Method, device and electronic device for discovering application association relationships

Abstract

The present invention discloses a method, device and electronic device for discovering application association relationships, and relates to the technical field of big data processing and mining. A specific implementation method of the method includes: aggregating session information and load balancing log information to obtain direct connection request information and load balancing request information; wherein the direct connection request information includes the source application IP, the target application IP and the target application port, and the load balancing request information includes the source application IP, the virtual IP of the load balancer, the virtual port of the load balancer, the target application IP and the target application port; obtaining the correspondence between each application IP and each application name from the configuration management database, thereby determining the calling relationship between each application based on the correspondence between each application IP and each application name, the direct connection request information and the load balancing request information. This implementation method can solve the technical problem that the workload of sorting out the association relationship between applications is large and easy to miss.

Description

Technical Field

[0001] The present invention relates to the field of big data processing and mining technology, and in particular to a method, device, electronic device and computer-readable medium for discovering application association relationships. Background Art

[0002] As enterprises grow in size and face extensive digitalization requirements, they may consider building their own computer rooms and servers to deploy their own applications. Applications generate requests from one another, and these requests form a mesh of network access relationships.

[0003] In the process of implementing the present invention, the inventors discovered that the prior art has at least the following problems:

[0004] As application systems continue to iterate and update, static application system documentation often remains out of sync. During application migration or disaster recovery, incomplete application system documentation, lacking application system architecture diagrams and documentation on inter-application system relationships, or outdated and outdated documentation, renders it useless as a basis for application migration or disaster recovery. To sort out application relationships, code and configuration analysis are often the only way to reorganize them, resulting in a significant workload and the risk of omissions. Summary of the Invention

[0005] In view of this, embodiments of the present invention provide a method, device, electronic device, and computer-readable medium for discovering application association relationships to solve the technical problem that sorting out association relationships between applications is labor-intensive and prone to omissions.

[0006] To achieve the above objective, according to one aspect of an embodiment of the present invention, a method for discovering application association relationships is provided, comprising:

[0007] Receive session information sent by each machine and the port opened for local application listening. The session information includes local application IP, local application port, external application IP and external application port;

[0008] Receive load balancing log information pushed by the load balancer, the load balancing log information including the source application IP, source application port, load balancer virtual IP, load balancer virtual port, target application IP and target application port;

[0009] Aggregating the session information and the load balancing log information to obtain direct connection request information and load balancing request information; wherein the direct connection request information includes the source application IP, the target application IP, and the target application port, and the load balancing request information includes the source application IP, the virtual IP of the load balancer, the virtual port of the load balancer, the target application IP, and the target application port;

[0010] The correspondence between each application IP and each application name is obtained from the configuration management database, thereby determining the calling relationship between each application according to the correspondence between each application IP and each application name, the direct connection request information and the load balancing request information.

[0011] Optionally, the session information and the load balancing log information are aggregated to obtain direct connection request information and load balancing request information, including:

[0012] For each session information, determine the source application port and the target application port in the session information according to the port that the local application opens for listening, thereby determining the source application IP and the target application IP in the session information;

[0013] The source application port, target application port, source application IP, target application IP and load balancing log information in the session information are aggregated and deduplicated to obtain direct connection request information and load balancing request information.

[0014] Optionally, determining the source application port and the target application port in the session information according to the port on which the local application starts listening, thereby determining the source application IP and the target application IP in the session information, includes:

[0015] Determine whether the local application port in the local session information is the same as the port on which the local application starts listening;

[0016] If yes, then use the local application port in the session information as the source application port and the external application port in the session information as the target application port, thereby using the local application IP in the session information as the source application IP and the external application IP in the session information as the target application IP;

[0017] If not, the external application port in the session information is used as the source application port, and the local application port in the session information is used as the target application port, thereby using the external application IP in the session information as the source application IP and the local application IP in the session information as the target application IP.

[0018] Optionally, the source application port, target application port, source application IP, target application IP, and load balancing log information in the session information are aggregated and deduplicated to obtain direct connection request information and load balancing request information, including:

[0019] Determine whether the local application IP or external application IP in the session information is the same as the virtual IP of the load balancer;

[0020] If not, deduplication is performed on the session information to obtain direct connection request information;

[0021] If so, the session information and the load balancing log information including the virtual IP of the load balancer are aggregated, and the aggregation result is deduplicated to obtain the load balancing request information.

[0022] Optionally, determining the calling relationship between the applications according to the corresponding relationship between the application IP addresses and the application names, the direct connection request information, and the load balancing request information includes:

[0023] For each direct connection request information, according to the correspondence between each application IP and each application name, respectively determine the source application name corresponding to the source application IP and the target application name corresponding to the target application IP in the direct connection request information, thereby obtaining the calling relationship between the source application and the target application;

[0024] For each load balancing request information, based on the correspondence between the application IPs and the application names, the source application name corresponding to the source application IP and the target application name corresponding to the target application IP in the load balancing request information are determined respectively, thereby obtaining the calling relationship between the source application calling the target application.

[0025] Optionally, after determining the calling relationship between the applications based on the correspondence between the application IP addresses and the application names, the direct connection request information, and the load balancing request information, the method further includes:

[0026] Obtain the correspondence between the load balancer's virtual IP and each application IP from the load balancer's backend;

[0027] Comparing the load balancing request information with the correspondence between the virtual IP of the load balancer and each target application IP, and determining whether there is an uncalled target application IP that does not appear in the load balancing request information;

[0028] Obtain a firewall whitelist of the uncalled target application, and determine whether there is a connection abnormality between the load balancer and the uncalled target application based on the firewall whitelist and the virtual IP of the load balancer.

[0029] In addition, according to another aspect of an embodiment of the present invention, a device for discovering application association relationships is provided, including:

[0030] The first receiving module is used to receive session information sent by each machine and the port opened for monitoring by the local application, wherein the session information includes the local application IP, local application port, external application IP and external application port;

[0031] The second receiving module is used to receive the load balancing log information pushed by the load balancer, wherein the load balancing log information includes the source application IP, the source application port, the virtual IP of the load balancer, the virtual port of the load balancer, the target application IP and the target application port;

[0032] an aggregation module, configured to aggregate the session information and the load balancing log information to obtain direct connection request information and load balancing request information; wherein the direct connection request information includes the source application IP, the target application IP, and the target application port, and the load balancing request information includes the source application IP, the virtual IP of the load balancer, the virtual port of the load balancer, the target application IP, and the target application port;

[0033] The discovery module is used to obtain the correspondence between each application IP and each application name from the configuration management database, thereby determining the calling relationship between each application based on the correspondence between each application IP and each application name, the direct connection request information and the load balancing request information.

[0034] Optionally, the aggregation module is further configured to:

[0035] For each session information, determine the source application port and the target application port in the session information according to the port that the local application opens for listening, thereby determining the source application IP and the target application IP in the session information;

[0036] The source application port, target application port, source application IP, target application IP and load balancing log information in the session information are aggregated and deduplicated to obtain direct connection request information and load balancing request information.

[0037] Optionally, the aggregation module is further configured to:

[0038] Determine whether the local application port in the local session information is the same as the port on which the local application starts listening;

[0039] If yes, then use the local application port in the session information as the source application port and the external application port in the session information as the target application port, thereby using the local application IP in the session information as the source application IP and the external application IP in the session information as the target application IP;

[0040] If not, the external application port in the session information is used as the source application port, and the local application port in the session information is used as the target application port, thereby using the external application IP in the session information as the source application IP and the local application IP in the session information as the target application IP.

[0041] Optionally, the aggregation module is further configured to:

[0042] Determine whether the local application IP or external application IP in the session information is the same as the virtual IP of the load balancer;

[0043] If not, deduplication is performed on the session information to obtain direct connection request information;

[0044] If so, the session information and the load balancing log information including the virtual IP of the load balancer are aggregated, and the aggregation result is deduplicated to obtain the load balancing request information.

[0045] Optionally, the discovery module is further configured to:

[0046] For each direct connection request information, according to the correspondence between each application IP and each application name, respectively determine the source application name corresponding to the source application IP and the target application name corresponding to the target application IP in the direct connection request information, thereby obtaining the calling relationship between the source application and the target application;

[0047] For each load balancing request information, based on the correspondence between the application IPs and the application names, the source application name corresponding to the source application IP and the target application name corresponding to the target application IP in the load balancing request information are determined respectively, thereby obtaining the calling relationship between the source application calling the target application.

[0048] Optionally, the discovery module is further configured to:

[0049] After determining the calling relationship between the applications based on the correspondence between the application IPs and the application names, the direct connection request information, and the load balancing request information, obtain the correspondence between the virtual IP of the load balancer and the application IPs from the backend of the load balancer;

[0050] Comparing the load balancing request information with the correspondence between the virtual IP of the load balancer and each target application IP, and determining whether there is an uncalled target application IP that does not appear in the load balancing request information;

[0051] Obtain a firewall whitelist of the uncalled target application, and determine whether there is a connection abnormality between the load balancer and the uncalled target application based on the firewall whitelist and the virtual IP of the load balancer.

[0052] According to another aspect of an embodiment of the present invention, there is further provided an electronic device, including:

[0053] one or more processors;

[0054] a storage device for storing one or more programs,

[0055] When the one or more programs are executed by the one or more processors, the one or more processors implement the method described in any one of the above embodiments.

[0056] According to another aspect of the embodiments of the present invention, a computer-readable medium is provided, on which a computer program is stored. When the program is executed by a processor, the method described in any one of the above embodiments is implemented.

[0057] According to another aspect of an embodiment of the present invention, a computer program product is provided, including a computer program. When the computer program is executed by a processor, the method described in any one of the above embodiments is implemented.

[0058] One embodiment of the above invention has the following advantages or beneficial effects: by aggregating session information and load balancing log information to obtain direct connection request information and load balancing request information, and obtaining the correspondence between each application IP address and each application name from a configuration management database, the call relationship between each application is determined based on the correspondence between each application IP address and each application name, the direct connection request information, and the load balancing request information. This overcomes the technical problem in the prior art of high workload and easy omissions in sorting out the association between applications. By aggregating session information and load balancer log information, the embodiment of the present invention accurately sorts out the call relationship between each application, not only reducing the workload of manual sorting, but also achieving high accuracy. Compared with the prior art, the embodiment of the present invention has the following beneficial effects: first, it is lightweight, simple to deploy, non-invasive to applications, and the deployment process does not require application restarts; second, it has strong compatibility, detection is independent of the application development language, and supports network access to hardware devices such as load balancers; third, it has wide coverage, and can collect data from both virtualized devices and physical machines.

[0059] The further effects of the above-mentioned non-conventional optional manner will be described below in conjunction with specific embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative work. Among them:

[0061] Figure 1 is a flowchart of a method for discovering application association relationships according to an embodiment of the present invention;

[0062] Figure 2 is a flowchart of a method for discovering application association relationships according to a reference embodiment of the present invention;

[0063] Figure 3 is a flowchart of a method for discovering application association relationships according to another reference embodiment of the present invention;

[0064] Figure 4 Schematic diagram of the system architecture for implementing the method for discovering application association relationships according to an embodiment of the present invention;

[0065] Figure 5 is a schematic diagram of a device for discovering application association relationships according to an embodiment of the present invention;

[0066] Figure 6 is an exemplary system architecture diagram in which embodiments of the present invention may be applied;

[0067] Figure 7 It is a schematic diagram of the structure of a computer system of a terminal device or a server suitable for implementing an embodiment of the present invention. DETAILED DESCRIPTION

[0068] The following description of exemplary embodiments of the present invention is made in conjunction with the accompanying drawings, in which various details of the embodiments of the present invention are included to facilitate understanding. These details should be considered as merely exemplary. Therefore, it should be appreciated by those skilled in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present invention. Similarly, for the sake of clarity and conciseness, descriptions of well-known functions and structures are omitted in the following description.

[0069] It should be noted that the collection, analysis, use, transmission, and storage of user personal information involved in the technical solutions of the present invention comply with relevant laws and regulations, are used for legitimate and reasonable purposes, are not shared, disclosed, or sold outside of these legitimate uses, and are subject to oversight and management by regulatory authorities. Necessary measures should be taken to prevent unauthorized access to such personal information data, ensure that persons with access to such personal information data comply with relevant laws and regulations, and ensure the security of user personal information. Once such user personal information data is no longer needed, risks should be minimized by restricting or even prohibiting its collection and / or deleting it.

[0070] When applicable, including in certain relevant applications, protect user privacy by de-identifying data, such as by removing specific identifiers (e.g., name, account number, age, gender, date of birth, etc.) when applicable, controlling the amount or specificity of stored data, controlling how data is stored, and / or other de-identification methods.

[0071] Figure 1 Flowchart of the method for discovering application association relationships according to an embodiment of the present invention. Figure 1 As shown, the method for discovering the application association relationship may include:

[0072] Step 101: Receive session information sent by each machine and the port opened for monitoring by the local application. The session information includes the local application IP, local application port, external application IP, and external application port.

[0073] On business systems that need to collect network access relationships, agents collect machine session information and the ports that local applications open for listening. For example, they use the netstat command to obtain the current session information and the ports that local applications open for listening. These information is then regularly reported to the application association discovery system. The session information obtained by the netstat command is as follows:

[0074] Local application IP Local application port External application IP External application port 10.8.22.1 24531 192.168.1.1 2181 10.8.22.1 7546 10.8.22.25 3306 10.8.22.1 8524 10.8.22.73 8848

[0075] Optionally, the machine may also upload a host name, and the host name of the machine may be obtained using the hostname command.

[0076] Step 102: Receive load balancing log information pushed by the load balancer, where the load balancing log information includes the source application IP, source application port, virtual IP of the load balancer, virtual port of the load balancer, target application IP, and target application port.

[0077] Load balancer: A network device, consisting of hardware or software, that processes request traffic and distributes it to backend services.

[0078] You can configure the load balancer's syslog (load balancing log information) in the load balancer's management background. The load balancer will push the generated load balancing log information to the application association discovery system.

[0079] The original syslog data structure is as follows:

[0080] {

[0081] "ip":"10.8.22.240",

[0082] "@timestamp":"2023-07-03T07:02:06.637Z",

[0083] "received_from":"10.8.22.240",

[0084] "offset":1,

[0085] "@version":"1",

[0086] "source_id":127,

[0087] "raw":" <134> 2023 Jul 03 15:02:06 10.18.128.28 52810 10.8.8.35 6001110.8.8.192 60011 http: / / 10.8.8.35 / you / api / ceocr 10.8.8.240\u0000",

[0088] "received_at":"2023-07-03T07:02:06.637Z",

[0089] "path":" / data / logstash / syslog_remote"

[0090] }

[0091] Parsing the raw field in the load balancing log information, the following table can be obtained based on the regular expression:

[0092] src_ip src_port vip_ip vip_port real_ip real_port 10.18.128.28 52810 10.8.8.35 60011 10.8.8.192 60011

[0093] Among them, src_ip is the source application IP, src_port is the source application port, vip_port is the virtual IP of the load balancer, vip_port is the virtual port of the load balancer, real_ip is the target application IP, and real_port is the target application port.

[0094] It should be noted that step 101 and step 102 may be performed simultaneously, or step 101 may be performed first and then step 102, or step 102 may be performed first and then step 101. This embodiment of the present invention does not limit this.

[0095] Step 103: Aggregate the session information and the load balancing log information to obtain direct connection request information and load balancing request information. The direct connection request information includes the source application IP, target application IP, and target application port, and the load balancing request information includes the source application IP, the load balancer's virtual IP, the load balancer's virtual port, the target application IP, and the target application port.

[0096] After receiving the session information uploaded by each machine and the load balancing log information uploaded by each load balancer, the session information and the load balancing log information are aggregated to obtain direct connection request information and load balancing request information. In an embodiment of the present invention, the direct connection request information represents the session information generated by the connection between two machines, and the load balancing request information represents the load balancing log information generated by the connection between the two machines through the load balancer; wherein the direct connection request information includes the source application IP, the target application IP, and the target application port, and the load balancing request information includes the source application IP, the virtual IP of the load balancer, the virtual port of the load balancer, the target application IP, and the target application port.

[0097] Optionally, step 103 may include: for each session information, determining the source application port and target application port in the session information based on the port on which the local application is enabled for listening, thereby determining the source application IP and target application IP in the session information; and aggregating and deduplicating the source application port, target application port, source application IP, target application IP, and load balancing log information in the session information to obtain direct connection request information and load balancing request information. Parsing the session information only reveals the local application IP and external application IP, but does not reveal which application is the requester and which application is the receiver. Therefore, embodiments of the present invention use the port on which the local application is enabled for listening to identify the source application port and target application port in the session information, thereby identifying the source application IP and target application IP in the session information. Next, aggregating and deduplicating the source application port, target application port, source application IP, target application IP, and load balancing log information in the session information to obtain direct connection request information and load balancing request information.

[0098] It should be noted that, for the receiver, the port on which the local application starts listening (ie, the target application port) usually does not change, and for the requester, the source application port is randomly generated.

[0099] Optionally, the source application port and the target application port in the session information are determined according to the port on which the local application starts listening, thereby determining the source application IP and the target application IP in the session information, including: judging whether the local application port in the local session information is the same as the port on which the local application starts listening; if so, taking the local application port in the session information as the source application port, and the external application port in the session information as the target application port, thereby taking the local application IP in the session information as the source application IP, and the external application IP in the session information as the target application IP; if not, taking the external application port in the session information as the source application port, and the local application port in the session information as the target application port, thereby taking the external application IP in the session information as the source application IP, and the local application IP in the session information as the target application IP. First, determine whether the local application port in the session information is the same as the port on which the local application starts listening. If the local application port is the same as the port on which the local application starts listening, use the local application port as the source application port, the external application port as the target application port, the local application IP as the source application IP, and the external application IP as the target application IP; if the local application port is different from the port on which the local application starts listening, use the external application port as the source application port, and use the local application port as the target application port, thereby using the external application IP as the source application IP and the local application IP as the target application IP.

[0100] Optionally, the source application port, target application port, source application IP, target application IP and the load balancing log information in the session information are aggregated and deduplicated to obtain direct connection request information and load balancing request information, including: determining whether the local application IP or external application IP in the session information is the same as the virtual IP of the load balancer; if not, deduplicating the session information to obtain direct connection request information; if so, aggregating the session information and the load balancing log information containing the virtual IP of the load balancer, and deduplicating the aggregation result to obtain load balancing request information. Specifically, determine whether the local application IP or external application IP in the session information is the same as the virtual IP of the load balancer. If the local application IP or external application IP in the session information is different from the virtual IP of the load balancer, it means that the local application is directly connected to the external application, and then directly deduplicate the session information; if the local application IP or external application IP in the session information is the same as the virtual IP of the load balancer, it means that the local application is connected to the external application through the load balancer, then first aggregate the session information and the load balancing log information containing the virtual IP of the load balancer, and then deduplicate the aggregation result to obtain the load balancing request information.

[0101] Therefore, step 103 can filter, aggregate, and remove duplicates from the session information of step 101 and the load balancing log information of step 103. For example, the following direct connection request information and load balancing request information can be obtained:

[0102] Source application IP The virtual IP of the load balancer Virtual port of the load balancer Target application IP Target application port 10.18.12.11 10.18.12.51 9080 10.18.12.12 10.18.12.62 9090 10.18.12.15 10.18.51.35 80 10.18.12.2 80 10.18.12.15 10.18.51.35 80 10.18.12.3 80

[0103] Step 104: Obtain the correspondence between each application IP and each application name from the configuration management database, thereby determining the calling relationship between each application based on the correspondence between each application IP and each application name, the direct connection request information, and the load balancing request information.

[0104] Finally, the correspondence between each application IP and each application name is obtained from the configuration management database (such as CMDB), so as to determine the calling relationship between each application based on the correspondence between each application IP and each application name, as well as the direct connection request information and load balancing request information aggregated in step 103.

[0105] Optionally, based on the correspondence between the application IPs and the application names, the direct connection request information, and the load balancing request information, the calling relationship between the applications is determined, including: for each direct connection request information, based on the correspondence between the application IPs and the application names, the source application name corresponding to the source application IP in the direct connection request information and the target application name corresponding to the target application IP are determined, thereby obtaining the calling relationship between the source application calling the target application; for each load balancing request information, based on the correspondence between the application IPs and the application names, the source application name corresponding to the source application IP in the load balancing request information and the target application name corresponding to the target application IP are determined, thereby obtaining the calling relationship between the source application calling the target application. For example, the following results can be obtained:

[0106]

[0107]

[0108] Based on the above results, the calling relationships between applications can be sorted out as follows:

[0109] Application A --> Application C;

[0110] Application A --> Application D;

[0111] Application B --> Application D (direct connection, no load balancing SLB);

[0112] Application B --> Application E;

[0113] Application B --> Application F.

[0114] According to the various embodiments described above, it can be seen that the embodiments of the present invention obtain direct connection request information and load balancing request information by aggregating session information and load balancing log information, and obtain the correspondence between each application IP and each application name from the configuration management database. Based on the correspondence between each application IP and each application name, the direct connection request information and the load balancing request information, the technical means for determining the call relationship between each application solves the technical problem in the prior art that the workload of sorting out the association relationship between applications is large and easy to miss. The embodiments of the present invention accurately sort out the call relationship between each application by aggregating session information and load balancer log information, which not only reduces the workload of manual sorting but also has high accuracy. Compared with the prior art, the embodiments of the present invention have the following advantages: First, it is lightweight, simple to deploy, non-invasive to applications, and the deployment process does not require restarting the application; second, it has strong compatibility, and the detection is independent of the application development language, and supports network access to hardware devices such as load balancers; third, it has wide coverage, and can collect data from both virtualized devices and physical machines.

[0115] Figure 2 Flowchart of a method for discovering application association relationships according to a reference embodiment of the present invention. As another embodiment of the present invention, Figure 2 As shown, the method for discovering the application association relationship may include:

[0116] Step 201: Receive session information sent by each machine and the port opened for monitoring by the local application. The session information includes the local application IP, local application port, external application IP, and external application port.

[0117] Step 202: Receive load balancing log information pushed by the load balancer, where the load balancing log information includes the source application IP, source application port, virtual IP of the load balancer, virtual port of the load balancer, target application IP, and target application port.

[0118] It should be noted that step 201 and step 202 may be performed simultaneously, or step 201 may be performed first and then step 202, or step 202 may be performed first and then step 201. This embodiment of the present invention does not limit this.

[0119] Step 203 : for each session information, determine whether the local application port in the local session information is the same as the port on which the local application starts listening; if so, execute step 204 ; if not, execute step 205 .

[0120] Step 204: Use the local application port in the session information as the source application port and the external application port in the session information as the target application port, thereby using the local application IP in the session information as the source application IP and the external application IP in the session information as the target application IP.

[0121] Step 205: Use the external application port in the session information as the source application port and the local application port in the session information as the target application port, thereby using the external application IP in the session information as the source application IP and the local application IP in the session information as the target application IP.

[0122] Step 206 , determining whether the local application IP or external application IP in the session information is the same as the virtual IP of the load balancer; if not, executing step 207 ; if yes, executing step 208 .

[0123] Step 207: De-duplicate the session information to obtain direct connection request information.

[0124] Step 208 : Aggregate the session information and the load balancing log information including the virtual IP of the load balancer, and deduplicate the aggregation result to obtain load balancing request information.

[0125] The direct connection request information includes the source application IP, the target application IP, and the target application port; the load balancing request information includes the source application IP, the virtual IP of the load balancer, the virtual port of the load balancer, the target application IP, and the target application port;

[0126] Step 209: Obtain the correspondence between each application IP and each application name from the configuration management database, thereby determining the calling relationship between each application based on the correspondence between each application IP and each application name, the direct connection request information, and the load balancing request information.

[0127] Specifically, for each direct connection request information, based on the correspondence between each application IP and each application name, the source application name corresponding to the source application IP and the target application name corresponding to the target application IP in the direct connection request information are determined respectively, thereby obtaining the calling relationship of the source application calling the target application; for each load balancing request information, based on the correspondence between each application IP and each application name, the source application name corresponding to the source application IP and the target application name corresponding to the target application IP in the load balancing request information are determined respectively, thereby obtaining the calling relationship of the source application calling the target application.

[0128] In addition, the specific implementation content of the method for discovering application association relationships in a reference embodiment of the present invention has been described in detail in the above-mentioned method for discovering application association relationships, so the repeated content will not be described again here.

[0129] Figure 3 Flowchart of a method for discovering application association relationships according to another embodiment of the present invention. Figure 3 As shown, the method for discovering the application association relationship may include:

[0130] Step 301: Receive session information sent by each machine and the port opened for monitoring by the local application. The session information includes the local application IP, local application port, external application IP, and external application port.

[0131] Step 302: Receive load balancing log information pushed by the load balancer, where the load balancing log information includes the source application IP, source application port, virtual IP of the load balancer, virtual port of the load balancer, target application IP, and target application port.

[0132] Step 303: Aggregate the session information and the load balancing log information to obtain direct connection request information and load balancing request information. The direct connection request information includes the source application IP, target application IP, and target application port, and the load balancing request information includes the source application IP, the load balancer's virtual IP, the load balancer's virtual port, the target application IP, and the target application port.

[0133] Step 304: Obtain the correspondence between each application IP and each application name from the configuration management database, thereby determining the calling relationship between each application based on the correspondence between each application IP and each application name, the direct connection request information, and the load balancing request information.

[0134] Step 305: Obtain the correspondence between the virtual IP of the load balancer and each application IP from the background of the load balancer.

[0135] Step 306 : Compare the load balancing request information with the correspondence between the virtual IP of the load balancer and each target application IP, and determine whether there is an uncalled target application IP that does not appear in the load balancing request information.

[0136] Step 307: Obtain the firewall whitelist of the uncalled target application, and determine whether there is a connection abnormality between the load balancer and the uncalled target application based on the firewall whitelist and the virtual IP of the load balancer.

[0137] In this embodiment, the correspondence between the virtual IP of each load balancer and each application IP (the virtual IP of each load balancer corresponds to at least one application IP) can also be obtained from the management background of the load balancer, and the aggregated load balancing request information and the correspondence between the virtual IP of each load balancer and each application IP are compared to determine whether there is a target application IP that does not appear in the load balancing request information. If so, it means that the target application has not been called, and the firewall whitelist of the uncalled target application is obtained; further determine whether the virtual IP of the load balancer exists in the firewall whitelist. If so, it means that there is a connection abnormality between the load balancer and the uncalled target application.

[0138] In addition, the specific implementation content of the application association relationship discovery method in another reference embodiment of the present invention has been described in detail in the application association relationship discovery method described above, so the repeated content will not be described again here.

[0139] Figure 4 Schematic diagram of the system architecture for realizing the method for discovering application association relationships according to an embodiment of the present invention. Figure 4As shown, the method for discovering application association relationships includes the following steps:

[0140] Step 1: Write a script for collecting session information on machines and distribute it using a management platform (Ansible) or manually configuring Crontab. This allows the machines to execute the script regularly, for example, every 5 minutes. The script executes commands such as netstat and curl to collect session information and send it to a pre-configured file server.

[0141] Step 2: Start a scheduled service that periodically obtains the script execution results from the file server and parses the network access relationship to obtain the machine session information. The session information of each machine is written into the MYSQL database.

[0142] Step 3: Write a logstash script to listen to the port number and send the monitored results to ElasticSearch.

[0143] Step 4: Configure the syslog information of the load balancer (slb) in the management background, configure the output end to the listening address and port of logstash, and enable slb to start sending data to logstash.

[0144] Step 5: Start a scheduled service that regularly obtains syslog information from ElasticSearch, parses the content, obtains request information of network traffic passing through SLB (i.e. load balancing log information), and writes the information to the MYSQL database.

[0145] Step 6: You need to find the correspondence between each application IP and each application name, which is generally recorded in cmdb or in local files. Import the data into the MYSQL database.

[0146] Step 7: Send the SLB configuration information, such as the current VIP list, the load balancing machine information list under each VIP, keepalive information, etc., to the database.

[0147] VIP: In networking, "VIP" typically refers to a "Virtual IP," or virtual IP address. A virtual IP is a special IP address used in load balancing or failover scenarios to forward traffic from the sender to a specific backend service, achieving load balancing and high availability.

[0148] Step 8: Merge the information written to the database. The merged result includes information such as the source application IP, the virtual IP of the load balancer, the virtual port of the load balancer, the target application IP, the target application port, the service name, and the host name.

[0149] Figure 5 FIG. 1 is a schematic diagram of a device for discovering application association relationships according to an embodiment of the present invention. Figure 5 As shown, the application association relationship discovery device 500 includes a first receiving module 501, a second receiving module 502, an aggregation module 503 and a discovery module 504; wherein the first receiving module 501 is used to receive session information sent by each machine and the port on which the local application opens for listening, the session information includes the local application IP, the local application port, the external application IP and the external application port; the second receiving module 502 is used to receive the load balancing log information pushed by the load balancer, the load balancing log information includes the source application IP, the source application port, the virtual IP of the load balancer, the virtual port of the load balancer, the target application IP and the target application port; the aggregation module 50 3 is used to aggregate the session information and the load balancing log information to obtain direct connection request information and load balancing request information; wherein the direct connection request information includes the source application IP, the target application IP and the target application port, and the load balancing request information includes the source application IP, the virtual IP of the load balancer, the virtual port of the load balancer, the target application IP and the target application port; the discovery module 504 is used to obtain the correspondence between each application IP and each application name from the configuration management database, thereby determining the calling relationship between each application based on the correspondence between each application IP and each application name, the direct connection request information and the load balancing request information.

[0150] Optionally, the aggregation module 503 is further configured to:

[0151] For each session information, determine the source application port and the target application port in the session information according to the port that the local application opens for listening, thereby determining the source application IP and the target application IP in the session information;

[0152] The source application port, target application port, source application IP, target application IP and load balancing log information in the session information are aggregated and deduplicated to obtain direct connection request information and load balancing request information.

[0153] Optionally, the aggregation module 503 is further configured to:

[0154] Determine whether the local application port in the local session information is the same as the port on which the local application starts listening;

[0155] If yes, then use the local application port in the session information as the source application port and the external application port in the session information as the target application port, thereby using the local application IP in the session information as the source application IP and the external application IP in the session information as the target application IP;

[0156] If not, the external application port in the session information is used as the source application port, and the local application port in the session information is used as the target application port, thereby using the external application IP in the session information as the source application IP and the local application IP in the session information as the target application IP.

[0157] Optionally, the aggregation module 503 is further configured to:

[0158] Determine whether the local application IP or external application IP in the session information is the same as the virtual IP of the load balancer;

[0159] If not, deduplication is performed on the session information to obtain direct connection request information;

[0160] If so, the session information and the load balancing log information including the virtual IP of the load balancer are aggregated, and the aggregation result is deduplicated to obtain the load balancing request information.

[0161] Optionally, the discovery module 504 is further configured to:

[0162] For each direct connection request information, according to the correspondence between each application IP and each application name, respectively determine the source application name corresponding to the source application IP and the target application name corresponding to the target application IP in the direct connection request information, thereby obtaining the calling relationship between the source application and the target application;

[0163] For each load balancing request information, based on the correspondence between the application IPs and the application names, the source application name corresponding to the source application IP and the target application name corresponding to the target application IP in the load balancing request information are determined respectively, thereby obtaining the calling relationship between the source application calling the target application.

[0164] Optionally, the discovery module 504 is further configured to:

[0165] After determining the calling relationship between the applications based on the correspondence between the application IPs and the application names, the direct connection request information, and the load balancing request information, obtain the correspondence between the virtual IP of the load balancer and the application IPs from the backend of the load balancer;

[0166] Comparing the load balancing request information with the correspondence between the virtual IP of the load balancer and each target application IP, and determining whether there is an uncalled target application IP that does not appear in the load balancing request information;

[0167] Obtain a firewall whitelist of the uncalled target application, and determine whether there is a connection abnormality between the load balancer and the uncalled target application based on the firewall whitelist and the virtual IP of the load balancer.

[0168] It should be noted that the specific implementation content of the device for discovering application association relationships described in the present invention has been described in detail in the above-mentioned method for discovering application association relationships, so the details will not be repeated here.

[0169] Figure 6 An exemplary system architecture 600 is shown to which the method for discovering application association relationships or the apparatus for discovering application association relationships according to an embodiment of the present invention may be applied.

[0170] like Figure 6 As shown, system architecture 600 may include terminal devices 601, 602, 603, a network 604, and a server 605. Network 604 is used to provide a medium for communication links between terminal devices 601, 602, 603 and server 605. Network 604 may include various connection types, such as wired or wireless communication links or fiber optic cables.

[0171] Users can use terminal devices 601, 602, and 603 to interact with server 605 via network 604 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 601, 602, and 603, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only as examples).

[0172] The terminal devices 601 , 602 , and 603 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, and desktop computers.

[0173] Server 605 may be a server that provides various services, such as a backend management server (for example only) that supports shopping websites browsed by users using terminal devices 601, 602, and 603. The backend management server may analyze and process received data such as item information query requests, and feed back the processing results to the terminal device.

[0174] It should be noted that the method for discovering application association relationships provided in the embodiment of the present invention is generally executed by the server 605 . Accordingly, the device for discovering application association relationships is generally provided in the server 605 .

[0175] It should be understood that Figure 6 The number of terminal devices, networks and servers in the embodiment is merely illustrative. Any number of terminal devices, networks and servers may be provided as required.

[0176] Reference below Figure 7 , which shows a schematic structural diagram of a computer system 700 of a terminal device suitable for implementing an embodiment of the present invention. Figure 7 The terminal device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0177] like Figure 7 As shown, the computer system 700 includes a central processing unit (CPU) 701, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 702 or a program loaded from a storage unit 708 into a random access memory (RAM) 703. Various programs and data required for the operation of the system 700 are also stored in the RAM 703. The CPU 701, ROM 702, and RAM 703 are connected to each other via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0178] The following components are connected to the I / O interface 705: an input section 706 including a keyboard, a mouse, and the like; an output section 707 including devices such as a cathode ray tube (CRT), a liquid crystal display (LCD), and a speaker; a storage section 708 including a hard disk; and a communication section 709 including a network interface card such as a LAN card or a modem. The communication section 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to the I / O interface 705 as needed. A removable medium 711, such as a magnetic disk, an optical disk, a magneto-optical disk, or a semiconductor memory, is installed in the drive 710 as needed, so that computer programs read therefrom can be installed into the storage section 708 as needed.

[0179] In particular, according to the embodiments disclosed in the present invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, the embodiments disclosed in the present invention include a computer program comprising a computer program carried on a computer-readable medium, the computer program comprising program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 709, and / or installed from a removable medium 711. When the computer program is executed by the central processing unit (CPU) 701, the above-mentioned functions defined in the system of the present invention are executed.

[0180] It should be noted that the computer-readable medium described in the present invention can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of computer-readable storage media can include, but are not limited to, an electrical connection having one or more conductors, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In the present invention, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. This propagated data signal can take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium that can transmit, propagate, or transport a program for use by or in conjunction with an instruction execution system, apparatus, or device. Program code embodied on a computer-readable medium may be transmitted using any suitable medium, including but not limited to wireless, wireline, optical fiber cable, RF, or any suitable combination thereof.

[0181] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the systems, methods and computer programs according to various embodiments of the present invention. In this regard, each box in the flowchart or block diagram can represent a module, program segment, or a part of code, and the above-mentioned module, program segment, or a part of code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart, can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0182] The modules described in the embodiments of the present invention may be implemented in software or hardware. The modules may also be provided in a processor. For example, a processor may be described as comprising a first receiving module, a second receiving module, an aggregation module, and a discovery module. The names of these modules do not, in some cases, limit the modules themselves.

[0183] As another aspect, the present invention further provides a computer-readable medium, which may be included in the device described in the above embodiment; or may exist independently without being assembled into the device. The computer-readable medium carries one or more programs. When the one or more programs are executed by a device, the device implements the following method: receiving session information sent by each machine and the port opened for listening by the local application, the session information including the local application IP, local application port, external application IP, and external application port; receiving load balancing log information pushed by the load balancer, the load balancing log information including the source application IP, source application port, virtual IP of the load balancer, virtual port of the load balancer, target application IP, and target application port; aggregating the session information and the load balancing log information to obtain direct connection request information and load balancing request information; wherein the direct connection request information includes the source application IP, target application IP, and target application port, and the load balancing request information includes the source application IP, virtual IP of the load balancer, virtual port of the load balancer, target application IP, and target application port; obtaining the correspondence between each application IP and each application name from a configuration management database, and thereby determining the calling relationship between each application based on the correspondence between each application IP and each application name, the direct connection request information, and the load balancing request information.

[0184] As another aspect, an embodiment of the present invention further provides a computer program product, including a computer program, which implements the method described in any of the above embodiments when executed by a processor.

[0185] According to the technical solution of the embodiment of the present invention, because the session information and load balancing log information are aggregated to obtain direct connection request information and load balancing request information, the correspondence between each application IP and each application name is obtained from the configuration management database, and the calling relationship between each application is determined based on the correspondence between each application IP and each application name, the direct connection request information and the load balancing request information. Therefore, the technical problem of the existing technology that the workload of sorting out the association relationship between applications is large and easy to miss is overcome. The embodiment of the present invention accurately sorts out the calling relationship between each application by aggregating session information and load balancer log information, which not only reduces the workload of manual sorting, but also has high accuracy. Compared with the existing technology, the embodiment of the present invention has the following advantages: first, it is lightweight, simple to deploy, non-invasive to the application, and the deployment process does not require restarting the application; second, it has strong compatibility, and the detection is independent of the application development language, and can support network access to hardware devices such as load balancers; third, it has wide coverage, and can collect data from both virtualized devices and physical machines.

[0186] The above specific embodiments do not limit the scope of protection of the present invention. Those skilled in the art will appreciate that various modifications, combinations, sub-combinations, and substitutions may occur depending on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention are intended to be included within the scope of protection of the present invention.

Claims

1. A method for discovering application association relationships, characterized in that: include: Receive session information sent by each machine and the port opened for local application listening. The session information includes local application IP, local application port, external application IP and external application port; Receive load balancing log information pushed by the load balancer, the load balancing log information including the source application IP, source application port, load balancer virtual IP, load balancer virtual port, target application IP and target application port; Aggregating the session information and the load balancing log information to obtain direct connection request information and load balancing request information; wherein the direct connection request information includes the source application IP, the target application IP, and the target application port, and the load balancing request information includes the source application IP, the virtual IP of the load balancer, the virtual port of the load balancer, the target application IP, and the target application port; The correspondence between each application IP and each application name is obtained from the configuration management database, thereby determining the calling relationship between each application according to the correspondence between each application IP and each application name, the direct connection request information and the load balancing request information.

2. The method according to claim 1, characterized in that Aggregating the session information and the load balancing log information to obtain direct connection request information and load balancing request information, including: For each session information, determine the source application port and the target application port in the session information according to the port that the local application opens for listening, thereby determining the source application IP and the target application IP in the session information; The source application port, target application port, source application IP, target application IP and load balancing log information in the session information are aggregated and deduplicated to obtain direct connection request information and load balancing request information.

3. The method according to claim 2, characterized in that Determining the source application port and the target application port in the session information according to the port on which the local application starts listening, thereby determining the source application IP and the target application IP in the session information, including: Determine whether the local application port in the local session information is the same as the port on which the local application starts listening; If yes, then use the local application port in the session information as the source application port and the external application port in the session information as the target application port, thereby using the local application IP in the session information as the source application IP and the external application IP in the session information as the target application IP; If not, the external application port in the session information is used as the source application port, and the local application port in the session information is used as the target application port, thereby using the external application IP in the session information as the source application IP and the local application IP in the session information as the target application IP.

4. The method according to claim 2, characterized in that Aggregate and deduplicate the source application port, target application port, source application IP, target application IP, and load balancing log information in the session information to obtain direct connection request information and load balancing request information, including: Determine whether the local application IP or external application IP in the session information is the same as the virtual IP of the load balancer; If not, deduplication is performed on the session information to obtain direct connection request information; If so, the session information and the load balancing log information including the virtual IP of the load balancer are aggregated, and the aggregation result is deduplicated to obtain the load balancing request information.

5. The method according to claim 1, wherein Determining the calling relationship between the applications based on the correspondence between the application IP addresses and the application names, the direct connection request information, and the load balancing request information, including: For each direct connection request information, according to the correspondence between each application IP and each application name, respectively determine the source application name corresponding to the source application IP and the target application name corresponding to the target application IP in the direct connection request information, thereby obtaining the calling relationship between the source application and the target application; For each load balancing request information, based on the correspondence between the application IPs and the application names, the source application name corresponding to the source application IP and the target application name corresponding to the target application IP in the load balancing request information are determined respectively, thereby obtaining the calling relationship between the source application calling the target application.

6. The method according to claim 1, characterized in that After determining the calling relationship between the applications based on the correspondence between the application IP addresses and the application names, the direct connection request information, and the load balancing request information, the method further includes: Obtain the correspondence between the load balancer's virtual IP and each application IP from the load balancer's backend; Comparing the load balancing request information with the correspondence between the virtual IP of the load balancer and each target application IP, and determining whether there is an uncalled target application IP that does not appear in the load balancing request information; Obtain a firewall whitelist of the uncalled target application, and determine whether there is a connection abnormality between the load balancer and the uncalled target application based on the firewall whitelist and the virtual IP of the load balancer.

7. A device for discovering application association relationships, characterized in that: include: The first receiving module is used to receive session information sent by each machine and the port opened for monitoring by the local application, wherein the session information includes the local application IP, local application port, external application IP and external application port; The second receiving module is used to receive the load balancing log information pushed by the load balancer, wherein the load balancing log information includes the source application IP, the source application port, the virtual IP of the load balancer, the virtual port of the load balancer, the target application IP and the target application port; an aggregation module, configured to aggregate the session information and the load balancing log information to obtain direct connection request information and load balancing request information; wherein the direct connection request information includes the source application IP, the target application IP, and the target application port, and the load balancing request information includes the source application IP, the virtual IP of the load balancer, the virtual port of the load balancer, the target application IP, and the target application port; The discovery module is used to obtain the correspondence between each application IP and each application name from the configuration management database, thereby determining the calling relationship between each application based on the correspondence between each application IP and each application name, the direct connection request information and the load balancing request information.

8. The device according to claim 7, characterized in that The aggregation module is further configured to: For each session information, determine the source application port and the target application port in the session information according to the port that the local application opens for listening, thereby determining the source application IP and the target application IP in the session information; The source application port, target application port, source application IP, target application IP and load balancing log information in the session information are aggregated and deduplicated to obtain direct connection request information and load balancing request information.

9. The device according to claim 8, characterized in that The aggregation module is further configured to: Determine whether the local application port in the local session information is the same as the port on which the local application starts listening; If yes, then use the local application port in the session information as the source application port and the external application port in the session information as the target application port, thereby using the local application IP in the session information as the source application IP and the external application IP in the session information as the target application IP; If not, the external application port in the session information is used as the source application port, and the local application port in the session information is used as the target application port, thereby using the external application IP in the session information as the source application IP and the local application IP in the session information as the target application IP.

10. The device according to claim 8, characterized in that The aggregation module is further configured to: Determine whether the local application IP or external application IP in the session information is the same as the virtual IP of the load balancer; If not, deduplication is performed on the session information to obtain direct connection request information; If so, the session information and the load balancing log information including the virtual IP of the load balancer are aggregated, and the aggregation result is deduplicated to obtain the load balancing request information.

11. The device according to claim 7, characterized in that The discovery module is also used to: For each direct connection request information, according to the correspondence between each application IP and each application name, respectively determine the source application name corresponding to the source application IP and the target application name corresponding to the target application IP in the direct connection request information, thereby obtaining the calling relationship between the source application and the target application; For each load balancing request information, based on the correspondence between the application IPs and the application names, the source application name corresponding to the source application IP and the target application name corresponding to the target application IP in the load balancing request information are determined respectively, thereby obtaining the calling relationship between the source application calling the target application.

12. The device according to claim 7, characterized in that The discovery module is also used to: After determining the calling relationship between the applications based on the correspondence between the application IPs and the application names, the direct connection request information, and the load balancing request information, obtain the correspondence between the virtual IP of the load balancer and the application IPs from the backend of the load balancer; Comparing the load balancing request information with the correspondence between the virtual IP of the load balancer and each target application IP, and determining whether there is an uncalled target application IP that does not appear in the load balancing request information; Obtain a firewall whitelist of the uncalled target application, and determine whether there is a connection abnormality between the load balancer and the uncalled target application based on the firewall whitelist and the virtual IP of the load balancer.

13. An electronic device, characterized in that: include: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 6.

14. A computer-readable medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

15. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images