Method and device for monitoring abnormal operation of real-time system

Abstract

The invention provides a real-time system operation abnormity monitoring method, which comprises the following steps of respectively executing data acquisition and clustering processing when a real-time system is in a normal state and a monitoring state; the data acquisition and clustering processing comprises the steps of performing n times of sampling on at least one kind of monitored data in a sampling period to form n sample points, and clustering the n sample points based on a clustering algorithm to obtain a clustering result in the sampling period; and according to the difference degree between the clustering result in the monitoring operation state and the clustering result in the normal state, determining the possibility of abnormal operation of the real-time system in the monitoring operation state. The invention further provides a corresponding monitoring device. According to the invention, on the premise that no obvious fatal problem is generated in the system, whether the system may have abnormity within a period of time can be evaluated.

Description

Technical Field

[0001] The present application relates to a technical field related to operating system monitoring, and in particular to a method and device for monitoring abnormal operation of a real-time system. Background Art

[0002] At present, the monitoring methods for abnormal operation of general non-real-time systems (such as Windows OS, iOS, Linux, Unix, etc.) can realize the monitoring of the operation of the system or the application in the system. These monitoring methods are relatively mature and widely used. However, since most of these monitoring methods are designed based on general non-real-time systems, they may have the following disadvantages:

[0003] On the one hand, most of these monitoring methods include open source monitoring tools or third-party monitoring software, such as Zabbix, Nagios, Prometheus, etc., which provide data collection, storage, query, alarm and visualization functions. These software require more system resources and have a complex operating environment, and are suitable for monitoring large amounts of data. However, most real-time systems require a small amount of data to be monitored and processed, and the system resources of real-time systems are relatively limited, so they are not suitable for the operation of such monitoring software.

[0004] On the other hand, some of these monitoring methods for system anomalies have low real-time performance. For example, methods based on log monitoring (using relevant log monitoring tools to collect, index and analyze log data to help locate problems) are similar to post-event analysis (i.e., after an event occurs and logs are generated), and are not suitable for the requirements of high real-time response to system anomalies in real-time systems.

[0005] On the other hand, some of these monitoring methods for system anomalies are based on program modification monitoring methods, mainly targeting known problems and some system bottom-level fatal problems. The monitoring granularity is relatively fine (for example, monitoring specific performance indicators of system resources and applications, such as CPU usage, memory usage, disk I / O performance, etc., as well as application error rate and response time, etc.), and mainly monitoring obvious fatal problems. For systems that appear to be running normally, such methods cannot determine whether the operation of the entire system is abnormal over a period of time. For example, the USE method (refers to a method for quickly locating the performance bottleneck of system resources through the three core indicators of utilization, saturation, and number of errors), although it can monitor the current situation of the entire system, when the system appears to be running normally (such as no abnormality in the current situation is monitored), the USE method is difficult to determine whether the operation of the entire system is abnormal over a period of time.

[0006] Therefore, given the characteristics of real-time systems, which have limited system resources and high real-time requirements, how to provide a monitoring solution suitable for real-time system operation abnormalities and evaluate whether the system may have abnormalities within a period of time without obvious fatal problems in the system, is a technical problem to be solved. Summary of the invention

[0007] In view of the above problems in the prior art, the present application provides a real-time system operation abnormality monitoring method and device, which is applicable to real-time systems and can evaluate whether the system may have abnormalities within a period of time without causing obvious fatal problems in the system.

[0008] To achieve the above object, the present application provides a first aspect of a real-time system operation abnormality monitoring method, comprising the following steps:

[0009] When the real-time system is in a normal state and a monitoring state, data collection and clustering processing are respectively performed; the data collection and clustering processing includes: performing n sampling on at least one monitored data within a sampling period to form n sample points, clustering the n sample points based on a clustering algorithm, and obtaining a clustering result within the sampling period;

[0010] According to the difference between the clustering result in the monitoring operation state and the clustering result in the normal state, the possibility of abnormal operation of the real-time system in the monitoring operation state is determined.

[0011] From the above, the real-time system operation abnormality monitoring method described in this application monitors the changes in data characteristics during operation, and uses the degree of difference in clustering results as the possibility of evaluating system operation abnormality. Since the data under monitoring does not require any form of modification and intervention, the amount of data required for monitoring is also small, so the system resources used are relatively small; after collecting data, the monitoring results can be obtained immediately by performing a clustering algorithm, and the real-time performance is good; in particular, since the core idea of ​​the method described in this application is to monitor and evaluate the changes in the characteristics of the operating data over a period of time, and to determine whether there are abnormalities in the data interaction and data processing of the entire system and the solution over a period of time, it is possible to evaluate whether the system may have abnormalities over a period of time on the premise that no obvious fatal problems occur in the system.

[0012] In addition, since the present application scheme can determine whether the system may be abnormal within a period of time without causing obvious fatal problems in the system, then, in the program development and design of the system or application, corresponding takeover and processing procedures can be designed based on the situation when the system is abnormal using the present application scheme to improve the stability of the program operation.

[0013] As a possible implementation manner of the first aspect, the at least one data includes at least one of the following: the amount of data read and written by the system driver, the result of the system driver calling an interface provided by the operating system, and the CPU usage rate.

[0014] From the above, since the data interaction interface is located in the system driver, the data processing unit and the core are located in the CPU, and the data can characterize the data interaction and data processing process between the operating system driver and the CPU, it can well represent the operation status of the operating system as a whole.

[0015] Optionally, the result of the system driver calling the interface provided by the operating system includes: 4 characteristic values ​​respectively indicating no call, successful call, call with warning or call with error; the number of clusters specified in the clustering algorithm is 4.

[0016] From the above, the system driver calls the interface provided by the operating system. By monitoring the call success or failure data, the system can be monitored to see whether it is running normally. The number of clusters can be determined according to the call result of the interface, which can guide the clustering result more accurately.

[0017] Optionally, the clustering algorithm includes a k-means algorithm.

[0018] From the above, the k-means clustering algorithm consumes less resources and requires less data to be monitored. In real-time systems with limited resources, coarse-grained monitoring of the overall system solution can be achieved.

[0019] As a possible implementation of the first aspect, the degree of difference between the clustering results under the monitoring operation state and the clustering results under the normal state is calculated based on the intra-cluster sum of squares of the clustering under the monitoring operation state and the intra-cluster sum of squares of the clustering under the normal state.

[0020] From the above, the intra-cluster sum of squares is the sum of the squares of the distances between all points in a cluster and the centroid (center point) of the cluster, which is used to measure the rough clustering effect. Since the intra-cluster sum of squares has a small amount of computation and can represent the overall data characteristics when the overall data deviation is not large, it can save calculations and reflect the effect quickly.

[0021] As a possible implementation manner of the first aspect, performing n samplings within the sampling period is performing the n samplings at a set sampling time interval, wherein the sampling time interval and / or n can be preconfigured.

[0022] As described above, by performing sampling in a manner of user-defined sampling time interval and / or number of times, it is possible to adapt to different requirements of various real-time operating systems performing different tasks on the amount and type of monitoring data.

[0023] As a possible implementation manner of the first aspect, the sample points formed when performing n samplings are temporarily stored in a memory.

[0024] From the above, temporarily storing the sampling results in high-speed memory has the advantages of improving access speed, reducing data transmission, and reducing storage costs.

[0025] A second aspect of the present application provides a real-time system operation abnormality monitoring device, comprising:

[0026] The data collection and clustering processing module is used to be called to perform data collection and clustering processing when the real-time system is in a normal state and a monitoring state; the data collection and clustering processing includes: performing n sampling on at least one monitored data within a sampling period to form n sample points, clustering the n sample points based on a clustering algorithm, and obtaining a clustering result within the sampling period;

[0027] The abnormality determination module is used to determine the possibility of abnormality in the real-time system operation under the monitoring operation state according to the difference between the clustering result under the monitoring operation state and the clustering result under the normal state.

[0028] A third aspect of the present application provides a computing device, comprising: a processor, and a memory, on which program instructions are stored, and when the program instructions are executed by the processor, the processor executes the real-time system operation abnormality monitoring method described in any one of the first aspects.

[0029] A fourth aspect of the present application provides a computer-readable storage medium having program instructions stored thereon, wherein when the program instructions are executed by a computer, the computer executes the method for monitoring abnormal operation of a real-time system as described in any one of the first aspects. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 is a flow chart of a method for monitoring abnormal operation of a real-time system provided in the first embodiment of the present application;

[0031] Figure 2 is a flow chart of a method for monitoring abnormal operation of a real-time system provided in a second embodiment of the present application;

[0032] Figure 3a-3d is a schematic diagram of four rounds of sampling clustering involved in the second embodiment;

[0033] Figure 4 is a schematic diagram of a real-time system operation abnormality monitoring device provided in an embodiment of the present application;

[0034] Figure 5It is a structural schematic diagram of a computing device provided in an embodiment of the present application.

[0035] It should be understood that the size and shape of each block diagram in the above structural diagram are for reference only and should not constitute an exclusive interpretation of the embodiment of the present invention. The relative position and inclusion relationship between the blocks presented in the structural diagram are only schematic representations of the structural association between the blocks, and do not limit the physical connection method of the embodiment of the present invention. DETAILED DESCRIPTION

[0036] The technical solution provided by the present application is further described below with reference to the accompanying drawings and examples. It should be understood that the system structure and business scenarios provided in the examples of the present application are mainly to illustrate the possible implementation methods of the technical solution of the present application and should not be interpreted as the only limitation on the technical solution of the present application. It is known to those of ordinary skill in the art that with the evolution of the system structure and the emergence of new business scenarios, the technical solution provided by the present application is also applicable to similar technical problems.

[0037] It should be understood that the monitoring scheme for abnormal operation of a real-time system provided in the embodiments of the present application includes a monitoring method for abnormal operation of a real-time system, a monitoring device, a computing device, and a computer-readable storage medium. Since the principles of solving the problems in these technical solutions are the same or similar, some repetitions may not be repeated in the introduction of the following specific embodiments, but it should be regarded as that these specific embodiments have been referenced to each other and can be combined with each other.

[0038] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by technicians in the technical field of this application. In the event of any inconsistency, the meaning described in this specification or the meaning derived from the contents recorded in this specification shall prevail. In addition, the terms used herein are only for the purpose of describing the embodiments of the present application and are not intended to limit the present application. In order to accurately describe the technical content in this application and to accurately understand the present invention, the following explanations or definitions are given to the terms used in this specification before describing the specific embodiments:

[0039] 1) Portable Operating System Interface (POSIX): It is an IEEE standard that defines a series of APIs (application programming interfaces) that the operating system should provide to applications. It aims to improve the portability of software, that is, to allow programs to run on different operating systems with little or no modification.

[0040] 2) Intewell system: It is a high real-time and high-reliability microkernel operating system. The Intewell operating system is widely used in industrial control, intelligent manufacturing, automotive electronics, rail transportation, energy and power, aerospace and other fields, which have extremely high real-time requirements.

[0041] 3) Universal Asynchronous Receiver / Transmitter (UART): is a widely used serial communication protocol for asynchronous communication. It allows different devices to transmit data over a single communication line. UART communication usually uses two lines: one for sending data (TX) and the other for receiving data (RX).

[0042] 4) Controller Area Network (CAN): It is a serial communication protocol used in the automotive and industrial automation fields. The CAN protocol was originally developed by Bosch in Germany in 1983 to solve the communication problem between electronic control units (ECUs) in automotive electronic systems. Due to its reliability and flexibility, the CAN protocol is also widely used in industrial automation, medical equipment, ships, aviation and many other fields.

[0043] 5) General-Purpose Input / Output (GPIO): A group of multi-function pins on microcontrollers and other integrated circuits that can be controlled by user programs. These pins can be configured as input or output mode to interact with external devices, such as reading sensor data, controlling LED lights, driving motors, etc.

[0044] 6) Cluster Sum of Square: This is an indicator to measure the closeness of clustering. It calculates the sum of the squares of the distances from all points in each cluster to the cluster center. K-means output usually includes the cluster sum of squares for each cluster. The cluster sum of squares is a criterion for evaluating clustering effects. The smaller the cluster sum of squares, the closer the points in the cluster are.

[0045] The real-time system operation abnormality monitoring scheme provided by the embodiment of the present application can sample the monitored parameters within a period of time, and calculate the clustering results of these parameters within the period of time based on the clustering method, and judge whether the system may be abnormal during the period of time based on the comparison of the calculated clustering results and the reference clustering results. The types of parameters required to be monitored by this method can be limited, and a clustering algorithm with less resource consumption can be used. It is suitable for real-time systems with few system resources and high requirements for real-time performance. It can also evaluate whether the system may be abnormal within a period of time without obvious fatal problems in the system. The embodiment of the present application can be applied to the abnormal monitoring of real-time operating systems in various industries, robots, aerospace, and military fields, such as Intewell, Delta OS, Sylix OS, etc. Refer to the accompanying drawings below for a detailed introduction to the embodiments of the present application.

[0046] The first embodiment of the present application provides a real-time system operation abnormality monitoring method. Figure 1 , specifically describing the implementation of each step of the method, including steps S10-S20:

[0047] S10: When the real-time system is in a normal state and a monitoring state, data collection and clustering processing are performed respectively; the data collection and clustering processing includes: performing n sampling on at least one monitored data within a sampling period to form n sample points, clustering the n sample points based on a clustering algorithm, and obtaining the clustering results within the sampling period.

[0048] It should be understood that the normal state of a real-time system refers to a state in which the response and processing time, stability, error rate, task scheduling, security, etc. of the system operation are within an acceptable range for the tasks to be processed; the monitoring state refers to the stage when the real-time system needs to determine whether it is in a normal operating state; the normal state and monitoring state do not specifically refer to a system state or moment named by this name. If the normal state and monitoring state are mentioned later, the meaning described is the same as here.

[0049] In some embodiments, when executing data collection, it can be specifically implemented as follows: when the real-time system is turned on, the method provided in the embodiment of the present application will create a thread / process in the system, which can be used to monitor data interaction and data processing, and record at least one monitored data into the system's high-speed memory or other storage unit. In some embodiments, the thread / process can be created and run in the system through a data acquisition module, program or terminal. It should be understood that the data acquisition module, program or terminal does not specifically refer to a module, program or terminal named by the name.

[0050] In some embodiments, the at least one type of data monitored includes at least one of the following: the amount of data read and written by the system driver, the result of the system driver calling an interface provided by the operating system, and the CPU usage rate.

[0051] In some embodiments, the interface provided by the above system may include a POSIX general interface, and may also include an operating system call interface provided by various real-time systems.

[0052] In some embodiments, the operating system call interface includes the system's own call interface provided by real-time operating systems such as Intewell, Delta OS, and Sylix OS, which are applied to various industries, robots, aerospace, and military scenarios. For example, the embedded real-time operating system FreeRTOS is a small, scalable, preemptive real-time operating system kernel that is widely used on microcontrollers (MCUs). It provides a series of interfaces to obtain system operation information; for example, after enabling the relevant predefined macro functions, the task's running time information can be obtained through the vTaskGetRunTimeStats() and vTaskList() functions, and then the CPU usage rate can be calculated. In some embodiments, hook-like functions can be used to monitor the use of interfaces by certain programs or terminal devices.

[0053] In some embodiments, the collected data may be preprocessed, including data cleaning, data normalization, etc. When the monitored data is of many types, large in volume, and complex in structure, operations such as feature selection and dimensionality reduction may also be performed, which shall be selected according to the specific circumstances and are not limited here.

[0054] In some embodiments, the result of the system driver calling the interface provided by the operating system includes: four characteristic values ​​indicating no call, successful call, call with warning or call with error; accordingly, the number of clusters in the clustering algorithm can be preset to 4. Setting the number of clusters of the clustering algorithm to be the same as the number of types of the call results can make the clustering correspond to the above call results, which makes the clustering results more intuitive and easy to understand, and the clustering results can reflect the four states in the running process.

[0055] In some embodiments, the clustering algorithm used may predetermine the number of clusters as described above (for example, the number of clusters described above is 4), and the number of clusters may be determined according to the type and characteristics of the data to be monitored. In other embodiments, the clustering algorithm used may not predetermine the number of clusters, which is determined by the clustering algorithm itself, such as the Mean shift algorithm.

[0056] In some embodiments, the clustering algorithm includes a k-means algorithm, which takes up less resources and is more suitable for real-time systems. In addition, when using k-means for clustering, 4 can be set as the number of clusters as above. In some other embodiments, the clustering algorithm can also use a hierarchical clustering algorithm, a DBSCAN algorithm, etc. If there are many types of data to be monitored, a large amount of data, and a more complex data structure, a spectral clustering algorithm, a Mean Shift algorithm, a BIRCH algorithm, etc. can also be used; it can be selected according to the specific situation and is not limited here.

[0057] In some embodiments, the n samplings are performed within the sampling cycle, and the n samplings are performed at a set sampling time interval, wherein the sampling time interval and / or n can be preconfigured. A specific implementation method may be: data collection is performed according to a period, and sampling may be performed once at a certain interval within a sampling cycle, and a total of n samplings are performed to form n sample points. The time interval and the number of samplings may be preconfigured. In some embodiments, sampling at unequal time intervals may also be performed using marked specific time points within a sampling cycle, which is not limited here. It should be understood that the collection time interval is determined by the user according to the actual operating environment of the current application business, which is not limited here, and can be the following reference values: 100 milliseconds, 1 second, 1 minute, 1 hour, etc. For example, if the application business operation cycle of the user product is 1 month or more, then the collection interval can be set to 1 hour. For example, some products that frequently send and receive data, such as high-speed data collectors, have a faster application business logic cycle, so the collection interval can be set to 1 second. To ensure clustering quality, it is recommended that the number of collections should not be less than 100 times, but the number of collections should be determined based on the content and needs of data collection, and is not limited here.

[0058] Among them, one or more data (i.e., a sample point) obtained in each sampling is the data content to be monitored. In some embodiments, the data content in a sample point may include the aforementioned amount of data read and written by the system driver, the call result of the system driver calling the interface provided by the operating system, and the CPU usage rate. In other embodiments, the data content in a sample point may also include at least one of the following: memory usage, disk I / O read and write speed and queue length, hardware temperature and voltage level, number of processes and threads, network interface upload and download speed, data packet loss and network delay, application and service startup / response time and error rate, file system space usage, memory limit, disk quota, CPU time limit, hardware and terminal device status, response time and deadline miss rate of key tasks, function call counts and other performance counts, as well as system event conditions such as configuration changes, startup and shutdown, etc.

[0059] In some embodiments, the call result data of the system driver calling the interface provided by the operating system may include the operations of the system driver calling the interface provided by the operating system, including open(), read(), write(), close(), ioctl(); and may also include other system call operations that are desired to be monitored. The call result of each operation may be, as described above, four characteristic values ​​indicating no call, successful call, call with warning, or call with error.

[0060] In some embodiments, one or more data obtained from each sampling can be stored as the coordinates of a sample point located in a multidimensional space. For example, assuming that a sample point for each sampling records three types of data, it is a three-dimensional array, such as [a1, a2, a3]. In some embodiments, multiple sample point data are compiled into an array according to time or not according to time series, and temporarily stored in the system memory. It should be understood that the purpose of using one or more data as the coordinates of a sample point located in a multidimensional space is to allow the monitoring data of the system at the same time to together constitute a description of the overall health of the system, which is convenient for subsequent clustering; if other grouping or storage methods can achieve the same effect, such grouping or storage methods can also be used for storage or processing, and are not limited here.

[0061] In some embodiments, the collected data can also be subjected to simple calculations to form data in a sample point. For example, the CPU usage rate can be obtained by the task running time ÷ total system running time × 100%. The acquired task running time and the total system running time can be sampled and calculated using this formula to form data in a sample point.

[0062] In some embodiments, the sample points formed when the n samplings are executed are temporarily stored in a memory, such as the high-speed memory of the aforementioned system. When the sample point data is stored in the system memory, the upper limit of the number of sample points should not exceed the available memory size. In other embodiments, the storage unit for temporary storage of the sample point data may also include virtual memory, cache (such as a heap, stack), etc. on the hard disk. Each temporary storage method has its usage scenario, and the method to be selected depends on factors such as the size of the data, the access frequency, and the performance requirements. In some embodiments, the sample point data may also be stored on the hard disk in the form of files, databases, etc. (here, it refers to the non-virtual memory space on the hard disk). Compared with the temporary storage method in the system memory, this method has lower reading efficiency and occupies more resources, but can be used for subsequent access queries. It is also possible to combine multiple storage methods to optimize performance and resource utilization.

[0063] In some embodiments, for data collection and clustering processing performed when the real-time system is in a normal state, one round may be performed after the system is started. In other embodiments, multiple rounds may be performed to obtain the mean of the clustering results of multiple rounds (such as the mean of the intra-cluster sum of squares of multiple rounds) to serve as a standard value for determining whether the real-time system is running abnormally.

[0064] In some embodiments, data collection and clustering processing may be performed in multiple rounds within a period of time or may be performed intermittently to determine whether the real-time system operation is abnormal.

[0065] S20: Determine the possibility of abnormal operation of the real-time system in the monitoring operation state according to the difference between the clustering result in the monitoring operation state and the clustering result in the normal state.

[0066] In some embodiments, the degree of difference between the clustering result in the monitoring operation state and the clustering result in the normal state is calculated based on the intra-cluster sum of squares of the clustering in the monitoring operation state and the intra-cluster sum of squares of the clustering in the normal state. Based on the calculated degree of difference, the possibility of abnormal operation of the real-time system in the monitoring operation state is determined.

[0067] In some embodiments, the clustering result may also be characterized by using one or more parameters such as intra-cluster distance, inter-cluster distance, silhouette coefficient, cluster density, stability, etc., or by transforming and calculating them.

[0068] In some embodiments, the difference degree of the parameter of the intra-cluster sum of squares characterizing the clusters in the two states can be calculated using relative error, absolute error, etc. In other embodiments, the difference degree of clustering results can also be directly output using methods such as mutual information, Rand index, Jaccard coefficient, etc. that can directly determine the similarity of two groups of clustering results.

[0069] In some embodiments, when judging the possibility of abnormal operation of the real-time monitoring system, a threshold value can be used to issue a warning for the monitoring state where the difference degree exceeds the threshold value. For example, when the intra-cluster sum of squares is used for characterization, when the relative error of the intra-cluster sum of squares is greater than 75% (75% is the threshold used), the monitoring system may be operating abnormally, and a warning is issued. It should be understood that the threshold value can be obtained after system adaptation, reflecting the alarm threshold requirements of a specific system, and can be adjusted according to the conditions of different systems, which is not limited here. In some embodiments, the content contained in the issued warning can use the direct use of the difference degree or the difference degree after calculation as the probability or possibility of deviation from normal use to prompt the user.

[0070] The second embodiment of the present application provides a method for monitoring the abnormal operation of a real-time system through system read and write volume, system driver call and CPU usage. The following will take the Intewell real-time system as an example. The Intewell real-time system uses the following 4 peripherals: uart, CAN, network port, GPIO, and these peripherals will call POSIX interface communication. Figure 2 As shown in the flowchart, the method provided by the second embodiment includes the following steps S200-S206.

[0071] S200: Start the system and the user sets and inputs the acquisition parameters such as the acquisition time interval (Interval) and the total number of samples (times):

[0072] First, under the condition of ensuring the normal operation of the equipment, the user can set two parameters according to the actual situation: set the collection time interval (interval) and the total number of collection points (times). Among them, the collection time interval is the time interval for the real-time system thread to collect data, and data collection is performed once within the interval. The setting range of the total number of collection points is: 100~100000, with a lower limit of 100 and an upper limit not exceeding the available memory size.

[0073] Since the main application logic cycle of the second embodiment of the present application is relatively short, the user selects the parameter sampling interval to be 1s; the user sampling point parameter is: 200, that is, 200s is a round of sampling cycle, so 200 sampling points will be generated in a round of sampling cycle. Therefore, after starting up, the user enters the following parameters:

[0074] ① Interval = 1;

[0075] ② Times = 200;

[0076] S201: Create a thread / process in the system, and use the hook function and related interfaces to sample at intervals. The hook sampling is passively triggered once every 1s interval; if there is no data within the 1s interval, the sampling value defaults to 0.

[0077] Among them, the thread / process created in the real-time system can use the hook function to obtain the call status of the POSIX interface. The hook function can intercept and modify the behavior of the system or application without modifying the original code. It is widely used in event processing, user interface programming, system monitoring, debugging and security.

[0078] S202: Perform the first round of data collection under normal use to obtain a 3D array, perform 200 samplings, and store the result Array_1 in RAM.

[0079] Among them, when the data of the first round of 200 sampling points is sampled, the collected data is stored in the array Array_1. The data of each sampling point consists of the following three features A, B, and C:

[0080] A. The amount of data read and written by the system driver (i.e. using read()\write() operations), in k bytes.

[0081] B. The result of the system driver calling the POSIX interface: no call, successful call, call with warning, call with error (the monitored call operations include open(), read(), write(), close(), ioctl()), and the corresponding characteristic values ​​are: 0, 1, 2, 3 respectively.

[0082] C. CPU usage (ranging from 1% to 100%), after normalization and scaling, the corresponding eigenvalues ​​are 0.001 to 0.1 respectively.

[0083] During the collection time interval, when the system driver starts to interact with data, the hook function of the driver POSIX interface is triggered, and the real-time system thread starts to sample data once, and the collected three types of characteristic data of ABC are arranged as 3D data. After sampling once, it is determined whether times = 200 samplings are completed. If completed, no more sampling is performed. Otherwise, sampling is suspended after the sampling is completed, and sampling is performed again in the second interval. Each collection record is a 3D array. Assume that the first array is [a1, a2, a3], a1 represents the amount of data read and written by the system driver (corresponding to A above), a2 represents the result of the system driver calling the POSIX interface (corresponding to B above), a3 represents the CPU usage rate (corresponding to C above), the second array is [b1, b2, b3], the third array is [c1, c2, c3], and so on, to the nth array (n = 200). The array is named Array_1 and temporarily stored in the memory (RAM), as shown below:

[0084]

[0085] If no hook is triggered within the interval, that is, there is no driver interaction, the default sampled value for this data collection is [0,0,0].

[0086] Further examples are as follows: Assume that in the first second, the application service triggers the hook function of a peripheral driver, and the system thread obtains the length of the received and sent data of the driver as 8; the interface call result is 1 (indicating successful call); the CPU occupancy rate is 23%; then the three-dimensional array of the first sampling is [0.008, 1, 0.023], which is recorded in the array Array_1, waiting for the hook function to be triggered in the next second. Assume that in the next second (the second second), the network port reads and writes, the hook function is triggered, the system thread obtains the network card data length of 262, the interface call result is 1 (indicating successful call), and the CPU occupancy rate is 21%. Then the three-dimensional array of the second sampling is [0.262, 1, 0.021], which is recorded in the array Array_1, and waits for the next second to start sampling. Repeat the sampling action at 1 second intervals until 200 points are sampled. At the end of the first round, the Array_1 data reaches 200, that is, when the total number of points collected times value, the first round of sampling ends.

[0087] S203: Use the k-means algorithm to cluster the array Array_1 collected under normal use, with parameter k=4, and obtain the intra-cluster square sum Inertia_0:

[0088] Use k-means algorithm (k value parameter is 4) to cluster Array_1, where k value is determined by the four types of feature values ​​generated by the corresponding system POSIX interface call results (no call, successful call, call with warning, call with error), namely 0, 1, 2, and 3. After obtaining the clustering results, calculate the cluster sum of squares (cluster Sum of Square) of this clustering, recorded as Inertia_0, as a reference standard result when the system is operating normally.

[0089] In the second embodiment of the present application, the measured Inertia_0 is 0.11420345107862839, and this Inertia_0 is used as a reference value for subsequent clustering analogy. The clustering results are as follows: Figure 3a As shown in the figure, we can see that clustering successfully divides the results into 4 clusters. There are 4 types of displays from left to right. Among them, the points in the middle two parts are the most, which represent normal driver calls, and the points on both sides correspond to abnormal driver calls.

[0090] S204: Perform the xth round of monitoring status data collection (x≥1) in the monitoring state, obtain a 3D array, perform times=200 samplings, and store the result Array_x in RAM:

[0091] During the operation of the real-time system to be monitored, the steps of data sampling, grouping and recording in S202 are repeated, that is, the three types of feature data ABC are sampled times=200 times according to the 3D array, and the result Array_x is stored in RAM.

[0092] S205: Use the k-means algorithm to cluster the array Array_x collected under the monitoring status, with parameter k=4, and obtain the intra-cluster sum of squares Inertia_x (201>x>1):

[0093] The clustering results of the subsequent rounds of sampling in the second embodiment of the present application are as follows: Figure 3b , Figure 3c , where the points in the second cluster from left to right represent the set of normal communications, all within the normal range. Figure 3b Inertia_1 is 0.19677935815587339; Figure 3c The Inertia_2 is 0.18829912936372764.

[0094] When an exception occurs in program logic or data processing, the clustering state diagram will change greatly, the proportion of points in the second cluster from left to right will also change, and the value of Inertia will increase accordingly. When the Inertia value exceeds a certain threshold, it can be determined that an abnormal situation may exist, such as Figure 3d The clustering result of Inertia_3 is: 0.28165491161750467, which is obviously larger than the previous two values.

[0095] S206: Calculate the difference ratio of the sum of squares within the cluster between the monitoring state and the normal operation state, which is calculated using the formula (Inertia_x-Inertia_0) / Inertia_0, and compare it with the threshold:

[0096] Calculate the expression (Inertia_n-Inertia_0) / Inertia_0. If the result does not exceed 0.75, it can be considered normal and the system is not abnormal. If the result is greater than 0.75, a warning is issued to the user.

[0097] In the second embodiment of the present application, Figure 3b , Figure 3c The difference between the Inertia value and the reference value does not exceed 75% of the reference value, which can be considered normal and there is no abnormality in the system. Figure 3d According to the expression calculation, we can get:

[0098] (0.28165491161750467-0.11420345107862839) / 0.11420345107862839=1.468

[0099] The result is much greater than 0.75. Therefore, although there is no fatal error in the system, the system business logic and system communication may be abnormal, so a warning will be issued to the user.

[0100] The third embodiment of the present application provides a real-time system operation abnormality monitoring device, such as Figure 4 As shown, including:

[0101] The data collection and clustering processing module is used to be called to perform data collection and clustering processing when the real-time system is in a normal state and a monitoring state; the data collection and clustering processing includes: performing n sampling on at least one monitored data within a sampling period to form n sample points, clustering the n sample points based on a clustering algorithm, and obtaining the clustering results within the sampling period. Specifically, the data collection and clustering processing module can be used to implement step S10 in the first embodiment and its optional embodiments.

[0102] The abnormality determination module is used to determine the possibility of abnormality in the real-time system operation under the monitoring operation state according to the difference between the clustering result under the monitoring operation state and the clustering result under the normal state. Specifically, the data acquisition and clustering processing module can be used to implement step S20 in the first embodiment and its optional embodiments.

[0103] Figure 5 900 is a schematic structural diagram of a computing device 900 provided in an embodiment of the present application. The computing device can execute each optional embodiment of the above method, and the computing device can be a terminal, or a chip or chip system inside the terminal. Figure 5 As shown, the computing device 900 includes: a processor 910 , a memory 920 , and a communication interface 930 .

[0104] It should be understood that Figure 5 The communication interface 930 in the computing device 900 shown may be used to communicate with other devices, and may specifically include one or more transceiver circuits or interface circuits.

[0105] The processor 910 may be connected to a memory 920. The memory 920 may be used to store the program code and data. Therefore, the memory 920 may be a storage unit inside the processor 910, or an external storage unit independent of the processor 910, or a component including a storage unit inside the processor 910 and an external storage unit independent of the processor 910.

[0106] Optionally, the computing device 900 may further include a bus. The memory 920 and the communication interface 930 may be connected to the processor 910 via the bus. The bus may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 5 A line without an arrow is used to represent the bus, but this does not mean that there is only one bus or one type of bus.

[0107] It should be understood that in the embodiment of the present application, the processor 910 may adopt a central processing unit (CPU). The processor may also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc. Alternatively, the processor 910 may adopt one or more integrated circuits to execute relevant programs to implement the technical solutions provided in the embodiment of the present application.

[0108] The memory 920 may include a read-only memory and a random access memory, and provides instructions and data to the processor 910. A portion of the processor 910 may also include a nonvolatile random access memory. For example, the processor 910 may also store information on the device type.

[0109] When the computing device 900 is running, the processor 910 executes the computer-executable instructions in the memory 920 to perform any operation step of the above method and any optional embodiment thereof.

[0110] It should be understood that the computing device 900 according to the embodiment of the present application can correspond to the corresponding subjects in the methods according to the embodiments of the present application, and the above-mentioned and other operations and / or functions of each module in the computing device 900 are respectively for implementing the corresponding processes of each method of the present embodiment. For the sake of brevity, they will not be repeated here.

[0111] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0112] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0113] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0114] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0115] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0116] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0117] An embodiment of the present application also provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, it is used to execute the above method, which includes at least one of the solutions described in the above embodiments.

[0118] The computer storage medium of the embodiment of the present application can adopt any combination of one or more computer-readable media. Computer-readable media can be computer-readable signal media or computer-readable storage media. Computer-readable storage media can be, for example, but not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or devices, or any combination of the above. More specific examples (non-exhaustive lists) of computer-readable storage media include: electrical connections with one or more wires, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), optical fibers, portable compact disk read-only memories (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the above. In this document, computer-readable storage media can be any tangible medium containing or storing programs, which can be used by instruction execution systems, devices or devices or used in combination with them.

[0119] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, which carry computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0120] The program code embodied on the computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0121] Computer program code for performing the operation of the present application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as an independent software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (e.g., using an Internet service provider to connect through the Internet).

[0122] In addition, the words "first, second, third, etc." or module A, module B, module C and other similar terms in the specification and claims are only used to distinguish similar objects and do not represent a specific ordering of the objects. It can be understood that the specific order or sequence can be interchanged where permitted so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein.

[0123] In the above description, the numbers representing the steps, such as S100, S101, etc., do not necessarily mean that the steps will be executed in this manner. If permitted, the order of the steps can be interchanged or they can be executed simultaneously.

[0124] The term "comprising" as used in the description and claims should not be interpreted as being limited to what is listed thereafter; it does not exclude other elements or steps. Therefore, it should be interpreted as specifying the presence of the features, integers, steps or components mentioned, but does not exclude the presence or addition of one or more other features, integers, steps or components and groups thereof. Therefore, the expression "a device comprising means A and B" should not be limited to a device consisting of components A and B only.

[0125] References to "one embodiment" or "an embodiment" in this specification mean that a particular feature, structure, or characteristic described in conjunction with the embodiment is included in at least one embodiment of the present application. Therefore, the phrases "in one embodiment" or "in an embodiment" appearing in various places in this specification do not necessarily refer to the same embodiment, but may refer to the same embodiment. In addition, in one or more embodiments, the particular features, structures, or characteristics can be combined in any appropriate manner, as would be apparent to one of ordinary skill in the art from this disclosure.

[0126] Note that the above are only preferred embodiments of the present application and the technical principles used. Those skilled in the art will understand that the present application is not limited to the specific embodiments described herein, and that various obvious changes, readjustments and substitutions can be made by those skilled in the art without departing from the scope of protection of the present application. Therefore, although the present application is described in more detail through the above embodiments, the present application is not limited to the above embodiments, and may also include more other equivalent embodiments without departing from the concept of the present application, all of which belong to the scope of protection of the present application.

Claims

1. A real-time system operation abnormality monitoring method, characterized in that: include: When the real-time system is in a normal state and a monitoring state, data collection and clustering processing are performed respectively; The data collection and clustering processing includes: performing n sampling on at least one monitored data within a sampling period to form n sample points, clustering the n sample points based on a clustering algorithm to obtain a clustering result within the sampling period; According to the difference between the clustering result in the monitoring operation state and the clustering result in the normal state, the possibility of abnormal operation of the real-time system in the monitoring operation state is determined.

2. The method according to claim 1, characterized in that The at least one data includes at least one of the following: The amount of data read and written by the system driver, the results of the system driver calling the interface provided by the operating system, and the CPU usage.

3. The method according to claim 2, characterized in that The result of the system driver calling the interface provided by the operating system includes: four characteristic values ​​indicating no call, successful call, call with warning or call with error respectively; The number of clusters specified in the clustering algorithm is 4.

4. The method according to claim 3, characterized in that: The clustering algorithm includes a k-means algorithm.

5. The method according to claim 1, characterized in that The degree of difference between the clustering result in the monitoring operation state and the clustering result in the normal state is calculated according to the intra-cluster sum of squares of the clustering in the monitoring operation state and the intra-cluster sum of squares of the clustering in the normal state.

6. The method according to claim 1, characterized in that The n samplings are performed within a sampling period, and the n samplings are performed at a set sampling time interval, wherein the sampling time interval and / or n can be preconfigured.

7. The method according to claim 1, characterized in that The sample points formed when the sampling is performed n times are temporarily stored in the memory.

8. A real-time system operation abnormality monitoring device, characterized in that: include: The data collection and clustering processing module is used to be called to perform data collection and clustering processing when the real-time system is in a normal state and a monitoring state; The data collection and clustering processing includes: performing n sampling on at least one monitored data within a sampling period to form n sample points, clustering the n sample points based on a clustering algorithm to obtain a clustering result within the sampling period; The abnormality determination module is used to determine the possibility of abnormality in the real-time system operation under the monitoring operation state according to the difference between the clustering result under the monitoring operation state and the clustering result under the normal state.

9. A computing device, characterized in that include: processor, and A memory having program instructions stored thereon, wherein when the program instructions are executed by the processor, the processor executes the method for monitoring abnormal operation of a real-time system as claimed in any one of claims 1 to 6.

10. A computer-readable storage medium, characterized in that: Program instructions are stored thereon, and when the program instructions are executed by a computer, the computer is caused to execute the method for monitoring abnormal operation of a real-time system as claimed in any one of claims 1 to 6.

Images