An automated classification method for collapse events

Abstract

The application relates to the technical field of Internet data analysis, and provides an automatic classification method of collapse events, which is used for saving computing cost and improving classification efficiency.The application comprises the following steps: obtaining a collapse log of a collapse event occurring at an application end; extracting a keyword vector from the collapse log; calculating a hash value of the keyword vector by using a local sensitive hash algorithm; putting collapse events corresponding to similar hash values into the same attribution bucket to complete coarse classification of the collapse events; and clustering the collapse events in the same attribution bucket according to the similarity of the keyword vectors to complete fine classification of the collapse events.The application can help developers to quickly find similar collapse events from a large number of collapse logs and accelerate the code repair speed.

Description

Technical Field

[0001] This invention relates to the field of internet data analysis technology, specifically to an automated classification method for crash events. Background Technology

[0002] An application crash refers to a sudden and interrupted exit when an application is opened, also known as a sudden crash. Issues such as null pointer exceptions, stack overflows, library version incompatibility, and rendering errors can cause Android applications to crash at runtime.

[0003] Traditional crash attribution methods often rely on manual analysis. However, when faced with large-scale online crash logs, manual analysis is time-consuming and labor-intensive. Delayed remediation can lead to a decline in user experience and a sharp drop in user numbers. Therefore, researching and resolving the root causes of application crashes is of paramount importance.

[0004] Current research findings on Android application crashes, such as using Android Vitals to collect stack traces, perform regularization, and analyze similar stacks, have not significantly improved the crash situation and have the following shortcomings: 1) Android Vitals is turned off by default, meaning it does not actively collect crash-related information; and users are not inclined to actively enable Android Vitals to collect data online due to considerations of personal information protection and data consumption, resulting in incomplete data collection.

[0005] 2) The string after regularization is long, and the subsequent step of extracting keyword vectors requires a large amount of time.

[0006] 3) Applying traditional similar stack analysis to perform pairwise comparisons of large-scale crash event data is time-consuming. Summary of the Invention

[0007] The purpose of this invention is to solve the problems existing in the prior art and provide an automated classification method for crash events.

[0008] This invention is achieved through the following technical solution: an automated classification method for crash events, comprising the following steps: Retrieve crash logs for applications that experienced crashes; Extract keyword vectors from crash logs; The locality-sensitive hashing algorithm is used to calculate the hash value of the keyword vector, and the crash events corresponding to similar hash values ​​are included in the same attribution bucket to complete the coarse classification of crash events; Clustering of crash events within the same attribution bucket based on the similarity of keyword vectors completes the fine classification of crash events.

[0009] Furthermore, crash logs from the application are collected offline using a crash catcher without root privileges, and uploaded when the application connects to a wireless LAN.

[0010] Furthermore, the steps for the crash catcher to collect application crash logs offline include: Register signal handlers to intercept crash signals emitted by the virtual machine during application runtime; Upon receiving a crash signal, clone the crash scene information; After the crash scene information is cloned, a crash log is generated.

[0011] Furthermore, during crash catcher initialization, memory resources are reserved for writing crash logs.

[0012] Furthermore, the keyword vector includes text vectors and function vectors; the text vectors include the following features: CPU / memory utilization, error message keywords, and exception types; the function vectors include the function name and the class name in which the function belongs.

[0013] Furthermore, the Locality Sensitive Hash algorithm calculates the hash value based on the text vector.

[0014] Furthermore, a final similarity score for crash events is constructed based on the semantic similarity of text vectors and the word order similarity of function vectors. Whether two crash events belong to the same category is determined by whether the final similarity score exceeds a threshold. According to the following formula:

[0015] In the formula, Represents the semantic similarity of text vectors; Represents the word order similarity of function vectors; , , Both represent vector sets; , , These represent the basis of the corresponding vector set, that is, the number of elements in the vector set.

[0016] Furthermore, the Jaccard coefficient, which takes into account text length, is used to evaluate the semantic similarity of text vectors. The calculation formula is as follows:

[0017] In the formula, Indicates the first A text vector; Indicates the first A text vector; This represents the penalty coefficient.

[0018] Furthermore, the word order similarity of the function vectors is evaluated using string similarity, and the calculation formula is as follows:

[0019]

[0020] In the formula, Indicates the first The text length of each function vector; Indicates the first The text length of each function vector; This represents the minimum edit distance calculated using a dynamic programming algorithm.

[0021] Furthermore, keyword vectors are extracted from the obtained crash logs after preprocessing. The preprocessing steps include: regularizing to filter function words and retaining content word strings; and using natural language processing techniques to segment the content word strings.

[0022] Compared with the prior art, the beneficial effects of the present invention include: 1. After coarse classification, only the similarity between pairwise collapse events needs to be calculated in each attribution bucket, which can reduce the number of similarity calculations required, thereby greatly saving computational overhead and improving efficiency.

[0023] 2. The crash catcher obtains crash logs through cloning, thus enabling it to run without root privileges without affecting the normal operation of applications and the system, with low system overhead and no risk of user privacy leakage.

[0024] 3. The crash catcher collects crash logs offline and uploads them when the application is connected to a wireless LAN, avoiding the huge traffic overhead caused by using mobile data networks.

[0025] 4. Apply natural language processing techniques to the string after regularization to achieve further word segmentation, thereby overcoming the problem of extracting effective keyword vectors from long strings.

[0026] 5. The Locality Sensitive Hash algorithm is used to overcome the problem of long processing time of the traditional similar stack algorithm.

[0027] 6. In the prior art, the Jaccard coefficient only calculates the similarity of text content and does not take into account the influence of text length. The present invention adds a text length penalty term to the formula to obtain the Jaccard coefficient that takes into account the text length, thus overcoming the problem of overfitting.

[0028] 7. Since different keyword vectors may have different word orders, this invention proposes to construct the similarity of keyword vectors based on the semantic similarity of text vectors and the word order similarity of function vectors, thereby overcoming the influence of word order and realizing fine-grained, dimension-by-dimensional comparison between two strings. Attached Figure Description

[0029] Figure 1 This specific embodiment includes a flowchart of the automated classification method for crash events.

[0030] Figure 2 This is a diagram of the crash log. Detailed Implementation

[0031] The present invention will now be described in further detail with reference to the accompanying drawings: refer to Figure 1 As shown, this specific implementation method mainly consists of 5 steps: obtaining crash logs, preprocessing log data, extracting keyword vectors, coarse classification of crash events, and fine classification of crash events. The following sections will provide a detailed explanation of each step.

[0032] 1) Obtaining crash logs An application crash is called a crash event. Once an application crashes in the Android system, the runtime virtual machine in the Android system will issue a crash signal. At this time, the system will pause the application process based on the crash signal to generate crash scene information, which is often kept as a crash log.

[0033] The specific crash log content is as follows: Figure 2 As shown, in order to extract crash-related events and logs, a crash catcher that meets three conditions should be developed: it should run without root privileges; and it should not affect the normal operation of the application (unless the application crashes). Once a crash occurs, the crash catcher can quickly clone the crash scene information. It collects crash logs offline from the application without root privileges and uploads them when the application connects to a Wi-Fi network. Cloning the crash scene information provides more time for saving crash data. Furthermore, the catcher reserves some memory resources during initialization to overcome crashes where insufficient memory prevents log writing.

[0034] The steps for collecting crash logs by the crash catcher include: S1: Register a signal handler to intercept the default crash handling signal of the Android system. In the crash catcher, override the UncaughtExceptionHandler function and set the default crash handling function of the thread to the overridden UncaughtExceptionHandler function.

[0035] S2: When a crash signal is received, the crash scene information is cloned. The crash scene information can be obtained by calling the dumpStack function in the crash handling function.

[0036] S3: After the crash scene information is cloned, a crash log is generated. In this specific embodiment, the CPU and memory utilization at the time of the crash are added to the crash log.

[0037] II. Log Data Preprocessing (1) Regularization filters out irrelevant function words, such as: a) Thread ID: Each started thread is assigned a unique number by the system to distinguish it from other threads. It is a long integer.

[0038] b) Virtual address: The logical address used by a program to access memory.

[0039] Leave out concrete words that are helpful for analyzing the root cause, such as memory, thread, find, UI, database, etc. (2) Natural Language Processing Technology: a) Remove function words and punctuation marks. Function words are meaningless auxiliary verbs, prepositions, pronouns, etc. in English. b) Using spaCy for word segmentation: splitting long strings into shorter strings according to certain criteria.

[0040] For example, the log data before processing is: "MessageViewType.content(mMessageAdapter.mData[0]) must not be null".

[0041] After word segmentation using regularization and natural language processing techniques: "MessageViewType contentmMessageAdapter mData not null". III) Keyword Vector Extraction After word segmentation, feature extraction is performed, and the features are used to form a keyword vector. The keyword vector includes a text vector and a function vector. The text vector includes the following features: CPU / memory utilization, error message keywords, and exception type. The function vector includes the function name and the class name to which the function belongs. Each feature is explained below.

[0042] a) Exception types: Java's official definition of exception types related to crashes, which help with coarse-grained crash event analysis.

[0043] b) Error message keywords: Error messages provide a brief explanation of the cause and location of the error, and are output by the logging system. They play a constructive role in root cause analysis.

[0044] c) Function name and class name: Functions to be called on the stack that are related to the crash event, as well as the classes in which the functions are located. Functions at the top of the stack are more likely to crash.

[0045] d) CPU / memory utilization: CPU / memory utilization at the time of the crash.

[0046] IV) Rough Classification of Crash Events Locality-Sensitive Hash Algorithm: After extracting the keyword vector, this invention applies the Locality-Sensitive Hash Algorithm to comprehensively calculate the keyword vector and obtain the corresponding hash value. Two crash events that are logically adjacent and physically adjacent in the original space will fall into the same attribution bucket after being calculated by the Locality-Sensitive Hash Algorithm, thus remaining physically and logically adjacent. Assuming there are a total of n crash events, each crash event is assigned a hash value, and similar hash values ​​are grouped into the same bucket. Assuming that calculating the hash value for each crash event takes one unit of time, then the process for n crash events can be completed in log(n) time, overcoming the time-consuming problem of traditional similar stack analysis. V) Detailed Classification of Crash Events The final similarity of crash events is constructed based on the semantic similarity of text vectors and the word order similarity of function vectors. Whether two crash events belong to the same category is determined by whether the final similarity exceeds a threshold. According to the following formula:

[0047] In the formula, Represents the semantic similarity of text vectors; Represents the word order similarity of function vectors; , , These represent the basis of the corresponding vector set, that is, the number of elements in the vector set.

[0048] b) Semantic similarity of text vectors: Each bucket contains crash events with similar features, meaning the keywords extracted from the crash logs of the events have strong similarity in text content. The Jaccard coefficient only calculates the similarity of text content and does not consider the impact of text length. This invention adds a text length penalty term to the formula to overcome the overfitting problem. The Jaccard coefficient, which takes text length into account, is used to evaluate the semantic similarity of text vectors. The calculation formula is as follows:

[0049] In the formula, Indicates the first A text vector; Indicates the first A text vector; This indicates that the penalty coefficient bucket was manually set; and Both represent the magnitude of the vector difference; and Let represent the modulus of the intersection and union of vectors, respectively.

[0050] c) Word order similarity of function vectors: minimum edit distance is the minimum number of edits required to get from one string to another. Edit distance can be used to determine the similarity between two strings.

[0051]

[0052]

[0053] Where, in the formula, Indicates the first The text length of each function vector; Indicates the first The text length of each function vector; This represents the minimum edit distance calculated using a dynamic programming algorithm.

[0054] The Jaccard coefficient, taking into account text length, was used to calculate the crash events and model fitting problems for similar text content with different text lengths. Since different keyword vectors have different word orders, this invention proposes a calculation model that combines the vector space model and the minimum edit distance to overcome the influence of word order and achieve fine-grained, dimension-by-dimensional positioning comparison between two strings.

[0055]

[0056] in, The final similarity score is used to determine the number of crash events. In a specific implementation, if the final similarity score of two crash events is greater than 0.95, they are classified into the same category.

[0057] The invention clusters crash events caused by the same reason based on final similarity, but the specific cause of the crash still needs to be discovered manually in conjunction with the system code. This invention can help developers quickly find similar crash events from massive crash logs, accelerating code repair.

[0058] The above technical solution is only one embodiment of the present invention. For those skilled in the art, based on the principles disclosed in the present invention, it is easy to make various types of improvements or modifications, and not limited to the technical solutions described in the specific embodiments of the present invention. Therefore, the foregoing description is only a preferred option and is not restrictive.

Claims

1. A method of automated classification of collapse events, characterized by, Includes the following steps: Retrieve crash logs for applications that experienced crashes; Extract keyword vectors from crash logs; the keyword vectors include text vectors and function vectors; the text vectors include the following features: CPU / memory utilization, error message keywords, and exception type; the function vectors include the function name and the class name in which the function belongs; The locality-sensitive hashing algorithm is used to calculate the hash value of the keyword vector, and the crash events corresponding to similar hash values ​​are included in the same attribution bucket to complete the coarse classification of crash events; Clustering of crash events within the same attribution bucket based on the similarity of keyword vectors completes the fine classification of crash events; this includes: constructing the final similarity of crash events based on the semantic similarity of text vectors and the word order similarity of function vectors, and determining whether two crash events belong to the same category based on whether the final similarity is greater than a threshold.

2. The automated classification method for crash events according to claim 1, characterized in that, Crash logs from the application are collected offline using a crash catcher without root privileges, and uploaded when the application connects to a wireless LAN.

3. The automated classification method for crash events according to claim 2, characterized in that, The steps for a crash catcher to collect application crash logs offline include: Register signal handlers to intercept crash signals emitted by the virtual machine during application runtime; Upon receiving a crash signal, clone the crash scene information; After the crash scene information is cloned, a crash log is generated.

4. The automated classification method for crash events according to claim 3, characterized in that, When the crash catcher is initialized, memory resources are reserved for writing crash logs.

5. The automated classification method for crash events according to claim 1, characterized in that, Locality-Sensitive Hash (LSH) algorithms calculate hash values ​​based on text vectors.

6. The automated classification method for crash events according to claim 1, characterized in that, Final similarity of crash events According to the following formula: In the formula, Represents the semantic similarity of text vectors; Represents the word order similarity of function vectors; , , Both represent vector sets; , , These represent the basis of the corresponding vector set, that is, the number of elements in the vector set.

7. The automated classification method for crash events according to claim 6, characterized in that, The semantic similarity of text vectors is evaluated using the Jaccard coefficient, which takes into account text length. The calculation formula is as follows: In the formula, Indicates the first A text vector; Indicates the first A text vector; This represents the penalty coefficient.

8. The automated classification method for crash events according to claim 7, characterized in that, The word order similarity of function vectors is evaluated using string similarity, and the calculation formula is as follows: In the formula, Indicates the first The text length of each function vector; Indicates the first The text length of each function vector; This represents the minimum edit distance calculated using a dynamic programming algorithm.

9. The automated classification method for crash events according to claim 8, characterized in that, After preprocessing the obtained crash logs, keyword vectors are extracted. The preprocessing steps include: regularizing to filter function words and retaining content word strings; and using natural language processing techniques to segment the content word strings.

Images