Method and device for generating multi-level topology graph, electronic equipment and storage medium

Abstract

Embodiments of the present application provide a multi-level topology graph generation method and device, electronic equipment and storage medium, which are applied to a cloud native service framework. The cloud native service framework includes a micro-service platform. Original process information and network connection information of a local service end process are obtained through the micro-service platform. The original process information is subjected to regular matching processing, and the original process information that is successfully matched is labeled to obtain service information for a service. The service information is input into a preset service feature library to obtain a service group corresponding to the service information and service group information of the service group. The service group information includes a target service group label associated with the service group. Service groups with the same type label of the target service group label are aggregated to obtain a business system corresponding to the service group and system attribute information of the business system. A multi-level topology graph is generated according to the network connection information, the service information, the service group information and the system attribute information.

Description

Technical Field

[0001] This invention relates to the field of topology graph generation technology, and in particular to a method for generating a multi-level topology graph, an apparatus for generating a multi-level topology graph, an electronic device, and a computer-readable storage medium. Background Technology

[0002] Cloud technology is a managed technology that unifies hardware, software, and network resources within a wide area network (WAN) or local area network (LAN) to enable data computing, storage, processing, and sharing. The fundamental characteristics of cloud technology are virtualization and distributed computing. Virtualization abstracts and transforms computer resources, such as servers, networks, memory, and storage, allowing users to better utilize these resources without being limited by their physical form or geographical location. With the development of cloud technology, IT systems have exhibited new characteristics such as microservices, containerization, and elastic scaling. Furthermore, the number of processes in IT systems is rapidly increasing, making network connections more complex and service ports dynamically changing, making it difficult for users to understand and manage IT system services.

[0003] Based on this, although existing network topology technologies can enable users to understand the overall operation of the system and thus manage the network members by adopting specific, physical, or logical virtual arrangements among the members constituting the network, in the process of constructing network topology diagrams for the application layer, existing technologies can only collect the attribute information of business processes through business process identifiers and generate network topology diagrams based on the attribute information. Because the relationships between the processes in such network topology diagrams are too complex, the readability is poor, and users find it difficult to manage the members constituting the network through complex network topology diagrams. Summary of the Invention

[0004] The present invention provides a method, apparatus, electronic device, and computer-readable storage medium for generating multi-level topology graphs, in order to solve or partially solve the problems of overly complex relationships between network members and poor readability in existing network topology graphs, which makes it difficult for users to intuitively understand the network topology relationships of processes and manage the members constituting the network through complex network topology graphs.

[0005] This invention discloses a method for generating multi-level topology graphs, applied to a cloud-native service framework, wherein the cloud-native service framework includes a microservice platform, and the method includes:

[0006] The microservice platform obtains the record attribute information of the local server process, which includes at least the original process information and network connection information. The local server process includes multiple services.

[0007] The original process information is processed by regular expression matching, and the successfully matched original process information is tagged to obtain service information for the service.

[0008] The service information is input into a preset service feature library to obtain the service group corresponding to the service information and the service group information of the service group. The service group information includes the target service group tag associated with the service group.

[0009] Aggregate service groups whose target service group tags belong to the same type of tag to obtain the business system corresponding to the service group and the system attribute information of the business system.

[0010] A multi-level topology map is generated based on the network connection information, the service information, the service group information, and the system attribute information. The multi-level topology map is used to display the network topology structure between the services, the service groups, and the business systems.

[0011] Optionally, the original process information includes at least the server address, server process ID, and server process information for the local server, and the step of obtaining the record attribute information of the local server process through the microservice platform includes:

[0012] The microservice platform obtains the current port information and historical server information list of the local server.

[0013] If the current port information is the same as the preset port information, then the server address, the server process ID, and the server process information are obtained from the historical server information list.

[0014] The server process information includes at least the server process name, process startup user information, and process startup parameters.

[0015] Optionally, the network connection information includes communication connection relationships, and the step of obtaining the record attribute information of the local server process through the microservice platform includes:

[0016] The microservice platform obtains a list of historical client addresses corresponding to the local server, and extracts the client addresses corresponding to the server addresses from the list of historical client addresses.

[0017] Send a process ID query request to the client to which the client address belongs, and receive the client process ID returned by the client;

[0018] Establish a communication connection between the server address, the server process ID, the client address, and the client process ID.

[0019] Optionally, performing regular expression matching on the original process information and tagging the successfully matched original process information to obtain service information for the service includes:

[0020] Obtain the target service tag and target system tag of the local server process;

[0021] The process startup user information and process startup parameters are subjected to regular expression matching, and the successfully matched process startup user information and process startup parameters are associated with the target service tag and the system tag to obtain service information for the service.

[0022] Optionally, the preset service feature library is generated in the following way:

[0023] Obtain the historical service tags and historical system tags of the local server process;

[0024] The historical service tags and the historical system tags are used as training data, and tag features are extracted from the training data. Services with the same tag features are aggregated to obtain service groups corresponding to the services.

[0025] Establish the association between the service group and the preset service group tags, and generate the preset service feature library.

[0026] Optionally, the service information includes a target service tag and a target system tag. The step of inputting the service information into a preset service feature database to obtain the service group corresponding to the service information and the service group information of the service group includes:

[0027] Input the target service tag and the target system tag into the preset service feature library, and output the service group corresponding to the service;

[0028] The preset service group label associated with the service group is obtained using the association relationship, and the preset service group label is used as the target service group label.

[0029] Optionally, the cloud-native service framework further includes a graph database engine, wherein generating a multi-level topology graph based on the network connection information, the service information, the service group information, and the system attribute information includes:

[0030] The network connection information, service information, service group information, and system attribute information are input into the graph database engine to generate the multi-level topology graph;

[0031] The multi-level topology map includes a service layer topology map, a service group layer topology map, and a system layer topology map.

[0032] This invention also discloses a multi-level topology graph generation device, applied to a cloud-native service framework, the cloud-native service framework including a microservice platform, the device comprising:

[0033] The record attribute information acquisition module is used to acquire the record attribute information of the local server process through the microservice platform. The record attribute information includes at least the original process information and network connection information. The local server process includes multiple services.

[0034] The service information acquisition module is used to perform regular expression matching on the original process information and to tag the successfully matched original process information to obtain service information for the service.

[0035] The service group information acquisition module is used to input the service information into a preset service feature library to obtain the service group corresponding to the service information and the service group information of the service group. The service group information includes a target service group tag associated with the service group.

[0036] The system attribute information acquisition module is used to aggregate service groups whose target service group tags belong to the same type of tag to obtain the business system corresponding to the service group and the system attribute information of the business system.

[0037] A multi-level topology map generation module is used to generate a multi-level topology map based on the network connection information, the service information, the service group information, and the system attribute information. The multi-level topology map is used to display the network topology structure between the services, the service groups, and the business systems.

[0038] Optionally, the original process information includes at least the server address, server process ID, and server process information for the local server, and the record attribute information acquisition module is specifically used for:

[0039] The microservice platform obtains the current port information and historical server information list of the local server.

[0040] If the current port information is the same as the preset port information, then the server address, the server process ID, and the server process information are obtained from the historical server information list.

[0041] The server process information includes at least the server process name, process startup user information, and process startup parameters.

[0042] Optionally, the network connection information includes communication connection relationships, and the record attribute information acquisition module is specifically used for:

[0043] The microservice platform obtains a list of historical client addresses corresponding to the local server, and extracts the client addresses corresponding to the server addresses from the list of historical client addresses.

[0044] Send a process ID query request to the client to which the client address belongs, and receive the client process ID returned by the client;

[0045] Establish a communication connection between the server address, the server process ID, the client address, and the client process ID.

[0046] Optionally, the service information acquisition module is specifically used for:

[0047] Obtain the target service tag and target system tag of the local server process;

[0048] The process startup user information and process startup parameters are subjected to regular expression matching, and the successfully matched process startup user information and process startup parameters are associated with the target service tag and the system tag to obtain service information for the service.

[0049] Optionally, the preset service feature library is generated in the following way:

[0050] Obtain the historical service tags and historical system tags of the local server process;

[0051] The historical service tags and the historical system tags are used as training data, and tag features are extracted from the training data. Services with the same tag features are aggregated to obtain service groups corresponding to the services.

[0052] Establish the association between the service group and the preset service group tags, and generate the preset service feature library.

[0053] Optionally, the service information includes target service tags and target system tags, and the service group information acquisition module is specifically used for:

[0054] Input the target service tag and the target system tag into the preset service feature library, and output the service group corresponding to the service;

[0055] The preset service group label associated with the service group is obtained using the association relationship, and the preset service group label is used as the target service group label.

[0056] Optionally, the cloud-native service framework further includes a graph database engine, and the multi-level topology graph generation module is specifically used for:

[0057] The network connection information, service information, service group information, and system attribute information are input into the graph database engine to generate the multi-level topology graph;

[0058] The multi-level topology map includes a service layer topology map, a service group layer topology map, and a system layer topology map.

[0059] This invention also discloses an electronic device, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus;

[0060] The memory is used to store computer programs;

[0061] When the processor executes a program stored in the memory, it implements the method described in the embodiments of the present invention.

[0062] This invention also discloses a computer-readable storage medium storing instructions that, when executed by one or more processors, cause the processors to perform the methods described in this invention.

[0063] The embodiments of the present invention have the following advantages:

[0064] In this embodiment of the invention, the method is applied to a cloud-native service framework, which includes a microservice platform. The microservice platform obtains the recorded attribute information of local server-side processes. This recorded attribute information includes at least original process information and network connection information. The local server-side processes include multiple services. Regular expression matching is performed on the original process information, and successfully matched original process information is tagged to obtain service information for each service. This service information is input into a preset service feature library to obtain the service group corresponding to the service information and the service group information. The service group information includes a target service group tag associated with the service group. Service groups with target service group tags belonging to the same type of tag are aggregated to obtain the business system corresponding to the service group and the system attribute information of the business system. Based on network connection... Information, service information, service group information, and system attribute information are used to generate a multi-level topology map. This multi-level topology map displays the network topology structure between services, service groups, and business systems. Different services are distinguished by labeling, and services with the same type of label are aggregated into service groups. Service groups with the same type of label are aggregated into business systems. This allows for the merging of a large number of services and service groups, simplifies the network topology relationships of processes, and increases the readability of the network topology map. Furthermore, the network connection information of processes is used to associate services, service groups, and business systems, outputting a multi-level network topology map. This allows users to select different levels of network topology maps according to their actual needs and manage various services based on the network topology structure of the network topology map. Attached Figure Description

[0065] Figure 1 This is a flowchart of the steps of a method for generating a multi-level topological map provided in an embodiment of the present invention;

[0066] Figure 2 This is a flowchart of the steps for processing raw process information provided in this embodiment of the invention;

[0067] Figure 3 This is a schematic diagram of the top-level data flow for generating a multi-level topology graph provided in an embodiment of the present invention;

[0068] Figure 4 This is a schematic diagram of the data flow for generating a multi-level topology graph provided in an embodiment of the present invention;

[0069] Figure 5 This is a structural block diagram of a multi-level topology map generation device provided in an embodiment of the present invention;

[0070] Figure 6 This is a structural block diagram of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0071] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0072] As an example, existing network topology diagrams are often used to describe the network topology relationships between various processes at the network device level, but they do not describe the network topology relationships at the application layer. Even if they can describe the network topology relationships at the application layer, they can only describe the relationships between services within a process. When there are many services, the network topology diagram can easily become complex, making it difficult for technical personnel to manage services through such complex diagrams.

[0073] One of the core inventive points of this invention lies in its application to a cloud-native service framework. This framework includes a microservice platform. The microservice platform obtains the record attribute information of local server-side processes. This record attribute information includes at least original process information and network connection information. The local server-side processes include multiple services. Regular expression matching is performed on the original process information, and successfully matched original process information is tagged to obtain service information for each service. This service information is input into a preset service feature library to obtain the service group corresponding to the service information and the service group information. The service group information includes a target service group tag associated with the service group. Service groups with target service group tags belonging to the same type of tag are aggregated to obtain the business system corresponding to the service group and the system attribute information of the business system. A multi-level topology map is generated based on network connection information, service information, service group information, and system attribute information. This multi-level topology map displays the network topology structure between services, service groups, and business systems. Different services are distinguished by labeling, and services with the same type of label are aggregated into service groups, while service groups with the same type of label are aggregated into business systems. This allows for the merging of a large number of services and service groups, simplifies the network topology relationships of processes, and increases the readability of the network topology map. Furthermore, the network connection information of processes is used to associate services, service groups, and business systems, outputting a multi-level network topology map. This allows users to select different levels of network topology maps according to their actual needs and manage various services based on the network topology structure of the network topology map.

[0074] Reference Figure 1 This diagram illustrates a flowchart of a method for generating a multi-level topology graph according to an embodiment of the present invention. Applied to a cloud-native service framework, the cloud-native service framework includes a microservice platform, and specifically may include the following steps:

[0075] Step 101: Obtain the record attribute information of the local server process through the microservice platform. The record attribute information includes at least the original process information and network connection information. The local server process includes multiple services.

[0076] In this embodiment of the invention, the record attribute information of the local server process can be obtained through the microservice platform. The record attribute information includes at least the original process information and network connection information. The local server process includes multiple services.

[0077] Optionally, cloud native is a distributed cloud based on distributed deployment and unified operation and management. It is a cloud technology product system built on technologies such as containers, microservices, and DevOps (Development and Operations, processes, methods, and systems). The cloud native service architecture is a microservice architecture used to implement and govern microservices. The cloud native service architecture can include a microservice platform and a graph database engine. The microservice platform is used to collect and analyze process data, and the graph data engine is used to generate a network topology map based on the process data provided by the microservice platform. Before collecting and analyzing process data, agents need to be deployed in the members that make up the network. The agents mainly collect and generate multi-level topology map data. The members that make up the network mainly include physical machines, virtual machines, etc.

[0078] A process is an abstraction of a running program by the operating system. A process can be viewed as a single execution of a program. Within the operating system, a process can include multiple services. A service is a program that is automatically completed by the system and does not require interaction with the user. Recorded attribute information can include various information about the local server process, such as original process information and network connection information.

[0079] The raw process information may include the server address, server process ID, and server process information. It may also include a list of client IP addresses corresponding to clients communicating with the local server. The server address can be the local server's IP address (Internet Protocol Address). The server process information includes the listening port number, server process ID, server process name, process startup user information, process startup parameters, and access protocol, etc. Process startup parameters at least include insertion time and update time. Network connection information shows the communication connection relationship between the local server and clients.

[0080] In one example of the present invention, the proxy can obtain the current port information of the local server through the microservice platform. If the current port information is the same as the preset port information, the proxy can obtain the server address, server process ID, server process name, process startup user information and process startup parameters from the historical server information list.

[0081] Specifically, the historical server information list can be a list of server listening ports stored in a local cache. For example, the proxy can periodically check the host service listening ports. For each listening port, a record is inserted into the list, with the record using "IP address_process ID" as the ID (Identity document). If the port is found to be missing during the periodic check, the list needs to be updated in time to maintain data consistency.

[0082] In another example of the present invention, a list of historical client addresses corresponding to the local server is obtained through a microservice platform. The client address corresponding to the server address is extracted from the list of historical client addresses. A process ID query request is sent to the client to which the client address belongs. The client process ID returned by the client is received. A communication connection relationship is established between the server address, the server process ID and the client address, and the client process ID. The topology relationship in the process can be directly displayed through the communication connection relationship.

[0083] Specifically, the historical client address list can be the client IP address corresponding to the client process ID, and the communication connection relationship can be the client process ID. A mapping relationship is established between the server address, server process ID, and client address and process ID, such as (client IP_process ID) --- (server IP_process ID). For example, the proxy periodically iterates through the client IP address list and sends a PID (Process Identification) query request to the proxy where the client IP is located. The PID query request parameters include the server's IP address and server port number. After receiving the PID query request, the proxy where the client IP is located can find the client's PID in the local process based on the request parameters and return it. The local proxy obtains the client process ID and then inserts a record into the table. The record uses the `from(client IP_process ID) to(server IP_process ID)` as its ID, and the record attributes include the server port number and access protocol. If the network is found to be non-existent during the periodic iteration, the list should be updated promptly to maintain data consistency.

[0084] Step 102: Perform regular expression matching on the original process information and tag the successfully matched original process information to obtain service information for the service.

[0085] In this embodiment of the invention, the original process information can be processed by regular expression matching, and the original process information that successfully matches can be tagged to obtain service information for the service.

[0086] Optionally, regular expression matching can be used to process the original process information using regular expressions. A regular expression is a special sequence of characters that uses predefined specific characters and their combinations to form a rule. Then, a string is checked to see if it matches this rule to filter or match characters. Service information can be information about services after tagging the original process information processed by regular expression matching.

[0087] In the specific implementation, the target service tag and target system tag of the local server process are obtained, the process startup user information and process startup parameters are processed by regular expression matching, and the successfully matched process startup user information and process startup parameters are associated with the target service tag and system tag to obtain service information for the service.

[0088] Specifically, the system tag can be the tag of the business system, the service tag can be the tag of each service under the business system, the service tag is used to characterize the function or type of the service, the target system tag can be the currently matched system tag, and the target service tag can be the currently matched service tag. For example, the business system tag can be the MySQL system tag, and the service tag under this system tag can be the order service tag, etc.

[0089] As an example, refer to Figure 2 The flowchart of the raw process information processing steps is shown. After the process data is collected, it needs to be preprocessed. The specific data preprocessing process includes: configuring a unified regular expression matching rule for the agent in advance, then automatically matching the process startup user name, process name and process startup parameters, associating the matched information with target service tags and target business tags. After data preprocessing, the topology data is more readable. After data preprocessing, the tagged service information needs to be input into the service feature library, and the service group information and system attribute information need to be output. The service information, service group information and system attribute information are then input into the graph database for modeling, thereby generating a multi-level topology map.

[0090] Step 103: Input the service information into a preset service feature library to obtain the service group corresponding to the service information and the service group information of the service group. The service group information includes the target service group tag associated with the service group.

[0091] In this embodiment of the invention, service information can be input into a preset service feature library to obtain the service group corresponding to the service information and the service group information of the service group.

[0092] Optionally, the service group information can be information about the service group obtained by aggregating various services, the service group tag can be the tag of each service group, and the target service group tag can be the service group tag that matches the service group.

[0093] In the specific implementation, the preset service feature library is generated as follows: First, obtain the historical service tags and historical system tags of the local server process. Then, use the historical service tags and historical system tags as training data, extract tag features from the training data, aggregate services with the same tag features, obtain service groups corresponding to the services, establish the association between the service groups and the preset service group tags, and generate the preset service feature library.

[0094] Optionally, both historical service tags and historical system tags are tags corresponding to existing services. The training of the preset service feature library is completed using these tags. This training can include online training and offline training. Offline training is for identifying existing services and can be skipped after the solution in this application has been running stably. Online training is for identifying incremental services; as new service features constantly emerge, the service feature library also needs continuous improvement. The preset service feature library is a pre-trained feature library used to match service groups and service group tags corresponding to services. A service group can be a group of services that share common features. In a cloud-native environment, a SaaS (Software as a Service) layer service group represents a cluster of microservices providing services independently, while a PaaS (Platform as a Service) layer service group represents a cluster of components providing capabilities independently. The preset service group tags can be tags associated with the service group.

[0095] As an example, firstly, several service tags and business tags are selected from the service information as common features of this type of service. Then, services that meet the common features are grouped into the same service group, and a service group tag is manually defined. Finally, the correspondence between service features and service group tags, the correspondence between services and service groups, and the association between service groups and preset service group tags are established. These correspondences and associations are then stored in the database to generate a preset service feature library.

[0096] Specifically, the target service tag and target system tag can be input into the preset service feature library, the service group corresponding to the service can be output, the preset service group tag associated with the service group can be obtained by using the association relationship, and the preset service group tag can be used as the target service group tag.

[0097] As another example, the acquired service information is input into a service feature database for identification. If a service group matching the input service is found in the service feature database, the service group is successfully identified, and the service is automatically labeled with the service group. If no service group matching the input service is found in the service feature database, the service group identification fails. When encountering a service that fails to be identified, the service feature database needs to be retrained to aggregate multiple services with the same service group label into a member that constitutes a network, thereby reducing the size of the network.

[0098] Step 104: Aggregate service groups whose target service group tags belong to the same type of tag to obtain the business system corresponding to the service group and the system attribute information of the business system.

[0099] In this embodiment of the invention, service groups whose target service group tags belong to the same type of tag can be aggregated to obtain the business system corresponding to the service group and the system attribute information of the business system.

[0100] Step 105: Generate a multi-level topology map based on the network connection information, the service information, the service group information, and the system attribute information. The multi-level topology map is used to display the network topology structure between the services, the service groups, and the business systems.

[0101] In this embodiment of the invention, reference is made to Figure 3 This illustration shows a top-level data flow diagram for generating a multi-level topology map in an embodiment of the present invention. Network connection information, service information, service group information, and system attribute information can be input into the automatic network topology tool to automatically generate a multi-level topology map, which is then sent to the user. The multi-level topology map is used to display the network topology structure between services, service groups, and business systems.

[0102] In its implementation, network connection information, service information, service group information, and system attribute information are input into the graph database engine to generate a multi-level topology graph. This multi-level topology graph includes service layer topology graphs, service group layer topology graphs, and system layer topology graphs. This allows for the display of more network details through different levels of topology graphs, meeting user needs. When displaying the network topology graph at the service group level, a large number of microservices are merged using service group attribute tags, reducing the size of the network members. When displaying the network topology graph at the business system level, a large number of service groups are merged using service system attribute tags, further reducing the size of the network members and simplifying the network topology relationships. This enables relevant technical personnel to intuitively understand the overall picture of a large IT system, providing them with comprehensive reference when planning, building, decommissioning, and migrating networks for enterprises.

[0103] Optionally, a graph database is a data management system designed for efficient storage and retrieval of graph data, using nodes and edges as the basic storage units. A graph is a collection of nodes and edges, where "nodes" represent entities and "edges" represent relationships between entities. Graph databases can intuitively visualize relationships and are the optimal way to store, query, and analyze highly interconnected data, enabling rapid responses to complex relational queries. A graph database engine can be used to construct network topologies between services, service groups, and business systems, and to display these topologies as graphs. Graph database engines integrate graph theory-based retrieval algorithms, and their retrieval interfaces allow for efficient conditional and aggregate queries on topological data models.

[0104] As an example, a vertex in a graph database can represent a service, and an edge can represent a network connection between services. The attributes of each vertex should include the original process information of the service and the labels of the business system and service group to which the service belongs. The attributes of each edge include the direction of the request, the port, and the protocol, thereby storing the topology data in the graph database.

[0105] In one example of the present invention, in order to reflect the actual network conditions in real time, an expiration time can be preset for each newly added topology data, and the expiration time can be updated by refreshing the data. After the expiration time is exceeded, the topology data is regarded as expired data and the expired data is automatically cleaned up. For example, the expiration time can be set to 18:00 on December 20, 2022. Topology data that exceeds 18:00 on December 20, 2022 is regarded as expired data.

[0106] In another example of the invention, anomaly detection can be performed on network connections between processes. If the process PID information of the source or destination end of the connection is missing, it is determined to be an unknown connection. If the service tag of the source or destination end of the connection is missing, it is determined to be a suspicious connection. If the service tags of both the source and destination ends of the connection are registered, it is determined to be a legitimate connection. Anomaly detection is also performed on processes without connections. If the service tag of a process is missing, it is determined to be a suspicious service. In a microservice platform, unknown connections, suspicious connections, and suspicious services can be displayed on a multi-level topology graph.

[0107] To enable those skilled in the art to better understand the technical solutions of the embodiments of the present invention, an example is provided below with reference to... Figure 4 This diagram illustrates the data flow for generating a multi-level topology graph according to an embodiment of the present invention, which may specifically include the following steps:

[0108] 2.1 Process Information Collection:

[0109] Acquire host process information, including IP address, process PID, process name, process startup parameters, user who started the process, process listening port, and container namespace. Perform operations such as storage, service matching, manual / automatic identification of service groups, and visualization on the collected process information.

[0110] 2.2 Process Topology Relationship Acquisition:

[0111] Obtain the process topology. The process topology associates two processes using their IP address and process ID (PID). Therefore, if it's a server-side process, you also need to obtain the visiting client's IP address and PID. The client's PID is obtained through an API query. If it's a client-side process, you also need to obtain the server's IP address and PID, which are obtained by looking up a table. Store the collected process topology.

[0112] 2.3 Client PID Query:

[0113] On a host, a TCP connection is defined by the four elements: source IP, source port, destination IP, and destination port, and the PID of the client that initiated the connection is returned.

[0114] 2.4 Comprehensive Information Inquiry:

[0115] Query process information, query process topology, and query business system name.

[0116] 2.5 Service Matching:

[0117] The platform periodically retrieves process information and matching rules, analyzes whether key information in the process matches the matching rules, and if they do, the match is successful. Successfully matched processes need to supplement their registration with the business system tag and service tag they belong to, according to the definition of the matching rules.

[0118] 2.6 Matching rule maintenance:

[0119] The matching rules consist of three parts: key process information, business system tags, and service tags. To ensure naming consistency, business system tags need to be obtained from the business system name table. Business system managers can perform visual maintenance of the process matching rules.

[0120] 2.7. Manual identification by the service team:

[0121] The business system manager manually identifies processes belonging to the same service group based on their host IP, listening port, business system tag, and service tag, and then registers the service group tags for those processes. The platform stores the association between IPs, listening ports, and corresponding service group tags, forming a knowledge base.

[0122] 2.8 Automatic Service Group Identification:

[0123] The platform automatically identifies the IP address and listening port of newly collected processes. If the process is associated with a service group tag, it will directly register the service group tag by querying the knowledge base.

[0124] 2.9 Anomaly Detection:

[0125] Anomaly detection is performed on connections between processes. If the process PID information of the source or target end of the connection is missing, it is an unknown connection; if the service tag of the source or target end of the connection is missing, it is a suspicious connection; if the service tags of both the source and target end of the connection are registered, it is a legitimate connection. Anomaly detection is also performed on processes without connections. If the service tag of a process is missing, it is a suspicious service. The platform displays unknown connections, suspicious connections, and suspicious services.

[0126] 2.10 Basic Information Maintenance:

[0127] The platform administrator maintains basic information such as the business system name and the list of server IPs.

[0128] 2.11 Management Console:

[0129] Displays a list of process information and a service group topology diagram to users. Pushes anomaly detection results to users. Provides business system managers with a service matching rule maintenance page and a service group manual identification operation page.

[0130] It should be noted that the embodiments of the present invention include, but are not limited to, the examples described above. It is understood that those skilled in the art can make further settings according to actual needs under the guidance of the ideas in the embodiments of the present invention, and the present invention does not limit such settings.

[0131] In this embodiment of the invention, the method is applied to a cloud-native service framework, which includes a microservice platform. The microservice platform obtains the recorded attribute information of local server-side processes. This recorded attribute information includes at least original process information and network connection information. The local server-side processes include multiple services. Regular expression matching is performed on the original process information, and successfully matched original process information is tagged to obtain service information for each service. This service information is input into a preset service feature library to obtain the service group corresponding to the service information and the service group information. The service group information includes a target service group tag associated with the service group. Service groups with target service group tags belonging to the same type of tag are aggregated to obtain the business system corresponding to the service group and the system attribute information of the business system. Based on network connection... Information, service information, service group information, and system attribute information are used to generate a multi-level topology map. This multi-level topology map displays the network topology structure between services, service groups, and business systems. Different services are distinguished by labeling, and services with the same type of label are aggregated into service groups. Service groups with the same type of label are aggregated into business systems. This allows for the merging of a large number of services and service groups, simplifies the network topology relationships of processes, and increases the readability of the network topology map. Furthermore, the network connection information of processes is used to associate services, service groups, and business systems, outputting a multi-level network topology map. This allows users to select different levels of network topology maps according to their actual needs and manage various services based on the network topology structure of the network topology map.

[0132] It should be noted that, for the sake of simplicity, the method embodiments are all described as a series of actions. However, those skilled in the art should understand that the embodiments of the present invention are not limited to the described order of actions, because according to the embodiments of the present invention, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions involved are not necessarily essential to the embodiments of the present invention.

[0133] Reference Figure 5 The diagram illustrates a structural block diagram of a multi-level topology map generation device provided in an embodiment of the present invention, which is applied to a cloud-native service framework. The cloud-native service framework includes a microservice platform and may specifically include the following modules:

[0134] The record attribute information acquisition module 501 is used to acquire the record attribute information of the local server process through the microservice platform. The record attribute information includes at least the original process information and network connection information. The local server process includes multiple services.

[0135] The service information acquisition module 502 is used to perform regular expression matching on the original process information and to tag the successfully matched original process information to obtain service information for the service.

[0136] The service group information acquisition module 503 is used to input the service information into a preset service feature library to obtain the service group corresponding to the service information and the service group information of the service group, wherein the service group information includes a target service group tag associated with the service group;

[0137] The system attribute information acquisition module 504 is used to aggregate service groups whose target service group tags belong to the same type of tag to obtain the business system corresponding to the service group and the system attribute information of the business system.

[0138] The multi-level topology map generation module 505 is used to generate a multi-level topology map based on the network connection information, the service information, the service group information and the system attribute information. The multi-level topology map is used to display the network topology structure between the services, the service groups and the business systems.

[0139] In one optional example, the original process information includes at least the server address, server process ID, and server process information for the local server, and the record attribute information acquisition module 501 is specifically used for:

[0140] The microservice platform obtains the current port information and historical server information list of the local server.

[0141] If the current port information is the same as the preset port information, then the server address, the server process ID, and the server process information are obtained from the historical server information list.

[0142] The server process information includes at least the server process name, process startup user information, and process startup parameters.

[0143] In one optional example, the network connection information includes communication connection relationships, and the record attribute information acquisition module 501 is specifically used for:

[0144] The microservice platform obtains a list of historical client addresses corresponding to the local server, and extracts the client addresses corresponding to the server addresses from the list of historical client addresses.

[0145] Send a process ID query request to the client to which the client address belongs, and receive the client process ID returned by the client;

[0146] Establish a communication connection between the server address, the server process ID, the client address, and the client process ID.

[0147] In one optional example, the service information acquisition module 502 is specifically used for:

[0148] Obtain the target service tag and target system tag of the local server process;

[0149] The process startup user information and process startup parameters are subjected to regular expression matching, and the successfully matched process startup user information and process startup parameters are associated with the target service tag and the system tag to obtain service information for the service.

[0150] In one optional example, the preset service feature library is generated as follows:

[0151] Obtain the historical service tags and historical system tags of the local server process;

[0152] The historical service tags and the historical system tags are used as training data, and tag features are extracted from the training data. Services with the same tag features are aggregated to obtain service groups corresponding to the services.

[0153] Establish the association between the service group and the preset service group tags, and generate the preset service feature library.

[0154] In one optional example, the service information includes a target service tag and a target system tag, and the service group information acquisition module 503 is specifically used for:

[0155] Input the target service tag and the target system tag into the preset service feature library, and output the service group corresponding to the service;

[0156] The preset service group label associated with the service group is obtained using the association relationship, and the preset service group label is used as the target service group label.

[0157] In an optional example, the cloud-native service framework further includes a graph database engine, and the multi-level topology graph generation module 505 is specifically used for:

[0158] The network connection information, service information, service group information, and system attribute information are input into the graph database engine to generate the multi-level topology graph;

[0159] The multi-level topology map includes a service layer topology map, a service group layer topology map, and a system layer topology map.

[0160] As the device embodiment is basically similar to the method embodiment, the description is relatively simple, and relevant parts can be found in the description of the method embodiment.

[0161] In addition, this invention also provides an electronic device, including: a processor, a memory, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, it implements the various processes of the above-described multi-level topology map generation method embodiments and achieves the same technical effect. To avoid repetition, it will not be described again here.

[0162] This invention also provides a computer-readable storage medium storing a computer program. When executed by a processor, the computer program implements the various processes of the above-described multi-level topology map generation method embodiments and achieves the same technical effects. To avoid repetition, it will not be described again here. The computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0163] Figure 6 A structural block diagram of an electronic device for implementing various embodiments of the present invention.

[0164] The electronic device 600 includes, but is not limited to, components such as: a radio frequency unit 601, a network module 602, an audio output unit 603, an input unit 604, a sensor 605, a display unit 606, a user input unit 607, an interface unit 608, a memory 609, a processor 610, and a power supply 611. Those skilled in the art will understand that... Figure 6 The electronic device structures shown are not intended to limit the electronic device. An electronic device may include more or fewer components than shown, or combine certain components, or have different component arrangements. In embodiments of the present invention, the electronic device includes, but is not limited to, mobile phones, tablet computers, laptops, PDAs, in-vehicle terminals, wearable devices, and pedometers.

[0165] It should be understood that, in this embodiment of the invention, the radio frequency unit 601 can be used for receiving and transmitting signals during information transmission or calls. Specifically, it receives downlink data from the base station and processes it with the processor 610; additionally, it transmits uplink data to the base station. Typically, the radio frequency unit 601 includes, but is not limited to, an antenna, at least one amplifier, a transceiver, a coupler, a low-noise amplifier, a duplexer, etc. Furthermore, the radio frequency unit 601 can also communicate with networks and other devices through a wireless communication system.

[0166] The electronic device provides users with wireless broadband internet access through the network module 602, such as helping users send and receive emails, browse web pages, and access streaming media.

[0167] The audio output unit 603 can convert audio data received by the radio frequency unit 601 or the network module 602 or stored in the memory 609 into audio signals and output them as sound. Furthermore, the audio output unit 603 can also provide audio output related to specific functions performed by the electronic device 600 (e.g., call signal reception sound, message reception sound, etc.). The audio output unit 603 includes a speaker, a buzzer, and a receiver, etc.

[0168] Input unit 604 is used to receive audio or video signals. Input unit 604 may include a graphics processing unit (GPU) 6041 and a microphone 6042. GPU 6041 processes image data of still images or videos acquired by an image capture device (such as a camera) in video capture mode or image capture mode. The processed image frames can be displayed on display unit 606. The image frames processed by GPU 6041 can be stored in memory 609 (or other storage medium) or transmitted via radio frequency unit 601 or network module 602. Microphone 6042 can receive sound and process such sound into audio data. The processed audio data can be converted into a format that can be transmitted to a mobile communication base station via radio frequency unit 601 in telephone call mode.

[0169] The electronic device 600 also includes at least one sensor 605, such as a light sensor, a motion sensor, and other sensors. Specifically, the light sensor includes an ambient light sensor and a proximity sensor. The ambient light sensor can adjust the brightness of the display panel 6061 according to the ambient light level, and the proximity sensor can turn off the display panel 6061 and / or backlight when the electronic device 600 is moved to the ear. As a type of motion sensor, an accelerometer sensor can detect the magnitude of acceleration in various directions (generally three axes). When stationary, it can detect the magnitude and direction of gravity and can be used to identify the posture of the electronic device (such as landscape / portrait switching, related games, magnetometer posture calibration), vibration recognition related functions (such as pedometer, tapping), etc. The sensor 605 may also include a fingerprint sensor, pressure sensor, iris sensor, molecular sensor, gyroscope, barometer, hygrometer, thermometer, infrared sensor, etc., which will not be described in detail here.

[0170] The display unit 606 is used to display information input by the user or information provided to the user. The display unit 606 may include a display panel 6061, which may be configured in the form of a liquid crystal display (LCD), an organic light-emitting diode (OLED), or the like.

[0171] User input unit 607 can be used to receive input numerical or character information, and to generate key signal inputs related to user settings and function control of electronic devices. Specifically, user input unit 607 includes a touch panel 6071 and other input devices 6072. Touch panel 6071, also known as a touch screen, can collect touch operations performed by the user on or near it (such as operations performed by the user using a finger, stylus, or any suitable object or accessory on or near touch panel 6071). Touch panel 6071 may include two parts: a touch detection device and a touch controller. The touch detection device detects the user's touch position and the signal generated by the touch operation, and transmits the signal to the touch controller; the touch controller receives touch information from the touch detection device, converts it into touch point coordinates, and sends it to the processor 610, which receives and executes commands from the processor 610. In addition, touch panel 6071 can be implemented using various types such as resistive, capacitive, infrared, and surface acoustic wave. Besides touch panel 6071, user input unit 607 may also include other input devices 6072. Specifically, other input devices 6072 may include, but are not limited to, physical keyboards, function keys (such as volume control buttons, power buttons, etc.), trackballs, mice, joysticks, etc., which will not be described in detail here.

[0172] Furthermore, the touch panel 6071 can cover the display panel 6061. When the touch panel 6071 detects a touch operation on or near it, it transmits the information to the processor 610 to determine the type of touch event. Subsequently, the processor 610 provides corresponding visual output on the display panel 6061 based on the type of touch event. Although in Figure 6 In this embodiment, the touch panel 6071 and the display panel 6061 are two independent components to realize the input and output functions of the electronic device. However, in some embodiments, the touch panel 6071 and the display panel 6061 can be integrated to realize the input and output functions of the electronic device. The specific implementation is not limited here.

[0173] Interface unit 608 serves as an interface for connecting external devices to electronic device 600. For example, external devices may include a wired or wireless headphone port, an external power supply (or battery charger) port, a wired or wireless data port, a memory card port, a port for connecting a device with an identification module, an audio input / output (I / O) port, a video I / O port, a headphone port, and so on. Interface unit 608 can be used to receive input from external devices (e.g., data, power, etc.) and transmit the received input to one or more components within electronic device 600, or it can be used to transmit data between electronic device 600 and external devices.

[0174] The memory 609 can be used to store software programs and various data. The memory 609 may primarily include a program storage area and a data storage area. The program storage area may store the operating system, applications required for at least one function (such as sound playback, image playback, etc.), etc.; the data storage area may store data created based on the use of the mobile phone (such as audio data, phonebook, etc.). Furthermore, the memory 609 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0175] The processor 610 is the control center of the electronic device. It connects various parts of the electronic device via various interfaces and lines. By running or executing software programs and / or modules stored in the memory 609, and by calling data stored in the memory 609, it performs various functions and processes data, thereby providing overall monitoring of the electronic device. The processor 610 may include one or more processing units; preferably, the processor 610 may integrate an application processor and a modem processor. The application processor mainly handles the operating system, user interface, and applications, while the modem processor mainly handles wireless communication. It is understood that the modem processor may not be integrated into the processor 610.

[0176] The electronic device 600 may also include a power supply 611 (such as a battery) for supplying power to various components. Preferably, the power supply 611 is logically connected to the processor 610 through a power management system, thereby enabling functions such as managing charging, discharging, and power consumption through the power management system.

[0177] In addition, the electronic device 600 includes some functional modules not shown, which will not be described in detail here.

[0178] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0179] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0180] The embodiments of the present invention have been described above with reference to the accompanying drawings. However, the present invention is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of the present invention without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of the present invention.

[0181] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed in this invention can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0182] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0183] In the embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0184] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0185] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0186] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, essentially, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, ROM, RAM, magnetic disks, or optical disks.

[0187] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for generating a multi-level topological map, characterized in that, Applied to a cloud-native service framework, which includes a microservice platform, the method includes: The microservice platform obtains the record attribute information of the local server process, which includes at least the original process information and the process's network connection information. The local server process includes multiple services. The original process information is processed by regular expression matching, and the successfully matched original process information is tagged to obtain service information for the service. The service information is input into a preset service feature library to obtain the service group corresponding to the service information and the service group information of the service group. The service group information includes the target service group tag associated with the service group. Aggregate service groups whose target service group tags belong to the same type of tag to obtain the business system corresponding to the service group and the system attribute information of the business system. A multi-level topology map is generated based on the network connection information, the service information, the service group information, and the system attribute information. The multi-level topology map is used to display the network topology structure between the services, the service groups, and the business systems. The service information includes a target service tag and a target system tag. The target system tag represents the currently matched system tag, and the system tag is the tag of the business system. The target service tag represents the currently matched service tag, and the service tag is the tag of each service under the business system, used to characterize the function or type of the service. The step of inputting the service information into a preset service feature database to obtain the service group corresponding to the service information and the service group information of the service group includes: Input the target service tag and the target system tag into the preset service feature library, and output the service group corresponding to the service; The preset service group label associated with the service group is obtained by using the association relationship between the service group and the preset service group label, and the preset service group label is used as the target service group label.

2. The method according to claim 1, characterized in that, The original process information includes at least the server address, server process ID, and server process information for the local server. The step of obtaining the record attribute information of the local server process through the microservice platform includes: The microservice platform obtains the current port information and historical server information list of the local server. If the current port information is the same as the preset port information, then the server address, the server process ID, and the server process information are obtained from the historical server information list. The server process information includes at least the server process name, process startup user information, and process startup parameters.

3. The method according to claim 2, characterized in that, The network connection information includes communication connection relationships, and the step of obtaining the record attribute information of the local server process through the microservice platform includes: The microservice platform obtains a list of historical client addresses corresponding to the local server, and extracts the client addresses corresponding to the server addresses from the list of historical client addresses. Send a process ID query request to the client to which the client address belongs, and receive the client process ID returned by the client; Establish a communication connection between the server address, the server process ID, the client address, and the client process ID.

4. The method according to claim 2, characterized in that, The step of performing regular expression matching on the original process information and tagging the successfully matched original process information to obtain service information for the service includes: Obtain the target service tag and target system tag of the local server process; The process startup user information and process startup parameters are subjected to regular expression matching, and the successfully matched process startup user information and process startup parameters are associated with the target service tag and the target system tag to obtain service information for the service.

5. The method according to claim 1, characterized in that, The preset service feature library is generated in the following way: Obtain the historical service tags and historical system tags of the local server process; The historical service tags and the historical system tags are used as training data, and tag features are extracted from the training data. Services with the same tag features are aggregated to obtain service groups corresponding to the services. Establish the association between the service group and the preset service group tags, and generate the preset service feature library.

6. The method according to claim 1, characterized in that, The cloud-native service framework also includes a graph database engine, wherein generating a multi-level topology graph based on the network connection information, the service information, the service group information, and the system attribute information includes: The network connection information, service information, service group information, and system attribute information are input into the graph database engine to generate the multi-level topology graph; The multi-level topology map includes a service layer topology map, a service group layer topology map, and a system layer topology map.

7. A device for generating multi-level topological maps, characterized in that, Applied to a cloud-native service framework, the cloud-native service framework including a microservice platform, the device includes: The record attribute information acquisition module is used to acquire the record attribute information of the local server process through the microservice platform. The record attribute information includes at least the original process information and the network connection information of the process. The local server process includes multiple services. The service information acquisition module is used to perform regular expression matching on the original process information and to tag the successfully matched original process information to obtain service information for the service. The service group information acquisition module is used to input the service information into a preset service feature library to obtain the service group corresponding to the service information and the service group information of the service group. The service group information includes a target service group tag associated with the service group. The system attribute information acquisition module is used to aggregate service groups whose target service group tags belong to the same type of tag to obtain the business system corresponding to the service group and the system attribute information of the business system. A multi-level topology map generation module is used to generate a multi-level topology map based on the network connection information, the service information, the service group information, and the system attribute information. The multi-level topology map is used to display the network topology structure between the services, the service groups, and the business systems. The service information includes a target service tag and a target system tag. The target system tag represents the currently matched system tag, and the system tag is the tag of the business system. The target service tag represents the currently matched service tag, and the service tag is the tag of each service under the business system, used to characterize the function or type of the service. The service group information acquisition module is further configured to input the target service tag and the target system tag into the preset service feature library, output the service group corresponding to the service; obtain the preset service group tag associated with the service group by using the association relationship between the service group and the preset service group tag, and use the preset service group tag as the target service group tag.

8. An electronic device, characterized in that, It includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; The memory is used to store computer programs; When the processor executes a program stored in the memory, it implements the method as described in any one of claims 1-6.

9. A computer-readable storage medium having instructions stored thereon that, when executed by one or more processors, cause the processors to perform the method as described in any one of claims 1-6.

Images