A system resource early warning method, device, equipment and storage medium

Abstract

The application provides a system resource early warning method, device and equipment and a storage medium, the system resource early warning method comprises the following steps: collecting resource data of a system, wherein the resource data comprises memory data, CPU data and hard disk data; processing the collected resource data based on a hierarchical real-time memory algorithm to obtain an abnormal state prediction value of the resource data of the system; and when the abnormal state prediction value meets a triggering condition, performing resource early warning judgment on the system based on the abnormal state prediction value and obtained traffic data of the system. The system resource early warning method can efficiently and accurately perform early warning and troubleshooting on system resources of a security gateway device.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a system resource early warning method, apparatus, device, and storage medium. Background Technology

[0002] Security gateway devices play a crucial role in networks, monitoring and filtering incoming and outgoing traffic to ensure network security and stability. However, because security gateway devices need to handle large volumes of network traffic and complex security policies, their system resource usage is often difficult to detect immediately, easily overlooked, and can lead to potential security vulnerabilities.

[0003] Changes in system resources are typically slow and gradual, meaning that noticeable anomalies may not be apparent in the short term. For example, a gradual increase in network traffic could be due to malicious activity or a cyberattack, while the slow development of a memory leak could lead to a decline in device performance.

[0004] To address the above problems, existing solutions include: Real-time monitoring and alerting: The system resources of the security gateway device are monitored and statistically analyzed in real time, including metrics such as CPU utilization, memory usage, and network traffic. These metrics are compared to thresholds, and alerts are issued when thresholds are exceeded.

[0005] However, the drawback of the above solution is that the security gateway is already heavily loaded. Once an alarm occurs, it often affects network forwarding or the effectiveness of security detection, leaving security operations personnel with very little time to expand capacity or troubleshoot the problem. Summary of the Invention

[0006] This invention provides a system resource early warning method, apparatus, device, and storage medium that can efficiently and accurately conduct early warning and investigation of system resources of security gateway devices.

[0007] To address the aforementioned technical problems, embodiments of the present invention provide a system resource early warning method, comprising: The system collects resource data, including memory data, CPU data, and hard disk data. The collected resource data is processed based on a hierarchical real-time memory algorithm to obtain anomaly prediction values ​​for the resource data of the system. If the predicted abnormal state value meets the triggering conditions, a resource early warning judgment is made on the system based on the predicted abnormal state value and the obtained system traffic data.

[0008] As an optional embodiment, the resource data of the acquisition system includes: Resource data from the system is collected based on a preset early warning cycle.

[0009] As an optional embodiment, the step of processing the collected resource data based on the hierarchical real-time memory algorithm to obtain anomaly state prediction values ​​for the system's resource data includes: The resource data is encoded to establish a discrete and sparse representation of the resource data; The discrete sparse features are input into a hierarchical real-time memory model to identify, store, and learn the implicit state of the data, so as to calculate the abnormal state prediction value of the corresponding input resource data.

[0010] As an optional embodiment, the calculation of the abnormal state prediction value corresponding to the input resource data includes: The predicted value s of the abnormal state is calculated based on the following formula: , in, for A cell column that is constantly in a state of prediction. for A cell column that is always in an active state. Indicates that it was predicted that in The formula represents the number of activated cell columns, with the denominator indicating the number of activated cell columns and the numerator representing the number of activated cell columns that were not correctly predicted.

[0011] As an optional embodiment, the step of performing a resource early warning judgment on the system based on the abnormal state prediction value and the obtained system traffic data when the abnormal state prediction value meets the triggering condition includes: Obtain the traffic data of the system; When the predicted value of the abnormal state exceeds the preset threshold range, it is determined whether the traffic change and the predicted value of the abnormal state satisfy a synchronization relationship based on the traffic data. The synchronization relationship represents the matching of the change trend of the traffic change and the predicted value of the abnormal state. If the conditions are met, a prompt will be output indicating that the current system's resource data is abnormal and the traffic is abnormally increasing.

[0012] As an optional embodiment, the traffic data includes at least one of the following: Traffic volume, traffic rate, connection duration, and data packet size.

[0013] As an optional embodiment, the memory data includes at least one of the following: Total memory, available memory, used memory, memory utilization rate; The CPU data includes at least one of the following: CPU utilization, number of processes, number of threads; The hard disk data includes at least one of the following: Total hard disk space, used hard disk space, available hard disk space, hard disk utilization, number of disk I / O operations.

[0014] Another embodiment of the present invention also provides a system resource early warning device, comprising: The acquisition module is used to acquire system resource data, including memory data, CPU data, and hard disk data. The processing module is used to process the collected resource data according to the hierarchical real-time memory algorithm to obtain the abnormal state prediction value of the resource data of the system; The early warning judgment module is used to make resource early warning judgments on the system based on the abnormal state prediction value and the obtained system traffic data when the abnormal state prediction value meets the triggering conditions.

[0015] Another embodiment of the present invention also provides an electronic device, comprising: At least one processor; and, A memory that is communicatively connected to the at least one processor; The memory stores instructions that can be executed by the at least one processor, and the instructions are configured to execute the above-described system resource early warning method.

[0016] Another embodiment of the present invention provides a storage medium including a stored program, wherein, when the program is running, a device including the storage medium is controlled to perform the system resource early warning method as described in any of the embodiments above.

[0017] Another embodiment of the present invention also provides a computer program product tangibly stored on a computer-readable medium and including computer-executable instructions that, when executed, cause at least one processor to perform a system resource warning method such as those described in the embodiments above.

[0018] Based on the disclosure of the above embodiments, it can be understood that the beneficial effects of the embodiments of the present invention include: collecting resource data of the security gateway device system, including memory data, CPU data, and hard disk data; then processing the collected resource data based on a hierarchical real-time memory algorithm to obtain anomaly state prediction values ​​for the system's resource data; judging the anomaly state prediction values; and, if the anomaly state prediction values ​​meet the triggering conditions, performing resource early warning judgment on the system based on the anomaly state prediction values ​​and the obtained system traffic data. Through the above method, early warning judgments on the system resources of the security gateway device can be performed quickly and accurately, determining whether the system resource anomalies are caused by traffic problems. If so, an alarm can be output to promptly prompt staff to intervene, avoiding network security issues. Simultaneously, it can avoid the need for timely investigation and capacity expansion due to late warnings, which could lead to network failures and affect the use of the gateway device.

[0019] Other features and advantages of the invention will be set forth in the following description and will be apparent in part from the description or may be learned by practicing the application. The objectives and other advantages of this application may be realized and obtained by means of the structures particularly pointed out in the written description, claims, and drawings.

[0020] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0021] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 This is a flowchart illustrating the system resource early warning method in an embodiment of the present invention.

[0023] Figure 2 This is a flowchart illustrating the system resource early warning method in an embodiment of the present invention.

[0024] Figure 3 This is a flowchart illustrating the system resource early warning method in an embodiment of the present invention.

[0025] Figure 4 This is a structural block diagram of the system resource early warning device in an embodiment of the present invention. Detailed Implementation

[0026] The specific embodiments of the present invention will now be described in detail with reference to the accompanying drawings, but these are not intended to limit the scope of the invention.

[0027] It should be understood that various modifications can be made to the embodiments disclosed herein. Therefore, the following description should not be considered as limiting, but merely as an example of embodiments. Other modifications within the scope and spirit of this disclosure will be apparent to those skilled in the art.

[0028] The accompanying drawings, which are included in and form part of this specification, illustrate embodiments of the present disclosure and, together with the general description of the disclosure given above and the detailed description of the embodiments given below, serve to explain the principles of the disclosure.

[0029] These and other features of the invention will become apparent from the following description of preferred forms of embodiments given as non-limiting examples, with reference to the accompanying drawings.

[0030] It should also be understood that although the invention has been described with reference to some specific examples, those skilled in the art can certainly implement many other equivalent forms of the invention, which have the features described in the claims and are therefore all within the scope of protection defined herein.

[0031] The above and other aspects, features and advantages of this disclosure will become more apparent when taken in conjunction with the accompanying drawings and in view of the following detailed description.

[0032] Specific embodiments of the present disclosure are described thereafter with reference to the accompanying drawings; however, it should be understood that the disclosed embodiments are merely examples of the present disclosure and can be implemented in various ways. Well-known and / or repeated functions and structures are not described in detail to avoid unnecessary or redundant details that could obscure the present disclosure. Therefore, the specific structural and functional details disclosed herein are not intended to be limiting, but merely to serve as the basis and representative basis for the claims to teach those skilled in the art to use the present disclosure in a variety of substantially any suitable detailed structures.

[0033] This specification may use the phrases “in one embodiment,” “in another embodiment,” “in yet another embodiment,” or “in other embodiments,” all of which may refer to one or more of the same or different embodiments according to this disclosure.

[0034] The embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0035] like Figure 1 As shown, this embodiment of the invention provides a system resource early warning method, including: S1: Collect system resource data, including memory data, CPU data, and hard disk data; S2: Process the collected resource data based on the hierarchical real-time memory algorithm to obtain the abnormal state prediction value of the resource data of the system; S3: If the abnormal state prediction value meets the triggering condition, a resource early warning judgment is made on the system based on the abnormal state prediction value and the obtained system traffic data.

[0036] Based on the disclosure of the above embodiments, it can be understood that the solution proposed in this embodiment involves collecting resource data of the security gateway device system, including but not limited to memory data, CPU data, hard disk data, and other data that can reflect memory status. Then, the collected resource data is processed based on a hierarchical real-time memory algorithm to obtain anomaly prediction values ​​for the system's resource data. These anomaly prediction values ​​are then judged. If the anomaly prediction values ​​meet trigger conditions, a resource warning judgment is made for the system based on the anomaly prediction values ​​and the obtained system traffic data. Through this method, early warning judgments can be made quickly and accurately for the system resources of the security gateway device, determining whether system resource anomalies are caused by traffic issues. If so, an alarm can be output to promptly prompt staff to intervene, avoiding network security problems. Simultaneously, it avoids the need for delayed investigation and capacity expansion due to late warnings, which could lead to network failures and affect the use of the security gateway device.

[0037] In other words, the method based on this embodiment can identify system resource anomalies in gateway devices in advance and issue timely alerts, giving security operations personnel sufficient time to handle the alerts. Furthermore, it can more effectively identify system resource anomalies caused by traffic increases, especially abnormal increases. The method based on this embodiment can provide clear system prompts to assist security operations personnel in taking appropriate countermeasures.

[0038] Furthermore, the resource data of the acquisition system includes: S4: Collect system resource data based on a preset early warning cycle.

[0039] For example, security operations personnel can pre-configure alert cycles, which can be, but are not limited to, one week, one month, etc., depending on the market. As an application example, system resource data of the security gateway over the past month can be extracted to predict the overall system resource utilization, especially CPU utilization. If it exceeds any percentage value such as 80%, it indicates that the system resource consumption is high and further judgment is needed.

[0040] In one embodiment, the module for processing resource data is implemented using an architecture incorporating an HTM network model based on the Hierarchical Temporal Memory (HTM) algorithm, which performs anomaly detection on the resource data based on time series data. Figure 2 and Figure 3As shown, the architecture in this embodiment includes an encoding module, an HTM network model, and a scoring module. The process steps executed by this architecture include: The process of processing the collected resource data based on the hierarchical real-time memory algorithm to obtain abnormal state prediction values ​​for the system's resource data includes: S5: Encode the resource data to establish a discrete and sparse representation of the resource data; S6: Input the discrete sparse features into the hierarchical real-time memory model to identify, store and learn the implicit state of the data, so as to calculate the abnormal state prediction value of the corresponding input resource data.

[0041] The calculation of the abnormal state prediction value corresponding to the input resource data includes: S7: The predicted value of the abnormal state, s, is calculated based on the following formula: , The for A cell column that is constantly in a state of prediction. for A cell column that is always in an active state. Indicates that it was predicted that in The formula represents the number of activated cell columns, with the denominator indicating the number of activated cell columns and the numerator representing the number of activated cell columns that were not correctly predicted.

[0042] Specifically, in this embodiment, the encoding module is responsible for establishing a discrete sparse representation of the input data, discretizing the values ​​to meet the input requirements of the subsequent model, while preserving the original data information as much as possible; the HTM network model identifies, stores, and learns the implicit patterns in the input data to predict whether the input resource data is in an abnormal state and generates an abnormal state prediction value; the scoring module evaluates the detected object based on the degree of difference between the predicted value and the true value.

[0043] The HTM neuron structure and learning rules used in this embodiment differ from traditional artificial neuron models in that: traditional neuron models use functions such as sigmoid to calculate activation values; while HTM neurons use dendritic branches as basic units to determine whether a neuron is activated, and the state of a dendritic branch is determined by the number of active synapses in that dendritic region. The biggest difference between HTM neurons and traditional artificial neurons is that HTM constructs a more complex neuron model, simulating the dendritic branches and numerous synapses of biological neurons. Each synapse acts like a "threshold coincidence detector," processing the received information.

[0044] HTM neurons contain two input regions: proximal dendrites and distal dendrites. Proximal dendrites contain fewer dendritic branches and form synapses with the feedforward input (the encoded input data); distal dendrites contain multiple independent dendritic branches and form synapses with other cells in the same region. The information transmitted by a synapse differs depending on its location. Proximal synapses transmit information from the feedforward input; while distal synapses transmit information from other cells in the HTM network (neuronal output). When the number of simultaneously active synapses on a proximal dendritic branch reaches a certain threshold, that branch is activated, thereby activating the cell body and placing it in an "active (activated) state." Similarly, when the number of simultaneously active synapses on a distal dendritic branch reaches a certain threshold, that branch is also activated. However, active dendritic branches do not activate the cell; instead, they put the cell into a polarized state, or "predictive state." This indicates that, given the current input, the cell is likely to be activated in the next moment. This structure enables pattern prediction in the HTM network. In summary, the states of neurons can be categorized into: active state, inactive state, and predictive state.

[0045] In this embodiment, a score is calculated by comparing the dissimilarity between the HTM network prediction results and the input resource data; that is, by calculating the anomaly score. The formula for calculating the anomaly score is as follows: , The for A cell column that is constantly in a state of prediction. for A cell column that is always in an active state. Indicates that it was predicted that in The formula represents the number of active cell columns, with the denominator indicating the number of active cell columns and the numerator calculating the number of incorrectly predicted states among the active cell columns. The closer the anomaly score S is to 1, the higher the degree of data anomaly.

[0046] Further, the step of performing a resource early warning judgment on the system based on the abnormal state prediction value and the obtained system traffic data when the abnormal state prediction value meets the triggering condition includes: S8: Obtain the system's traffic data; S9: When the predicted value of the abnormal state exceeds the preset threshold range, determine whether the traffic change and the predicted value of the abnormal state satisfy a synchronization relationship based on the traffic data. The synchronization relationship represents the matching of the trend of the traffic change and the predicted value of the abnormal state. S10: If satisfied, output a prompt indicating that the current system's resource data is abnormal and the traffic is abnormally increasing.

[0047] In other words, security operations personnel can preset a threshold range for predicted abnormal states. If the predicted value exceeds the threshold range, it indicates that the system resources are in an abnormal state. At this time, the system will compare the predicted value with the obtained system traffic data to determine whether they meet the synchronization relationship. If they do, it indicates that the abnormality of the system resources is caused by traffic growth, so the system will output a corresponding prompt to notify the security operations personnel to investigate.

[0048] In practical applications, the collected traffic data includes at least one of the following: ①Traffic Size: The total amount of data in the traffic.

[0049] ②Traffic Rate: The rate at which data is transmitted, usually expressed in packets per second (pps) or bytes per second (bps). ③ Connection Duration: The duration of a connection, representing the time interval between the start and end of the connection.

[0050] ④ Packet Size: The number of bytes in a data packet.

[0051] Furthermore, the memory data includes at least one of the following: ① Total Memory: The total amount of memory in the system.

[0052] ②Available Memory: The amount of memory currently not occupied by any program. This is the amount of memory the system can use for new processes and applications.

[0053] ③Used Memory: The amount of memory currently being used by the program.

[0054] ④ Memory Usage Percentage: The percentage of memory used relative to total memory. It can be calculated using the following formula: (Used Memory / Total Memory) * 100.

[0055] The CPU data includes at least one of the following: CPU Usage Percentage: The ratio of CPU time being used by programs to total CPU time. It can be monitored by core (for multi-core processors) or overall CPU usage.

[0056] Number of Processes: The number of currently active processes, reflecting the number of tasks running simultaneously on the system.

[0057] Number of Threads: The number of currently active threads, reflecting the number of threads running simultaneously on the system.

[0058] The hard disk data includes at least one of the following: ① Total Disk Space: The total storage capacity on the hard drive.

[0059] ②Used Disk Space: The disk space currently occupied by files and data.

[0060] ③Available Disk Space: Disk space that is not yet occupied by files and data.

[0061] ④ Disk Usage Percentage: The percentage of disk space used relative to the total disk space. It can be calculated using the following formula: (Used Disk Space / Total Disk Space) * 100.

[0062] ⑤ Disk I / O Operations: The total number of read and write operations performed by the hard disk, which can distinguish between sequential I / O and random I / O operations.

[0063] Of course, the data types of CPU and hard disk data mentioned above are not limited to those listed above; they can also include other types of data, the specifics of which are uncertain. This embodiment uses the HTM algorithm to detect abnormal conditions of CPU, memory, and hard disk based on time series, determines the predicted value of the abnormal state, and compares the predicted value with the network traffic of the corresponding time period to determine whether a synchronous abnormal state is present. In other words, it comprehensively analyzes whether the abnormality of system resources is related to the abnormality of traffic. If so, it outputs the corresponding prompt. Based on this, it can effectively assist security operations personnel in making early warning judgments on the system resources of security gateway devices, which is efficient and accurate.

[0064] like Figure 4 As shown, another embodiment of the present invention also provides a system resource early warning device 100, comprising: The acquisition module is used to acquire system resource data, including memory data, CPU data, and hard disk data. The processing module is used to process the collected resource data according to the hierarchical real-time memory algorithm to obtain the abnormal state prediction value of the resource data of the system; The early warning judgment module is used to make resource early warning judgments on the system based on the abnormal state prediction value and the obtained system traffic data when the abnormal state prediction value meets the triggering conditions.

[0065] As an optional embodiment, the resource data of the acquisition system includes: Resource data from the system is collected based on a preset early warning cycle.

[0066] As an optional embodiment, the step of processing the collected resource data based on the hierarchical real-time memory algorithm to obtain anomaly state prediction values ​​for the system's resource data includes: The resource data is encoded to establish a discrete and sparse representation of the resource data; The discrete sparse features are input into a hierarchical real-time memory model to identify, store, and learn the implicit state of the data, so as to calculate the abnormal state prediction value of the corresponding input resource data.

[0067] As an optional embodiment, the calculation of the abnormal state prediction value corresponding to the input resource data includes: The predicted value s of the abnormal state is calculated based on the following formula: , in, for A cell column that is constantly in a state of prediction. for A cell column that is always in an active state. Indicates that it was predicted that in The formula represents the number of activated cell columns, with the denominator indicating the number of activated cell columns and the numerator representing the number of activated cell columns that were not correctly predicted.

[0068] As an optional embodiment, the step of performing a resource early warning judgment on the system based on the abnormal state prediction value and the obtained system traffic data when the abnormal state prediction value meets the triggering condition includes: Obtain the traffic data of the system; When the predicted value of the abnormal state exceeds the preset threshold range, it is determined whether the traffic change and the predicted value of the abnormal state satisfy a synchronization relationship based on the traffic data. The synchronization relationship represents the matching of the change trend of the traffic change and the predicted value of the abnormal state. If the conditions are met, a prompt will be output indicating that the current system's resource data is abnormal and the traffic is abnormally increasing.

[0069] As an optional embodiment, the traffic data includes at least one of the following: Traffic volume, traffic rate, connection duration, and data packet size.

[0070] As an optional embodiment, the memory data includes at least one of the following: Total memory, available memory, used memory, memory utilization rate; The CPU data includes at least one of the following: CPU utilization, number of processes, number of threads; The hard disk data includes at least one of the following: Total hard disk space, used hard disk space, available hard disk space, hard disk utilization, number of disk I / O operations.

[0071] Another embodiment of the present invention also provides an electronic device, comprising: At least one processor; and, A memory that is communicatively connected to the at least one processor; The memory stores instructions that can be executed by the at least one processor, and the instructions are configured to execute the system resource early warning method described in any of the above embodiments.

[0072] Another embodiment of the present invention provides a storage medium including a stored program, wherein, when the program is running, a device including the storage medium is controlled to perform the system resource early warning method as described in any of the embodiments above.

[0073] This invention also provides a computer program product, which is tangibly stored on a computer-readable medium and includes computer-executable instructions. When executed, these computer-executable instructions cause at least one processor to perform a system resource early warning method as described in the embodiments above. It should be understood that the various solutions in this embodiment have the corresponding technical effects in the above method embodiments, and will not be repeated here.

[0074] It should be noted that the computer storage medium in this application can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, a random access storage medium (RAM), a read-only storage medium (ROM), an erasable programmable read-only storage medium (EPROM or flash memory), an optical fiber, a portable compact disk read-only storage medium (CD-ROM), an optical storage medium, a magnetic storage medium, or any suitable combination thereof. In this application, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this application, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media can also be any computer-readable medium other than computer-readable storage media, which can send, propagate, or transmit a program configured for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wireless, antenna, optical fiber, RF, etc., or any suitable combination thereof.

[0075] The above embodiments are merely exemplary embodiments of the present invention and are not intended to limit the present invention. The scope of protection of the present invention is defined by the claims. Those skilled in the art can make various modifications or equivalent substitutions to the present invention within its spirit and scope of protection, and such modifications or equivalent substitutions should also be considered to fall within the scope of protection of the present invention.

Claims

1. A system resource early warning method, characterized in that, include: The system collects resource data, including memory data, CPU data, and hard disk data. The collected resource data is processed based on a hierarchical real-time memory algorithm to obtain anomaly prediction values ​​for the resource data of the system. When the predicted abnormal state value meets the triggering condition, a resource early warning judgment is made on the system based on the predicted abnormal state value and the obtained system traffic data, including: obtaining the system traffic data; when the predicted abnormal state value exceeds a preset threshold range, determining whether the traffic change and the predicted abnormal state value satisfy a synchronization relationship based on the traffic data, wherein the synchronization relationship represents the matching trend of the traffic change and the predicted abnormal state value; if satisfied, an alert is output to indicate that the current system resource data is abnormal and the traffic is abnormally increasing.

2. The system resource early warning method according to claim 1, characterized in that, The resource data of the acquisition system includes: Resource data from the system is collected based on a preset early warning cycle.

3. The system resource early warning method according to claim 1, characterized in that, The process of processing the collected resource data based on the hierarchical real-time memory algorithm to obtain abnormal state prediction values ​​for the system's resource data includes: The resource data is encoded to establish a discrete and sparse representation of the resource data; The discrete sparse representation is input into a hierarchical real-time memory model to identify, store, and learn the implicit state of the data, so as to calculate the abnormal state prediction value of the corresponding input resource data.

4. The system resource early warning method according to claim 3, characterized in that, The calculation to obtain the abnormal state prediction value of the corresponding input resource data includes: The predicted value s of the abnormal state is calculated based on the following formula: in, for A cell column that is constantly in a state of prediction. for A cell column that is always in an active state. Indicates that it was predicted that in The formula represents the number of activated cell columns, with the denominator indicating the number of activated cell columns and the numerator representing the number of activated cell columns that were not correctly predicted.

5. The system resource early warning method according to claim 1, characterized in that, The traffic data includes at least one of the following: Traffic volume, traffic rate, connection duration, and data packet size.

6. The system resource early warning method according to claim 1, characterized in that, The memory data includes at least one of the following: Total memory, available memory, used memory, memory utilization rate; The CPU data includes at least one of the following: CPU utilization, number of processes, number of threads; The hard disk data includes at least one of the following: Total hard disk space, used hard disk space, available hard disk space, hard disk utilization, number of disk I / O operations.

7. A system resource early warning device, characterized in that, include: The acquisition module is used to acquire system resource data, including memory data, CPU data, and hard disk data. The processing module is used to process the collected resource data according to the hierarchical real-time memory algorithm to obtain the abnormal state prediction value of the resource data of the system; The early warning judgment module is used to perform resource early warning judgment on the system based on the abnormal state prediction value and the obtained system traffic data when the abnormal state prediction value meets the triggering condition. The judgment includes: obtaining the system traffic data; when the abnormal state prediction value exceeds a preset threshold range, determining whether the traffic change and the abnormal state prediction value satisfy a synchronization relationship based on the traffic data, wherein the synchronization relationship represents the matching trend of the traffic change and the abnormal state prediction value; if satisfied, outputting a prompt indicating that the current system resource data abnormality is related to abnormal traffic growth.

8. An electronic device, comprising: At least one processor; as well as, A memory that is communicatively connected to the at least one processor; The memory stores instructions executable by the at least one processor, the instructions being configured to perform the system resource early warning method according to any one of claims 1-6.

9. A storage medium comprising a stored program, wherein, When the program is running, it controls the device including the storage medium to perform the system resource early warning method as described in any one of claims 1-6.

Images