Alarm event information sending method and device, electronic equipment and readable medium

Abstract

The embodiment of the invention discloses an alarm event information sending method and device, electronic equipment and a readable medium. A specific embodiment of the method comprises the following steps: acquiring a log data stream; obtaining an output condition information set; comparing the output condition information set with a pre-acquired historical output condition information set to obtain a comparison result; in response to determining that the comparison result meets a preset identification condition, executing the following steps: obtaining a modification information group and a deletion information group; generating a newly added information group; performing integration processing on the modified information group, the deleted information group and the newly added information group to obtain a modified information set; generating an update information set based on the change information set; generating alarm event information; and sending the alarm event information to a target server. According to the embodiment, the data processing speed can be increased, and computing resource waste is reduced.

Description

Technical Field

[0001] Embodiments of the present disclosure relate to the field of computer technology, and in particular to a method, device, electronic device, and readable medium for sending alarm event information. Background Art

[0002] When users access the Internet, they face a variety of network threats and attacks. Some of these threats or attacks are secretive and may lurk in the user's terminal for a long time without the user's knowledge, leaking data or conducting other malicious activities. Therefore, a technology is needed to identify the network threats or attacks that users are exposed to, and generate alarm event information when it is determined that the user's terminal is exposed to network threats or attacks to prompt the user to take timely network security measures.

[0003] At present, one of the methods used to identify network threats or network attacks and generate alarm event information is as follows: First, obtain the log data stream generated when the user interacts with other applications. Secondly, input the log data stream into the Apache Flink rule engine. Then, use the various output condition information pre-stored in Apache Flink to detect each log data in the log data stream. Finally, based on the detection results, generate alarm event information to prompt the user of the network threat or network attack that may be suffered, and send the alarm event information to the user terminal.

[0004] However, when the above method is used to generate alarm event information, the following technical problems often occur:

[0005] When the output condition information needs to be updated, the Apache Flink rule engine needs to be closed and the storage information corresponding to each updated output condition information needs to be declared through a loop function before the updated output condition information can be used to continue data processing. This results in the rule engine needing to be frequently restarted when the output condition information is frequently updated, resulting in the data processing process being frequently interrupted, which in turn results in a slow data processing speed. In addition, the architecture of the manager used to detect the output condition information is relatively complex, with poor stability and prone to abnormal situations, which can easily lead to the manager failing to detect changes in the output condition information in a timely manner, resulting in untimely updates of the output condition information, and in turn leading to more errors in the alarm event information generated using computing resources, resulting in the need to call computing resources to re-detect the detected log data, resulting in a waste of computing resources.

[0006] The above information disclosed in this Background section is only for enhancement of understanding of the background of the inventive concept and therefore it may contain information that does not form the prior art that is already known in this country to a person of ordinary skill in the art. Summary of the invention

[0007] The content of this disclosure is used to introduce concepts in a brief form, which will be described in detail in the detailed implementation section below. The content of this disclosure is not intended to identify the key features or essential features of the technical solution claimed for protection, nor is it intended to limit the scope of the technical solution claimed for protection.

[0008] Some embodiments of the present disclosure propose a method, device, electronic device, and computer-readable medium for sending alarm event information to solve one or more of the technical problems mentioned in the above background technology section.

[0009] In a first aspect, some embodiments of the present disclosure provide a method for sending alarm event information, the method comprising: obtaining a log data stream, wherein the log data stream comprises various log data, and the log data is interaction log data generated when a user interacts with an application; obtaining an output condition information set, wherein each output condition information in the output condition information set comprises an information number, condition information, and alarm information; comparing the output condition information set with a previously acquired historical output condition information set to obtain a comparison result, wherein the historical output condition information set is stored in a member variable corresponding to a preset storage information; in response to determining that the comparison result satisfies a preset identification condition, executing the following steps: The output condition information set and the historical output condition information set are identified and processed to obtain a modified information group and a deleted information group; based on the output condition information set and the historical output condition information set, a newly added information group is generated; the modified information group, the deleted information group and the newly added information group are integrated and processed to obtain a changed information set; based on the changed information set, an update information set is generated, wherein each update information in the update information set includes an update information number, update condition information, and update alarm information, and the update information set is stored in the member variable; based on the update information set and the log data stream, each alarm event information is generated; and each alarm event information is sent to a target server.

[0010] In a second aspect, some embodiments of the present disclosure provide an alarm event information sending device, the device comprising: a first acquisition unit, configured to acquire a log data stream, wherein the log data stream comprises various log data, and the log data is interaction log data generated when a user interacts with an application; a second acquisition unit, configured to acquire an output condition information set, wherein each output condition information in the output condition information set comprises an information number, condition information, and alarm information; a comparison unit, configured to compare the output condition information set with a pre-acquired historical output condition information set to obtain a comparison result, wherein the historical output condition information set is stored in a member variable corresponding to a preset storage information; an execution unit, configured to respond to determining the comparison If the result meets the preset identification conditions, the following steps are performed: the above-mentioned output condition information set and the above-mentioned historical output condition information set are identified and processed to obtain a modified information group and a deleted information group; based on the above-mentioned output condition information set and the above-mentioned historical output condition information set, a newly added information group is generated; the above-mentioned modified information group, the above-mentioned deleted information group and the above-mentioned newly added information group are integrated and processed to obtain a changed information set; based on the above-mentioned changed information set, an update information set is generated, wherein each update information in the above-mentioned update information set includes an update information number, update condition information, and update alarm information, and the above-mentioned update information set is stored in the above-mentioned member variable; based on the above-mentioned update information set and the above-mentioned log data stream, each alarm event information is generated; and the above-mentioned each alarm event information is sent to the target server.

[0011] In a third aspect, some embodiments of the present disclosure provide an electronic device comprising: one or more processors; a storage device on which one or more programs are stored, and when the one or more programs are executed by the one or more processors, the one or more processors implement the method described in any implementation manner of the above-mentioned first aspect.

[0012] In a fourth aspect, some embodiments of the present disclosure provide a computer-readable medium having a computer program stored thereon, wherein when the program is executed by a processor, the method described in any implementation manner of the above-mentioned first aspect is implemented.

[0013] The above-mentioned various embodiments of the present disclosure have the following beneficial effects: through the alarm event information sending method of some embodiments of the present disclosure, the speed of data processing can be improved and the waste of computing resources can be reduced. Specifically, the reason for the slow data processing speed and the waste of computing resources is that when the output condition information needs to be updated, the Apache Flink rule engine needs to be closed and the storage information corresponding to each updated output condition information needs to be declared through a loop function before the updated output condition information can be used to continue data processing, resulting in the need to frequently restart the rule engine when the output condition information is frequently updated, resulting in the data processing process being frequently interrupted, which in turn leads to a slow data processing speed. In addition, the architecture of the manager used to detect the output condition information is relatively complex, the stability is poor, and abnormal situations are prone to occur, which easily leads to the manager's untimely detection of changes in the output condition information, resulting in untimely updates of the output condition information, and then resulting in more errors in the alarm event information generated using computing resources, resulting in the need to call computing resources to re-detect the detected log data, resulting in a waste of computing resources. Based on this, the alarm event information sending method of some embodiments of the present disclosure, first, obtain a log data stream, wherein the log data stream includes various log data, and the log data is the interaction log data generated when the user interacts with the application. Thus, the data stream to be processed can be obtained. Secondly, an output condition information set is obtained, wherein each output condition information in the output condition information set includes an information number, condition information, and alarm information. Thus, the output condition information can be obtained. Then, the output condition information set is compared with the pre-acquired historical output condition information set to obtain a comparison result, wherein the historical output condition information set is stored in a member variable corresponding to the preset storage information. Thus, by comparing the output condition information obtained twice, it is possible to detect whether the output condition information has changed without using a manager, and the change of the output condition information can be detected more timely, so that the output condition information can be updated in time, thereby reducing the error of the generated alarm event information and reducing the waste of computing resources. Then, in response to determining that the comparison result satisfies the preset identification condition, the following steps are performed: First, the output condition information set and the historical output condition information set are identified and processed to obtain a modification information group and a deletion information group. Thus, the output condition information that needs to be deleted and modified after the change can be detected. Secondly, based on the output condition information set and the historical output condition information set, a new information group is generated. Thus, the output condition information that needs to be added after the change can be detected. Then, the modification information group, the deletion information group and the new information group are integrated to obtain a change information set. Thus, the existing output condition information set can be updated through the integrated output condition information set.Then, based on the above-mentioned change information set, an update information set is generated, wherein each update information in the above-mentioned update information set includes an update information number, update condition information, and update alarm information, and the above-mentioned update information set is stored in the above-mentioned member variable. Thus, an updated output condition information set can be obtained. Then, based on the above-mentioned update information set and the above-mentioned log data stream, each alarm event information is generated. Thus, each alarm event information can be obtained. Finally, the above-mentioned each alarm event information is sent to the target server. Thus, the generated alarm event information can be sent to the target server. Also, because it is possible to detect whether the output condition information has changed by directly comparing the output condition information obtained twice in succession without introducing an additional manager, the change of the output condition information can be obtained in time, and the condition information can be updated in time, thereby reducing the error of the generated alarm event information, and reducing the situation of calling computing resources to re-detect the detected log data, thereby reducing the waste of computing resources. Also, because the output condition information before and after the update can be stored in the same storage information, the storage information can be declared only once when the condition information is updated, without the need to declare the storage information corresponding to each output condition information through a loop function. Therefore, when the output condition information is frequently updated, there is no need to frequently restart the Apache Flink rule engine, and data can be processed uninterruptedly, thereby improving the data processing speed. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and that components and elements are not necessarily drawn to scale.

[0015] Figure 1 is a flowchart of some embodiments of the method for sending alarm event information according to the present disclosure;

[0016] Figure 2 is a schematic diagram of the structure of some embodiments of the alarm event information sending device according to the present disclosure;

[0017] Figure 3 It is a schematic diagram of the structure of an electronic device suitable for implementing some embodiments of the present disclosure. DETAILED DESCRIPTION

[0018] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments set forth herein. On the contrary, these embodiments are provided to provide a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0019] It should also be noted that, for ease of description, only the parts related to the invention are shown in the drawings. In the absence of conflict, the embodiments and features in the embodiments of the present disclosure can be combined with each other.

[0020] It should be noted that the concepts such as "first" and "second" mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0021] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0022] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0023] The present disclosure will be described in detail below with reference to the accompanying drawings and in conjunction with embodiments.

[0024] Figure 1 The process 100 of some embodiments of the method for sending alarm event information according to the present disclosure is shown. The method for sending alarm event information comprises the following steps:

[0025] Step 101: Obtain log data stream.

[0026] In some embodiments, the execution subject (e.g., a computing device) of the alarm event information sending method can obtain a log data stream. Among them, the above-mentioned log data can be the interaction log data generated when the user interacts with the application. The above-mentioned interaction can be a click operation performed by the user on the application. The above-mentioned application may include but is not limited to: a website, an application software. The above-mentioned interaction log data may include but is not limited to: access time, user's IP address, access path. The above-mentioned log data stream includes various log data. In practice, first, the above-mentioned execution subject can obtain all log data of all users from the data storage server. Then, all the obtained log data can be converted into a log data stream through the built-in data conversion operator of ApacheFlink. Among them, the above-mentioned data storage server can be a server for managing and storing the above-mentioned log data stream. The above-mentioned data conversion operator can be a Reduce operator. The above-mentioned execution subject can be a server.

[0027] Step 102: Obtain an output condition information set.

[0028] In some embodiments, the execution subject may obtain an output condition information set. The output condition information may be a condition used in a rule engine to specify an input data stream. Each of the output condition information includes an information number, condition information, and alarm information. The information number may be the number of the output condition information. The condition information may be a condition that the input data needs to meet. The alarm information may be information used to notify that a specific event has been triggered. As an example: when the output condition information is "1: a==100, DDoS attack alarm", and the input data is "a==100", the input data meets the condition information in the output condition information, and the alarm information "DDoS attack alarm" is output. In practice, the execution subject may obtain the output condition information set from the information storage server at regular intervals through a custom data source. The information storage server may be a server for managing and storing output condition information. The custom data source may be a custom Apache Flink data source. The custom data source may be used to define the source of data acquisition, the method of data acquisition, and the form of data conversion.

[0029] Step 103: compare the output condition information set with the pre-acquired historical output condition information set to obtain a comparison result.

[0030] In some embodiments, the execution subject may compare the output condition information set with the pre-acquired historical output condition information set to obtain a comparison result. The historical output condition information may be the output condition information obtained by the execution subject before obtaining the output condition information in step 102. The historical output condition information set is stored in a member variable corresponding to the preset storage information. The storage information may be a custom class for processing data in Apache Flink. For example, the storage information may be RuleProcessFunction. The member variable may be a member variable of the Map type corresponding to the storage information. The "key" part in the member variable may be used to store the information number. The "value" part in the member variable may be used to store condition information and alarm information. In practice, the execution subject may input the output condition information set into the storage information through a broadcast stream for comparison, and store the output condition information set in the corresponding memory area in the form of a stack. In practice, when there are various storage information, the execution subject may store the historical output condition information set in a member variable corresponding to each storage information of the various storage information. Then, the execution subject may input the output condition information set into each of the storage information respectively.

[0031] In some optional implementations of some embodiments, each output condition information in the output condition information set has an update time field, and each historical output condition information in the historical output condition information set has an update time field. The execution subject may compare the output condition information set with the previously acquired historical output condition information set through the following steps to obtain a comparison result:

[0032] The first step is to determine each update time field corresponding to the above historical output condition information set as each historical information update time field. The update time field corresponding to the above output condition information can be used to represent the time point when the output condition information is generated. The update time field corresponding to the above historical output condition information can be used to represent the time point when the historical output condition information is generated.

[0033] In the second step, for each output condition information in the output condition information set, perform the following steps:

[0034] In the first sub-step, the update time field corresponding to the output condition information is determined as the information update time field.

[0035] The second sub-step is to compare the information update time field with each of the historical information update time fields to obtain an update time comparison result. The update time comparison result may be a label used to indicate whether the information update time field is consistent with each of the historical information update time fields. For example, the update time comparison result may be "consistent" or "neither consistent".

[0036] In the third step, in response to determining that each update time comparison result obtained satisfies a preset update time condition, the no-change information is determined as the comparison result. The update time condition may be that all update time comparison results are "consistent". The no-change information may be a label used to indicate that the output condition information set has not changed. For example, the no-change information may be "no change".

[0037] In step 4, in response to determining that the obtained update time comparison results do not meet the above update time condition, the change information is determined as the comparison result. The change information may be a label used to indicate that the output condition information set has changed. For example, the change information may be "changed".

[0038] Step 104, in response to determining that the comparison result meets the preset recognition condition, perform the following steps:

[0039] Step 1041, identify and process the output condition information set and the historical output condition information set to obtain a modification information group and a deletion information group.

[0040] In some embodiments, the execution subject may identify and process the output condition information set and the historical output condition information set to obtain a modification information group and a deletion information group.

[0041] In the process of adopting technical solutions to solve the above technical problem 1, the following problems are often accompanied:

[0042] When updating the output condition information, directly using the latest output condition information to overwrite the original output condition information can easily lead to errors or loss of the updated output condition information, which in turn leads to more errors when using computing resources to generate alarm event information, resulting in the need to call computing resources to re-check the detected log data, resulting in a waste of computing resources.

[0043] Faced with the above technical problems, we decided to adopt the following solutions:

[0044] In some optional implementations of some embodiments, the execution subject may identify and process the output condition information set and the historical output condition information set through the following steps to obtain a modification information group and a deletion information group:

[0045] The first step is to determine the information number corresponding to each output condition information in the output condition information set as the output condition information number. Wherein, each historical output condition information in the historical output condition information set corresponds to an information number. The information number may be the number corresponding to the historical output condition information.

[0046] Step 2: For each piece of historical output condition information in the above historical output condition information set, perform the following steps:

[0047] In the first sub-step, the information number corresponding to the above historical output condition information is used to determine the historical information number.

[0048] The second sub-step is to search the output condition information number corresponding to the above historical information number from the determined output condition information numbers to obtain a first search result. The first search result may be the output condition information number corresponding to the above historical information number or a null value. The output condition information number corresponding to the above historical information number may be the same output condition information number as the above historical information number. In practice, the execution subject may traverse the above output condition information set through a loop function to obtain the first search result. The loop function may be a for function.

[0049] The third sub-step is, in response to determining that the first search result satisfies the first preset search condition, executing the following steps:

[0050] Sub-step 1: determining the output condition information number corresponding to the first search result as the information number to be identified. The first preset search condition may be that the first search result is not a null value.

[0051] Sub-step two: determining the output condition information corresponding to the above-mentioned information number to be identified as the output condition information to be identified.

[0052] Sub-step three, compare the historical output condition information with the output condition information to be identified to obtain an information comparison result. The information comparison result may be a label used to indicate whether the historical output condition information and the output condition information to be identified are consistent. The information comparison result may be "consistent" or "inconsistent".

[0053] Sub-step 4: in response to determining that the information comparison result satisfies a preset information modification condition, determining the historical output condition information as modification information. The preset information modification condition may be that the information comparison result is "inconsistent".

[0054] Sub-step five: in response to determining that the information comparison result does not satisfy the preset information modification condition, determining the historical output condition information as unmodified information.

[0055] A fourth sub-step, in response to determining that the first search result does not satisfy the first preset search condition, determines the historical output condition information as deletion information.

[0056] The third step is to determine the determined individual modification information as a modification information group.

[0057] The fourth step is to determine the determined deletion information as a deletion information group.

[0058] The above technical solution and its related contents, as an inventive point of an embodiment of the present disclosure, solve the technical problem of "waste of computing resources". The factors leading to waste of computing resources are often as follows: when updating the output condition information, the updated output condition information is often directly used to overwrite the original output condition information, which easily leads to errors or loss of the updated output condition information, and then leads to more errors when using the wrong or lost output condition information to generate alarm event information, resulting in the need to call computing resources to re-detect the detected log data, resulting in waste of computing resources. If the above factors are solved, the waste of computing resources can be reduced. In order to achieve this effect, the present disclosure first determines the information number corresponding to each output condition information in the above output condition information set as the output condition information number. Thus, the number of each output condition information can be obtained. Then, for each historical output condition information in the above historical output condition information set, the following steps are performed: First, the information number corresponding to the above historical output condition information is determined as the historical information number. Thus, the information number corresponding to the above historical output condition information can be determined. Then, the output condition information number corresponding to the above historical information number is searched from the determined output condition information numbers to obtain the first search result. Thus, it is possible to determine whether the historical output condition information corresponding to the historical information number is still in the latest output condition information set according to the search result. Then, in response to determining that the above-mentioned first search result meets the first preset search condition, the following steps are performed: first, the output condition information number corresponding to the above-mentioned first search result is determined as the information number to be identified. Thus, the information number of the output condition information can be determined. Secondly, the output condition information corresponding to the above-mentioned information number to be identified is determined as the output condition information to be identified. Thus, the corresponding output condition information can be found through the information number. Then, the above-mentioned historical output condition information is compared with the above-mentioned output condition information to be identified to obtain the information comparison result. Thus, it is possible to determine whether the output condition information has changed by comparison. Then, in response to determining that the above-mentioned information comparison result meets the preset information modification condition, the above-mentioned historical output condition information is determined as the modification information. Thus, when the output condition information changes, the corresponding historical output condition information can be determined as the modification information so as to be uniformly modified in subsequent processing. Then, in response to determining that the above-mentioned information comparison result does not meet the above-mentioned preset information modification condition, the above-mentioned historical output condition information is determined as no modification information. Thus, when there is no change, the historical output condition information can be directly determined as unmodified information, thereby indicating that the information does not need to be modified. Then, in response to determining that the first search result does not meet the first preset search condition, the historical output condition information is determined as deleted information. Thus, it can be determined that the historical output condition information corresponding to the historical information number is not in the latest output condition information set, and the historical output condition information can be determined as deleted information.Then, each determined modification information is determined as a modification information group. Thus, all output condition information that needs to be modified can be obtained. Finally, each determined deletion information is determined as a deletion information group. Thus, all output condition information that needs to be deleted can be obtained. Also, because all output condition information that needs to be modified and deleted can be determined in advance, so that in subsequent processing, each output condition information can be processed accordingly in turn according to the determined output condition information, thereby reducing the situation where the output condition information after the update is wrong or lost, and further reducing the situation where the computing resources are called to re-detect the detected log data, reducing the errors when using the output condition information to generate alarm event information, and reducing the waste of computing resources.

[0059] Step 1042: Generate a new information group based on the output condition information set and the historical output condition information set.

[0060] In some embodiments, the execution subject may generate a new information group based on the output condition information set and the historical output condition information set, wherein the new information may be condition information that belongs to the output condition information set but does not belong to the historical output condition information set.

[0061] In some optional implementations of some embodiments, the execution subject may generate a new information group based on the output condition information set and the historical output condition information set through the following steps:

[0062] The first step is to determine the information number corresponding to each historical output condition information in the historical output condition information set as the historical output condition information number.

[0063] In the second step, for each output condition information in the output condition information set, perform the following steps:

[0064] In the first sub-step, the information number corresponding to the output condition information is determined as the information number to be searched.

[0065] The second sub-step is to search the historical output condition information number corresponding to the information number to be searched from the determined historical output condition information numbers to obtain a second search result. The second search result may be the historical output condition information number corresponding to the information number to be searched or a null value. In practice, the execution subject may traverse the historical output condition information set through a loop function to obtain the second search result. The loop function may be a for function.

[0066] The third sub-step is, in response to determining that the second search result satisfies a second preset search condition, determining the output condition information as new information. The second preset search condition may be that the second search result is not a null value.

[0067] A fourth sub-step, in response to determining that the second search result does not satisfy the second preset search condition, determines the output condition information as original information.

[0068] The third step is to determine each piece of newly added information as a newly added information group.

[0069] Step 1043, integrating the modified information group, the deleted information group and the newly added information group to obtain a changed information set.

[0070] In some embodiments, the execution subject may integrate the modification information group, the deletion information group and the new information group to obtain a change information set. In practice, the execution subject may combine the modification information group, the deletion information group and the new information group into a change information set.

[0071] Step 1044, generating an update information set based on the change information set.

[0072] In some embodiments, the execution subject may generate an update information set based on the change information set. The update information in the update information set may be updated output condition information. Each update information in the update information set includes an update information number, update condition information, and update warning information. The update information number may be a number corresponding to the update information. The update condition information may be updated condition information. The update warning information may be updated warning information. The update information set is stored in the member variable. In practice, when the comparison result satisfies the preset identification condition, the execution subject may directly replace the historical output condition information set with the generated update information set, and store the update information set in the member variable. In practice, when there are various storage information, for each of the various storage information, the execution subject may replace the historical output condition information set stored in the member variable corresponding to the storage information with the update information set.

[0073] In the process of adopting technical solutions to solve the above technical problem 1, the following problems are often accompanied:

[0074] The updated output condition information is prone to the situation where the allocated storage resources are too large. When the allocated storage resources are too large, a large amount of storage resources are idle but cannot be used by other processes, resulting in a waste of storage resources.

[0075] Faced with the above technical problems, we decided to adopt the following solutions:

[0076] In some optional implementations of some embodiments, the execution subject may generate an update information set based on the change information set by performing the following steps:

[0077] In the first step, the deletion information group included in the above-mentioned change information set is determined as the information group to be deleted.

[0078] The second step is to perform a clearing process on each piece of information to be deleted in the group of information to be deleted. In practice, the execution subject may perform a clearing process on the information to be deleted through an operation command.

[0079] The third step is to determine the modified information group included in the above-mentioned modified information set as the information group to be modified.

[0080] Step 4: Based on each piece of information to be modified in the above-mentioned information group to be modified, perform the following steps:

[0081] In the first sub-step, the historical output condition information corresponding to the information to be modified is determined as the historical output condition information to be modified.

[0082] The second sub-step is to send the historical output condition information to be modified to a target server to perform data backup on the historical output condition information to be modified. The target server may be a cloud server for storing and managing data.

[0083] The third sub-step is to clear the above historical output condition information to be modified. In practice, the above execution subject can clear the above historical output condition information through a library function. The above library function can be remove().

[0084] The fourth sub-step is to determine the output condition information corresponding to the information to be modified as the modified information.

[0085] Step 5: determine the newly added information group included in the above-mentioned changed information set as the information group to be added.

[0086] Step 6: Integrate the determined modified information and the information group to be added to obtain an updated information set. In practice, the execution subject may combine the modified information and the information group to be added into an updated information set. In practice, the execution subject may clear the output condition information set and the historical output condition information set through a library function. The library function may be clear().

[0087] Step 7: Based on the update information set, determine the memory usage information corresponding to the update information set. The memory usage information may be the size of the memory space used by the update information set. In practice, the execution subject may obtain the memory usage information corresponding to the update information set through the Instrumentation interface.

[0088] Step 8. In response to determining that the memory usage information is greater than the preset allocated memory amount, increase the physical memory allocated to the update information set to adjust the storage resource allocation of the update information set. The preset allocated memory amount may be a preset memory value for storing the update information set. For example, the preset allocated memory amount may be 256MB. In practice, first, the execution entity may determine the difference between the memory usage information and the preset allocated memory amount as the allocated amount. Then, the malloc function may be used to allocate the memory that is in an idle state and has a storage size of the allocated amount to the update information set to increase the physical memory allocated to the update information set.

[0089] In step 9, in response to determining that the memory usage information is less than the preset allocated memory amount, the physical memory allocated to the update information set is reduced to adjust the storage resource allocation of the update information set. In practice, first, the execution subject may determine the difference between the memory usage information and the preset allocated memory amount as the released amount. Then, the memory allocated to the update information set, in an idle state and with a storage size equal to the released amount, may be allocated to other processes through the malloc function to reduce the physical memory allocated to the update information set.

[0090] The above technical solution and its related contents, as an inventive point of an embodiment of the present disclosure, solve the technical problem of "waste of storage resources". The factors that lead to waste of storage resources are often as follows: the size of the physical memory occupied by the updated output condition information may be different from that of the output condition information before the update. When the physical memory allocated to the output condition information before the update is much larger than the physical memory required by the updated output condition information, a large amount of physical memory will be idle but cannot be used by other processes, which leads to waste of storage resources. If the above factors are solved, the waste of storage resources can be reduced. In order to achieve this effect, the present disclosure first determines the deletion information group included in the above change information set as the information group to be deleted. Thus, all the output condition information that needs to be deleted can be obtained. Secondly, based on each information to be deleted in the above information group to be deleted, the above information to be deleted is cleared. Thus, each output condition information that needs to be deleted can be deleted. Then, the modification information group included in the above change information set is determined as the information group to be modified. Thus, all the output condition information that needs to be modified can be obtained. Then, based on each information to be modified in the above-mentioned information group to be modified, the following steps are performed: first, the historical output condition information corresponding to the above-mentioned information to be modified is determined as the historical output condition information to be modified. Thus, the historical output condition information that needs to be modified can be determined. Secondly, the above-mentioned historical output condition information to be modified is sent to the target server to perform data backup on the above-mentioned historical output condition information to be modified. Thus, the historical output condition information that needs to be deleted can be backed up. Then, the above-mentioned historical output condition information to be modified is cleared. Thus, the historical output condition information corresponding to the output condition information that needs to be modified can be deleted. Then, the output condition information corresponding to the above-mentioned information to be modified is determined as modified information. Thus, the modified output condition information can be determined as new output condition information. Then, the newly added information group included in the above-mentioned change information set is determined as the information group to be added. Thus, all newly added output condition information can be obtained. Then, the determined modified information and the above-mentioned information group to be added are integrated to obtain an updated information set. Thus, the original output condition information set can be updated to obtain an updated output condition information set. Then, based on the update information set, the memory usage information corresponding to the update information set is determined. Thus, the memory space occupied by the update information set can be obtained. Then, in response to determining that the memory usage information is greater than the preset allocated memory amount, the physical memory allocated to the update information set is increased to adjust the storage resource allocation of the update information set. Thus, when the memory space occupied by the update information set is too large, the excess physical memory can be allocated to other processes for use, which can reduce the waste of storage resources.Finally, in response to determining that the memory usage information is less than the preset allocated memory amount, the physical memory allocated to the update information set is reduced to adjust the storage resource allocation of the update information set. Thus, when the physical memory occupied by the update information set is too small, more memory can be allocated to maintain the normal call of the output condition information. Also, because when the physical memory occupied by the update information set is too large, the physical memory in the idle state among all the physical memories allocated to the update information set can be allocated to other processes for use, thereby reducing the situation where a large amount of storage resources are idle but cannot be used by other processes, and reducing the waste of storage resources.

[0091] Step 1045: Generate each alarm event information based on the update information set and the log data stream.

[0092] In some embodiments, the execution subject may generate various alarm event information based on the update information set and the log data stream, wherein the alarm event information may be information used to indicate that the corresponding condition information has been triggered.

[0093] In some optional implementations of some embodiments, the execution subject may generate each alarm event information based on the update information set and the log data stream through the following steps:

[0094] For each update information in the above-mentioned update information set that meets the preset information condition and each log data in the above-mentioned log data stream, in response to determining that the above-mentioned log data meets the update condition information corresponding to the above-mentioned update information, alarm event information is generated based on the above-mentioned update information and the above-mentioned log data. Among them, the above-mentioned preset information condition may be that the update condition information included in the update information does not belong to the frequency condition information. The above-mentioned frequency condition information may be information for specifying the number of times a specific type of data needs to occur within a preset time range. For example, the above-mentioned frequency condition information may be "a == 100 appears 3 times within 30s". In practice, the above-mentioned execution entity may determine the update alarm information corresponding to the above-mentioned update information as the above-mentioned alarm event information.

[0095] In some optional implementations of some embodiments, the execution subject may generate each alarm event information based on the update information set and the log data stream through the following steps:

[0096] In the first step, for each update information in the update information set that does not meet the preset information condition, the following steps are performed:

[0097] In the first sub-step, each log data corresponding to the update information in the log data stream is determined as each target log data.

[0098] The second sub-step is to determine the quantity of each target log data as the target quantity.

[0099] The third sub-step is to generate alarm event information based on the update information and the target log data in response to determining that the target quantity satisfies the update condition information corresponding to the update information. In practice, the execution subject may determine the update alarm information included in the update information as the alarm event information.

[0100] Step 1046, sending each alarm event information to the target server.

[0101] In some embodiments, the execution subject may send each of the alarm event information to a target server, wherein the target server may be a server for receiving and managing the alarm event information.

[0102] The above-mentioned various embodiments of the present disclosure have the following beneficial effects: through the alarm event information sending method of some embodiments of the present disclosure, the speed of data processing can be improved and the waste of computing resources can be reduced. Specifically, the reason for the slow data processing speed and the waste of computing resources is that when the output condition information needs to be updated, the Apache Flink rule engine needs to be closed and the storage information corresponding to each updated output condition information needs to be declared through a loop function before the updated output condition information can be used to continue data processing, resulting in the need to frequently restart the rule engine when the output condition information is frequently updated, resulting in the data processing process being frequently interrupted, which in turn leads to a slow data processing speed. In addition, the architecture of the manager used to detect the output condition information is relatively complex, the stability is poor, and abnormal situations are prone to occur, which easily leads to the manager's untimely detection of changes in the output condition information, resulting in untimely updates of the output condition information, and then resulting in more errors in the alarm event information generated using computing resources, resulting in the need to call computing resources to re-detect the detected log data, resulting in a waste of computing resources. Based on this, the alarm event information sending method of some embodiments of the present disclosure, first, obtain a log data stream, wherein the log data stream includes various log data, and the log data is the interaction log data generated when the user interacts with the application. Thus, the data stream to be processed can be obtained. Secondly, an output condition information set is obtained, wherein each output condition information in the output condition information set includes an information number, condition information, and alarm information. Thus, the output condition information can be obtained. Then, the output condition information set is compared with the pre-acquired historical output condition information set to obtain a comparison result, wherein the historical output condition information set is stored in a member variable corresponding to the preset storage information. Thus, by comparing the output condition information obtained twice, it is possible to detect whether the output condition information has changed without using a manager, and the change of the output condition information can be detected more timely, so that the output condition information can be updated in time, thereby reducing the error of the generated alarm event information and reducing the waste of computing resources. Then, in response to determining that the comparison result satisfies the preset identification condition, the following steps are performed: First, the output condition information set and the historical output condition information set are identified and processed to obtain a modification information group and a deletion information group. Thus, the output condition information that needs to be deleted and modified after the change can be detected. Secondly, based on the output condition information set and the historical output condition information set, a new information group is generated. Thus, the output condition information that needs to be added after the change can be detected. Then, the modification information group, the deletion information group and the new information group are integrated to obtain a change information set. Thus, the existing output condition information set can be updated through the integrated output condition information set.Then, based on the above-mentioned change information set, an update information set is generated, wherein each update information in the above-mentioned update information set includes an update information number, update condition information, and update alarm information, and the above-mentioned update information set is stored in the above-mentioned member variable. Thus, an updated output condition information set can be obtained. Then, based on the above-mentioned update information set and the above-mentioned log data stream, each alarm event information is generated. Thus, each alarm event information can be obtained. Finally, the above-mentioned each alarm event information is sent to the target server. Thus, the generated alarm event information can be sent to the target server. Also, because it is possible to detect whether the output condition information has changed by directly comparing the output condition information obtained twice in succession without introducing an additional manager, the change of the output condition information can be obtained in time, and the condition information can be updated in time, thereby reducing the error of the generated alarm event information, and reducing the situation of calling computing resources to re-detect the detected log data, thereby reducing the waste of computing resources. Also, because the output condition information before and after the update can be stored in the same storage information, the storage information can be declared only once when the condition information is updated, without the need to declare the storage information corresponding to each output condition information through a loop function. Therefore, when the output condition information is frequently updated, there is no need to frequently restart the Apache Flink rule engine, and data can be processed uninterruptedly, thereby improving the data processing speed.

[0103] Further references Figure 2 As an implementation of the methods shown in the above figures, the present disclosure provides some embodiments of a device for sending alarm event information. These device embodiments are similar to Figure 1 Corresponding to the method embodiments shown, the device can be specifically applied to various electronic devices.

[0104] like Figure 2As shown, the alarm event information sending device 200 of some embodiments includes: a first acquisition unit 201, a second acquisition unit 202, a comparison unit 203 and an execution unit 204. The first acquisition unit 201 is configured to acquire a log data stream, wherein the log data stream includes various log data, and the log data is interaction log data generated when the user interacts with the application; the second acquisition unit 202 is configured to acquire an output condition information set, wherein each output condition information in the output condition information set includes an information number, condition information, and alarm information; the comparison unit 203 is configured to compare the output condition information set with a pre-acquired historical output condition information set to obtain a comparison result, wherein the historical output condition information set is stored in a member variable corresponding to a preset storage information; the execution unit 204 is configured to respond to determining that the comparison result meets a preset identification condition. , perform the following steps: identify and process the above-mentioned output condition information set and the above-mentioned historical output condition information set to obtain a modified information group and a deleted information group; generate a newly added information group based on the above-mentioned output condition information set and the above-mentioned historical output condition information set; integrate the above-mentioned modified information group, the above-mentioned deleted information group and the above-mentioned newly added information group to obtain a changed information set; generate an update information set based on the above-mentioned changed information set, wherein each update information in the above-mentioned update information set includes an update information number, update condition information, and update alarm information, and the above-mentioned update information set is stored in the above-mentioned member variable; generate each alarm event information based on the above-mentioned update information set and the above-mentioned log data stream; and send the above-mentioned each alarm event information to the target server.

[0105] It is understood that the units described in the device 200 are similar to those described in the reference Figure 1 Therefore, the operations, features and beneficial effects described above for the method are also applicable to the device 200 and the units included therein, and will not be described in detail here.

[0106] Reference below Figure 3 , which shows an electronic device (such as Figure 1 A schematic diagram of the structure of the computing device 101)300 is shown. Figure 3 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0107] like Figure 3As shown, the electronic device 300 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 301, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 302 or a program loaded from a storage device 308 into a random access memory (RAM) 303. In the RAM 303, various programs and data required for the operation of the electronic device 300 are also stored. The processing device 301, the ROM 302, and the RAM 303 are connected to each other via a bus 304. An input / output (I / O) interface 305 is also connected to the bus 304.

[0108] Typically, the following devices may be connected to the I / O interface 305: input devices 306 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; output devices 307 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 308 including, for example, a magnetic tape, a hard disk, etc.; and communication devices 309. The communication devices 309 may allow the electronic device 300 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 3 The electronic device 300 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead. Figure 3 Each block shown in the figure may represent one device, or may represent multiple devices as required.

[0109] In particular, according to some embodiments of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, some embodiments of the present disclosure include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In some such embodiments, the computer program can be downloaded and installed from the network through the communication device 309, or installed from the storage device 308, or installed from the ROM 302. When the computer program is executed by the processing device 301, the above-mentioned functions defined in the method of some embodiments of the present disclosure are executed.

[0110] It should be noted that the computer-readable medium recorded in some embodiments of the present disclosure may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In some embodiments of the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In some embodiments of the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0111] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (HyperText Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0112] The above-mentioned computer-readable medium may be included in the above-mentioned electronic device; or it may exist independently without being assembled into the electronic device. The above-mentioned computer-readable medium carries one or more programs. When the above-mentioned one or more programs are executed by the electronic device, the electronic device: obtains a log data stream, wherein the above-mentioned log data stream includes various log data, and the above-mentioned log data is interaction log data generated when the user interacts with the application; obtains an output condition information set, wherein each output condition information in the above-mentioned output condition information set includes an information number, condition information, and alarm information; compares the above-mentioned output condition information set with a previously obtained historical output condition information set to obtain a comparison result, wherein the above-mentioned historical output condition information set is stored in a member variable corresponding to a preset storage information; in response to determining that the above-mentioned comparison result meets the preset recognition condition, executes The following steps are as follows: identify and process the above-mentioned output condition information set and the above-mentioned historical output condition information set to obtain a modified information group and a deleted information group; generate a newly added information group based on the above-mentioned output condition information set and the above-mentioned historical output condition information set; integrate the above-mentioned modified information group, the above-mentioned deleted information group and the above-mentioned newly added information group to obtain a changed information set; generate an update information set based on the above-mentioned changed information set, wherein each update information in the above-mentioned update information set includes an update information number, update condition information, and update alarm information, and the above-mentioned update information set is stored in the above-mentioned member variable; generate each alarm event information based on the above-mentioned update information set and the above-mentioned log data stream; and send the above-mentioned each alarm event information to the target server.

[0113] Computer program code for performing the operations of some embodiments of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0114] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0115] The units described in some embodiments of the present disclosure may be implemented by software or by hardware. The described units may also be provided in a processor, for example, may be described as: a processor comprising a first acquisition unit, a second acquisition unit, a comparison unit, and an execution unit. The names of these units do not, in certain cases, constitute limitations on the units themselves, for example, the first acquisition unit may also be described as a "unit for acquiring log data streams".

[0116] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0117] The above descriptions are only some preferred embodiments of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of the invention involved in the embodiments of the present disclosure is not limited to the technical solutions formed by a specific combination of the above-mentioned technical features, but should also cover other technical solutions formed by any combination of the above-mentioned technical features or their equivalent features without departing from the above-mentioned inventive concept. For example, the above-mentioned features are replaced with the technical features with similar functions disclosed in the embodiments of the present disclosure (but not limited to) and the technical solutions formed.

Claims

1. A method for sending alarm event information, comprising: Acquire a log data stream, wherein the log data stream includes various log data, and the log data is interaction log data generated when a user interacts with an application; Acquire an output condition information set, wherein each output condition information in the output condition information set includes an information number, condition information, and alarm information; Comparing the output condition information set with a previously acquired historical output condition information set to obtain a comparison result, wherein the historical output condition information set is stored in a member variable corresponding to the preset storage information; In response to determining that the comparison result satisfies a preset identification condition, performing the following steps: Identify and process the output condition information set and the historical output condition information set to obtain a modification information group and a deletion information group; Based on the output condition information set and the historical output condition information set, generating a new information group; Integrate the modified information group, the deleted information group and the newly added information group to obtain a changed information set; Based on the change information set, an update information set is generated, wherein each update information in the update information set includes an update information number, update condition information, and update warning information, and the update information set is stored in the member variable; Based on the update information set and the log data stream, generate each alarm event information; Send each alarm event information to the target server.

2. The method according to claim 1, wherein: Each output condition information in the output condition information set has an update time field, and each historical output condition information in the historical output condition information set has an update time field; And the output condition information set is compared with the previously acquired historical output condition information set to obtain a comparison result, including: Determine each update time field corresponding to the historical output condition information set as each historical information update time field; For each output condition information in the output condition information set, perform the following steps: Determine the update time field corresponding to the output condition information as the information update time field; Comparing the information update time field with each of the historical information update time fields to obtain an update time comparison result; in response to determining that each of the obtained update time comparison results satisfies a preset update time condition, determining unchanged information as a comparison result; In response to determining that each of the obtained update time comparison results does not satisfy the update time condition, the change information is determined as the comparison result.

3. The method according to claim 1, wherein: Each piece of historical output condition information in the historical output condition information set corresponds to an information number; And the generating of a new information group based on the output condition information set and the historical output condition information set includes: Determine the information number corresponding to each piece of historical output condition information in the historical output condition information set as the historical output condition information number; For each output condition information in the output condition information set, perform the following steps: Determine the information number corresponding to the output condition information as the information number to be searched; Searching for the historical output condition information number corresponding to the information number to be searched from each determined historical output condition information number to obtain a second search result; In response to determining that the second search result satisfies a second preset search condition, determining the output condition information as newly added information; In response to determining that the second search result does not satisfy the second preset search condition, determining the output condition information as original information; The determined pieces of new information are determined as a new information group.

4. The method according to claim 1, wherein: The generating each alarm event information based on the update information set and the log data stream includes: For each update information in the update information set that meets the preset information condition, and for each log data in the log data stream, in response to determining that the log data meets the update condition information corresponding to the update information, alarm event information is generated based on the update information and the log data.

5. The method according to claim 4, wherein: The generating each alarm event information based on the update information set and the log data stream includes: For each update information in the update information set that does not meet the preset information condition, perform the following steps: Determine each log data corresponding to the update information in the log data stream as each target log data; Determine the quantity of each target log data as the target quantity; In response to determining that the target quantity satisfies the update condition information corresponding to the update information, alarm event information is generated based on the update information and the respective target log data.

6. A device for sending alarm event information, comprising: A first acquisition unit is configured to acquire a log data stream, wherein the log data stream includes various log data, and the log data is interaction log data generated when a user interacts with an application; A second acquisition unit is configured to acquire an output condition information set, wherein each output condition information in the output condition information set includes an information number, condition information, and alarm information; a comparison unit configured to compare the output condition information set with a previously acquired historical output condition information set to obtain a comparison result, wherein the historical output condition information set is stored in a member variable corresponding to the preset storage information; The execution unit is configured to execute the following steps in response to determining that the comparison result meets the preset identification condition: identify the output condition information set and the historical output condition information set to obtain a modified information group and a deleted information group; generate a newly added information group based on the output condition information set and the historical output condition information set; integrate the modified information group, the deleted information group and the newly added information group to obtain a changed information set; generate an update information set based on the changed information set, wherein each update information in the update information set includes an update information number, update condition information, and update alarm information, and the update information set is stored in the member variable; generate each alarm event information based on the update information set and the log data stream; and send each alarm event information to a target server.

7. An electronic device comprising: one or more processors; a storage device having one or more programs stored thereon; When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 5.

8. A computer readable medium having a computer program stored thereon, wherein: When the program is executed by a processor, the method according to any one of claims 1 to 5 is implemented.

Images