementation method is similar and will not be repeated here.

[0261] For example, the corresponding alarm may be, but is not limited to, displaying or sending alarm information such as "There is an anomaly in the xxx call chain in the current target application. Please conduct in-depth fault analysis and repair in a timely manner." It should be noted that the specific implementation method for the corresponding alarm can be determined by those skilled in the art based on the actual situation. The above description is only an example and does not constitute a limitation.

[0262] By combining the method anomaly rate and the number of calls for the corresponding method type, the target call chain anomaly weight, which fully characterizes the degree of anomaly of the corresponding target call chain, can be obtained. This fully considers the relevant application development rules and mathematical principles, improves the accuracy of determining the target call chain anomaly weight, and the above calculation is also relatively simple, thus improving the overall speed. This refines the process of detecting whether the target call chain of the target application is abnormal, and improves the detection accuracy and detection speed.

[0263] Based on the same principle, this invention discloses an application anomaly detection device 600, such as... Figure 6 As shown, the application anomaly detection device 600 includes:

[0264] The historical call chain parsing module 601 is used to determine multiple normal call chains and multiple abnormal call chains in the reference call chain based on the exception stack information and the preset error code, and to determine the number of positive calls of multiple method types to each of the normal call chains and the number of negative calls of multiple method types to each of the abnormal call chains.

[0265] The anomaly weight threshold determination module 602 is used to determine the overall anomaly rate and the method anomaly rate corresponding to the method type based on the corresponding positive call count and negative call count, and to obtain the corresponding anomaly weight threshold based on the overall anomaly rate, method anomaly rate, positive call count and negative call count;

[0266] Anomaly detection module 603 is used to determine the target number of times that multiple methods of the aforementioned method type are called by the target call chain of the target application, and based on the target number of times, the corresponding method anomaly rate, and the anomaly weight threshold, to determine whether there is an anomaly risk in the target call chain, and if so, to issue a corresponding alarm.

[0267] In an optional implementation, a reference call chain determination module is further included, for:

[0268] Before determining multiple normal call chains and multiple abnormal call chains in the reference call chain based on the exception stack information and preset error codes.

[0269] Based on historical application code, multiple historical call chains are obtained, and based on the latest running time point corresponding to the historical call chain and the preset sample time period, multiple call chains to be processed are determined from the historical call chains.

[0270] Determine the method package name corresponding to each method in the pending call chain, and based on the preset original method package name format and the corresponding method package name, determine the original method in the pending call chain method of the pending call chain;

[0271] Based on the original methods in the call chain to be processed, the corresponding reference call chain is determined.

[0272] In an optional implementation, the reference call chain determination module is configured to:

[0273] Based on the original method package name format, determine the corresponding original method package name prefix information;

[0274] Determine the method package name prefix information corresponding to the method package name;

[0275] Determine whether the method package name prefix information corresponding to the method in the call chain to be processed matches the original method package name prefix information. If so, determine the corresponding method in the call chain to be processed as the original method.

[0276] In an optional implementation, the reference call chain determination module is configured to:

[0277] The original method level corresponding to the original method in the call chain to be processed is determined, and the call chain method of the next level after the lowest original method level is taken as the corresponding reference call chain termination method, wherein multiple original method levels are sequentially adjacent;

[0278] Based on the reference call chain termination method and the corresponding start method in the call chain to be processed, the corresponding call chain to be processed is intercepted to obtain the corresponding reference call chain, wherein the start method in the call chain to be processed is an original method.

[0279] In an optional implementation, the historical call chain parsing module 601 is used for:

[0280] Determine multiple reference call chain methods in the reference call chain;

[0281] Determine whether the reference call chain satisfies the condition that there is a reference call chain method with corresponding exception stack information or a reference call chain method including the error code in the reference call chain. If so, determine the corresponding reference call chain as the exception call chain.

[0282] Other reference call chains besides the abnormal call chain are identified as the normal call chains.

[0283] In an optional implementation, the historical call chain parsing module 601 is used for:

[0284] Identify multiple normal call chain methods in the normal call chain, and identify multiple abnormal call chain methods in the abnormal call chain;

[0285] The number of normal call chain methods corresponding to the method type in the normal call chain is determined as the corresponding positive call count, and the number of abnormal call chain methods corresponding to the method type in the abnormal call chain is determined as the corresponding negative call count.

[0286] In an optional implementation, a call chain method partitioning module is further included, for:

[0287] Before determining the number of normal call chain methods corresponding to the method type in the normal call chain as the corresponding positive call count, and determining the number of abnormal call chain methods corresponding to the method type in the abnormal call chain as the corresponding negative call count...

[0288] Determine the reference package name, reference class name, reference method name, and reference parameter type corresponding to the method type;

[0289] Determine the package name, class name, name, and parameter types of the normal call chain method corresponding to the normal call chain method;

[0290] Determine the package name, class name, name, and parameter types of the exception call chain method corresponding to the exception call chain method.

[0291] Determine whether the normal call chain method satisfies the following conditions: the normal call chain method package name matches the reference package name, the normal call chain method class name matches the reference class name, the normal call chain method name matches the reference method name, and the normal call chain method input parameter type matches the reference input parameter type. If so, determine the normal call chain method as the normal call chain method corresponding to the method type.

[0292] Determine whether the exception call chain method satisfies the following conditions: the package name of the exception call chain method matches the reference package name, the class name of the exception call chain method matches the reference class name, the name of the exception call chain method matches the reference method name, and the input parameter type of the exception call chain method matches the reference input parameter type. If so, determine the exception call chain method as the exception call chain method corresponding to the method type.

[0293] In an optional implementation, the anomaly weight threshold determination module 602 is used to:

[0294] The total number of methods in the exception call chain is obtained by summing the negative call counts corresponding to each of the above method types.

[0295] The total number of abnormal call chain methods and the number of positive calls for each normal call chain corresponding to each method type are added together to obtain the total number of reference call chain methods.

[0296] The overall exception rate is determined by dividing the total number of methods in the exception call chain by the total number of methods in the reference call chain.

[0297] In an optional implementation, the anomaly weight threshold determination module 602 is used to:

[0298] The cumulative negative call counts corresponding to the method type are summed to obtain the cumulative negative call counts corresponding to the method type.

[0299] The cumulative negative call count is added together with the multiple positive call counts corresponding to the method type to obtain the cumulative call count corresponding to the method type;

[0300] Divide the cumulative number of negative calls corresponding to the method type by the cumulative number of calls to obtain the corresponding method anomaly rate.

[0301] In an optional implementation, the anomaly weight threshold determination module 602 is used to:

[0302] Based on the method's anomaly rate and the overall anomaly rate, the corresponding overall deviation coefficient is obtained;

[0303] Based on the number of positive calls to multiple method types corresponding to the normal call chain and the method anomaly rate of the method type corresponding to the normal call chain, the risk weight of the normal call chain is obtained; based on the number of negative calls to multiple method types corresponding to the abnormal call chain and the method anomaly rate of the method type corresponding to the abnormal call chain, the risk weight of the abnormal call chain is obtained.

[0304] Based on the overall deviation coefficient, the overall anomaly rate, the risk weights of the normal call chains corresponding to the multiple normal call chains, and the risk weights of the abnormal call chains corresponding to the multiple abnormal call chains, the corresponding anomaly weight thresholds are obtained.

[0305] In an optional implementation, the anomaly weight threshold determination module 602 is used to:

[0306] The absolute value of the difference between the method anomaly rate corresponding to the method type and the overall anomaly rate is used as the sub-deviation coefficient corresponding to the method type.

[0307] The sub-deviation coefficients corresponding to multiple method types are summed to obtain the total sub-deviation coefficients.

[0308] The overall deviation coefficient is obtained based on the sum of the sub-deviation coefficients and the number of method types.

[0309] In an optional implementation, the anomaly weight threshold determination module 602 is used to:

[0310] Multiply the number of positive calls to the method type corresponding to the normal call chain by the method anomaly rate corresponding to the method type to obtain the normal call chain sub-risk parameter of the normal call chain corresponding to the method type.

[0311] The risk parameters of the normal call chain sub-risk parameters corresponding to multiple method types of the normal call chain are superimposed to obtain the normal call chain risk parameters corresponding to the normal call chain.

[0312] The number of positive calls corresponding to multiple method types in the normal call chain is summed to obtain the number of normal call chain methods in the normal call chain;

[0313] Divide the normal call chain risk parameter by the number of normal call chain methods to obtain the normal call chain risk weight corresponding to the normal call chain.

[0314] In an optional implementation, the anomaly weight threshold determination module 602 is used to:

[0315] Multiply the number of negative calls corresponding to the method type in the abnormal call chain by the method anomaly rate corresponding to the method type to obtain the sub-risk parameter of the abnormal call chain corresponding to the method type in the abnormal call chain.

[0316] The abnormal call chain risk parameters corresponding to multiple method types of the abnormal call chain are superimposed to obtain the abnormal call chain risk parameters corresponding to the abnormal call chain.

[0317] The number of exception calls corresponding to multiple method types in the exception call chain is summed to obtain the number of exception call chain methods in the exception call chain.

[0318] Divide the abnormal call chain risk parameter by the number of abnormal call chain methods to obtain the abnormal call chain risk weight corresponding to the abnormal call chain.

[0319] In an optional implementation, the anomaly weight threshold determination module 602 is used to:

[0320] Based on the preset correction coefficient and the overall deviation coefficient, the historical risk level correction weight is obtained;

[0321] Based on the risk weights of the normal call chains corresponding to the multiple normal call chains and the risk weights of the abnormal call chains corresponding to the multiple abnormal call chains, the corresponding relative risk weights are obtained.

[0322] Based on the historical risk level correction weight, relative risk weight, and overall anomaly rate, the corresponding anomaly weight threshold is obtained.

[0323] In an optional implementation, the anomaly weight threshold determination module 602 is used to:

[0324] The risk weights of multiple normal call chains and multiple abnormal call chains are superimposed to obtain the total call chain risk weight. The total call chain risk weight is then divided by the number of reference call chains to obtain the average call chain risk weight.

[0325] The corresponding relative risk weight is obtained based on the absolute value of the difference between the risk weight of each normal call chain and the risk weight of the average call chain, and the absolute value of the difference between the risk weight of each abnormal call chain and the risk weight of the average call chain.

[0326] In an optional implementation, the anomaly detection module 603 is configured to:

[0327] Multiply the number of times the target call chain corresponds to the method type by the method exception rate corresponding to the method type to obtain the target call chain sub-risk parameter of the target call chain corresponding to the method type.

[0328] The target call chain risk parameters corresponding to the target call chain of multiple method types are superimposed to obtain the target call chain risk parameters corresponding to the target call chain.

[0329] The number of target calls for the target call chain corresponding to the multiple method types in the target call chain is summed to obtain the number of target call chain methods in the target call chain.

[0330] Divide the target call chain risk parameter by the number of methods in the target call chain to obtain the target call chain anomaly weight corresponding to the target call chain;

[0331] Determine whether the abnormal weight of the target call chain is greater than the abnormal weight threshold. If so, issue a corresponding alarm.

[0332] Since the principle of the application anomaly detection device 600 in solving the problem is similar to the above method, the implementation of the application anomaly detection device 600 can refer to the implementation of the above method, and will not be repeated here.

[0333] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer device, specifically, a computer device can be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smartphone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or any combination of these devices.

[0334] In a typical example, a computer device specifically includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements the method described above.

[0335] The following is for reference. Figure 7 It shows a schematic diagram of the structure of a computer device 700 suitable for implementing the embodiments of this application.

[0336] like Figure 7 As shown, the computer device 700 includes a central processing unit (CPU) 701, which can perform various appropriate tasks and processes based on programs stored in read-only memory (ROM) 702 or programs loaded from storage section 708 into random access memory (RAM) 703. The RAM 703 also stores various programs and data required for the operation of the system 700. The CPU 701, ROM 702, and RAM 703 are interconnected via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0337] The following components are connected to the I / O interface 705: an input section 706 including a keyboard, mouse, etc.; an output section 707 including a cathode ray tube (CRT), liquid crystal feedback (LCD), etc., and speakers, etc.; a storage section 708 including a hard disk, etc.; and a communication section 709 including a network interface card such as a LAN card, modem, etc. The communication section 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to the I / O interface 705 as needed. A removable medium 711, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 710 as needed so that computer programs read from it can be installed in the storage section 708 as needed.

[0338] In particular, according to embodiments of the present invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of the present invention include a computer program product comprising a computer program tangibly embodied on a machine-readable medium, the computer program including program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 709, and / or installed from removable medium 711.

[0339] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0340] For ease of description, the above devices are described separately by function as various units. Of course, in implementing this application, the functions of each unit can be implemented in one or more software and / or hardware.

[0341] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0342] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0343] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0344] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0345] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0346] This application can be described in the general context of computer-executable instructions, such as program modules, that are executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a specific task or implement a specific abstract data type. This application can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0347] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0348] The above description is merely an embodiment of this application and is not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. An application anomaly detection method characterized by, The method comprises the following steps: determining the method package name corresponding to each method in the to-be-processed call chain, and determining the original method in the to-be-processed call chain method based on the preset original method package name format and the corresponding method package name; based on the original method in the to-be-processed call chain method, determining the corresponding reference call chain; based on the exception stack information and the preset error code, determining a plurality of normal call chains and a plurality of abnormal call chains in the reference call chain, and determining the positive call times of a plurality of method types of methods called by each normal call chain and the negative call times of a plurality of method types of methods called by each abnormal call chain; based on the corresponding positive call times and negative call times, determining the overall abnormal rate and the method abnormal rate corresponding to the method type, and obtaining the corresponding abnormal weight threshold based on the overall abnormal rate, the method abnormal rate, the positive call times and the negative call times; determining the target number of times that a plurality of methods of the method type are called by a target call chain of a target application, and determining whether the target call chain has an abnormal risk based on the target number of times, the corresponding method abnormal rate and the abnormal weight threshold, and if so, corresponding alarm is performed; wherein, based on the original method in the to-be-processed call chain method, the corresponding reference call chain is determined, comprising: determining the original method level corresponding to the original method in the to-be-processed call chain, and taking the to-be-processed call chain method at the next level of the lowest original method level as the corresponding reference call chain termination method, wherein a plurality of original method levels are adjacent in turn; based on the reference call chain termination method and the starting method in the corresponding to-be-processed call chain, the corresponding reference call chain is obtained by intercepting the corresponding to-be-processed call chain, wherein the starting method in the to-be-processed call chain is an original method; wherein, based on the overall abnormal rate, the method abnormal rate, the positive call times and the negative call times, the corresponding abnormal weight threshold is obtained, comprising: based on the method abnormal rate and the overall abnormal rate, the overall deviation degree coefficient corresponding thereto is obtained; based on the positive call times of a plurality of method types corresponding to the normal call chain and the method abnormal rate of the method type corresponding to the normal call chain, the normal call chain risk weight corresponding to the normal call chain is obtained; based on the negative call times of a plurality of method types corresponding to the abnormal call chain and the method abnormal rate of the method type corresponding to the abnormal call chain, the abnormal call chain risk weight corresponding to the abnormal call chain is obtained; based on the overall deviation degree coefficient, the overall abnormal rate, the normal call chain risk weight corresponding to a plurality of normal call chains and the abnormal call chain risk weight corresponding to a plurality of abnormal call chains, the corresponding abnormal weight threshold is obtained.

2. The method of claim 1, wherein, further comprising: before determining a plurality of normal call chains and a plurality of abnormal call chains in the reference call chain based on the exception stack information and the preset error code, Based on historical application code, a plurality of historical call chains are obtained, and based on a latest running time point corresponding to the historical call chains and a preset sample time period, a plurality of to-be-processed call chains are determined from the historical call chains.

3. The method of claim 1, wherein, The method further comprises: determining a plurality of original methods in the to-be-processed call chain method based on a preset original method package name format and the method package name corresponding to the original method package name format. The method further comprises: determining original method package name prefix information corresponding to the original method package name format; 4. The method of claim 1, wherein, determining method package name prefix information corresponding to the method package name; determining whether the method package name prefix information corresponding to the to-be-processed call chain method is consistent with the original method package name prefix information, and if so, determining the corresponding to-be-processed call chain method as the original method. The method further comprises: determining a plurality of normal call chains and a plurality of abnormal call chains in the reference call chain based on abnormal stack information and a preset error code.

5. The method of claim 1, wherein, The method further comprises: determining a plurality of reference call chain methods in the reference call chain; determining whether the reference call chain satisfies a condition that there is a reference call chain method corresponding to the abnormal stack information in the reference call chain or there is a reference call chain method including the error code in the reference call chain, and if so, determining the corresponding reference call chain as the abnormal call chain; 6. The method of claim 5, wherein, determining other reference call chains except the abnormal call chain as the normal call chain. The method further comprises: determining a plurality of normal call chain methods in the normal call chain and a plurality of abnormal call chain methods in the abnormal call chain; determining a positive call number of the method type called by each normal call chain and a negative call number of the method type called by each abnormal call chain. The method further comprises: before determining the positive call number of the method type called by each normal call chain and the negative call number of the method type called by each abnormal call chain, determining a reference package name, a reference class name, a reference method name, and a reference parameter type corresponding to the method type; determining a normal call chain method package name, a normal call chain method class name, a normal call chain method name, and a normal call chain method parameter type corresponding to the normal call chain method; determining an abnormal call chain method package name, an abnormal call chain method class name, an abnormal call chain method name, and an abnormal call chain method parameter type corresponding to the abnormal call chain method. determining whether the normal calling chain method meets the conditions that the normal calling chain method package name is consistent with the reference package name, the normal calling chain method class name is consistent with the reference class name, the normal calling chain method name is consistent with the reference method name, and the normal calling chain method parameter type is consistent with the reference parameter type, and if so, determining the normal calling chain method as the normal calling chain method corresponding to the method type; determining whether the abnormal calling chain method meets the conditions that the abnormal calling chain method package name is consistent with the reference package name, the abnormal calling chain method class name is consistent with the reference class name, the abnormal calling chain method name is consistent with the reference method name, and the abnormal calling chain method parameter type is consistent with the reference parameter type, and if so, determining the abnormal calling chain method as the abnormal calling chain method corresponding to the method type.

7. The method of claim 1, wherein, determining an overall abnormality rate based on the corresponding positive calling times and negative calling times, including: superimposing the negative calling times of each abnormal calling chain corresponding to each method type to obtain a total number of abnormal calling chain methods; superimposing the total number of abnormal calling chain methods and the positive calling times of each normal calling chain corresponding to each method type to obtain a total number of reference calling chain methods; dividing the total number of abnormal calling chain methods by the total number of reference calling chain methods to determine the overall abnormality rate.

8. The method of claim 1, wherein, determining a method abnormality rate corresponding to the method type based on the corresponding positive calling times and negative calling times, including: superimposing a plurality of negative calling times corresponding to the method type to obtain a cumulative negative calling time corresponding to the method type; superimposing the cumulative negative calling time and a plurality of positive calling times corresponding to the method type to obtain a cumulative calling time corresponding to the method type; dividing the cumulative negative calling time corresponding to the method type by the cumulative calling time to obtain the method abnormality rate corresponding to the method type.

9. The method of claim 1, wherein, obtaining a corresponding overall deviation degree coefficient based on the method abnormality rate and the overall abnormality rate, including: taking the absolute value of the difference between the method abnormality rate corresponding to the method type and the overall abnormality rate as a sub-deviation degree coefficient corresponding to the method type; superimposing a plurality of sub-deviation degree coefficients corresponding to the method type to obtain a sub-deviation degree coefficient sum; obtaining the overall deviation degree coefficient based on the sub-deviation degree coefficient sum and the number of method types.

10. The method of claim 1, wherein, obtaining a normal calling chain risk weight corresponding to the normal calling chain based on the positive calling times of a plurality of method types corresponding to the normal calling chain and the method abnormality rate of the method type corresponding to the normal calling chain, including: multiplying the positive calling times of the method type corresponding to the normal calling chain by the method abnormality rate corresponding to the method type to obtain a normal calling chain sub-risk amount parameter corresponding to the method type of the normal calling chain; superimposing the normal calling chain sub-risk amount parameters of a plurality of method types corresponding to the normal calling chain to obtain a normal calling chain risk amount parameter corresponding to the normal calling chain; The number of positive calls corresponding to multiple method types in the normal call chain is summed to obtain the number of normal call chain methods in the normal call chain; Divide the normal call chain risk parameter by the number of normal call chain methods to obtain the normal call chain risk weight corresponding to the normal call chain.

11. The method of claim 1, wherein, The step of obtaining the abnormal call chain risk weight based on the number of negative calls to multiple method types corresponding to the abnormal call chain and the method anomaly rate of the method type corresponding to the abnormal call chain includes: Multiply the number of negative calls corresponding to the method type in the abnormal call chain by the method anomaly rate corresponding to the method type to obtain the sub-risk parameter of the abnormal call chain corresponding to the method type in the abnormal call chain. The abnormal call chain risk parameters corresponding to multiple method types of the abnormal call chain are superimposed to obtain the abnormal call chain risk parameters corresponding to the abnormal call chain. The number of exception calls corresponding to multiple method types in the exception call chain is summed to obtain the number of exception call chain methods in the exception call chain. Divide the abnormal call chain risk parameter by the number of abnormal call chain methods to obtain the abnormal call chain risk weight corresponding to the abnormal call chain.

12. The method of claim 1, wherein, The process of obtaining the corresponding anomaly weight threshold based on the overall deviation coefficient, the overall anomaly rate, the risk weights of the normal call chains corresponding to the multiple normal call chains, and the risk weights of the abnormal call chains corresponding to the multiple abnormal call chains includes: Based on the preset correction coefficient and the overall deviation coefficient, the historical risk level correction weight is obtained; Based on the risk weights of the normal call chains corresponding to the multiple normal call chains and the risk weights of the abnormal call chains corresponding to the multiple abnormal call chains, the corresponding relative risk weights are obtained. Based on the historical risk level correction weight, relative risk weight, and overall anomaly rate, the corresponding anomaly weight threshold is obtained.

13. The method of claim 12, wherein, The process of obtaining corresponding relative risk weights based on the risk weights of the normal call chains corresponding to the multiple normal call chains and the risk weights of the abnormal call chains corresponding to the multiple abnormal call chains includes: The risk weights of multiple normal call chains and multiple abnormal call chains are superimposed to obtain the total call chain risk weight. The total call chain risk weight is then divided by the number of reference call chains to obtain the average call chain risk weight. The corresponding relative risk weight is obtained based on the absolute value of the difference between the risk weight of each normal call chain and the risk weight of the average call chain, and the absolute value of the difference between the risk weight of each abnormal call chain and the risk weight of the average call chain.

14. The method of claim 1, wherein, The step of determining whether the target call chain has any abnormal risks based on the target number of times, the corresponding method anomaly rate, and the anomaly weight threshold includes: Multiply the number of times the target call chain corresponds to the method type by the method exception rate corresponding to the method type to obtain the target call chain sub-risk parameter of the target call chain corresponding to the method type. Superimpose the target call chain corresponding to the target call chain sub-risk parameter of a plurality of method types to obtain the target call chain risk parameter corresponding to the target call chain; Superimpose the target call chain corresponding to the target number of a plurality of method types to obtain the target call chain method quantity of the target call chain; Divide the target call chain risk parameter by the target call chain method quantity to obtain the target call chain exception weight corresponding to the target call chain; Determine whether the target call chain exception weight is greater than the exception weight threshold, if so, corresponding alarm is performed.

15. An application anomaly detection apparatus characterized by comprising: Comprise: A historical call chain analysis module for determining a plurality of normal call chains and a plurality of abnormal call chains in a reference call chain based on exception stack information and a preset error code, and determining the positive call number of a plurality of method types of methods called by each normal call chain and the negative call number of a plurality of method types of methods called by each abnormal call chain; An exception weight threshold determination module for determining an overall exception rate and a method exception rate corresponding to the method type based on the corresponding positive call number and negative call number, and obtaining a corresponding exception weight threshold based on the overall exception rate, method exception rate, positive call number and negative call number; An exception detection module for determining the target number of a plurality of method types of methods called by a target call chain of a target application, and determining whether the target call chain has an abnormal risk based on the target number, the corresponding method exception rate and the exception weight threshold, if so, corresponding alarm is performed; A reference call chain determination module for determining the method package name corresponding to each method in the to-be-processed call chain, and determining the original method in the to-be-processed call chain method based on the preset original method package name format and the corresponding method package name; Determine the corresponding reference call chain based on the original method in the to-be-processed call chain method; The reference call chain determination module is specifically configured to determine the original method level corresponding to the original method in the to-be-processed call chain, and take the next level of the to-be-processed call chain method of the lowest original method level as the corresponding reference call chain termination method, wherein a plurality of original method levels are adjacent in turn; based on the reference call chain termination method and the starting method in the corresponding to-be-processed call chain, the corresponding reference call chain is obtained by intercepting the corresponding to-be-processed call chain, wherein the starting method in the to-be-processed call chain is an original method; An abnormal weight threshold determination module is configured to obtain a corresponding overall deviation degree coefficient based on the method abnormality rate and the overall abnormality rate; obtain a normal call chain risk weight corresponding to the normal call chain based on the positive call times of the plurality of method types corresponding to the normal call chain and the method abnormality rate of the method types corresponding to the normal call chain; obtain an abnormal call chain risk weight corresponding to the abnormal call chain based on the negative call times of the plurality of method types corresponding to the abnormal call chain and the method abnormality rate of the method types corresponding to the abnormal call chain; and obtain the corresponding abnormal weight threshold based on the overall deviation degree coefficient, the overall abnormality rate, the normal call chain risk weights corresponding to the plurality of normal call chains, and the abnormal call chain risk weights corresponding to the plurality of abnormal call chains.

16. A computer device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor implements the method of any one of claims 1-14 when executing the program.

17. A computer readable medium having stored thereon a computer program, characterized in that The program is executed by the processor to implement the method of any one of claims 1-14.

Images