Memory leak detection method and device based on KNN and medium

Abstract

The invention discloses a memory leak detection method and device based on KNN and a medium, belongs to the technical field of intelligent operation and maintenance, and is used for solving the technical problems that an existing memory anomaly detection algorithm is mainly oriented to universal memory faults such as resource bottleneck and insufficient capacity and is not accurate enough in memory leak fault recognition and lagged in fault recognition. The method comprises the following steps: acquiring a memory monitoring index data set of a target system in a preset time period; determining whether any data point is an abnormal point or not based on the distance between any data point in the memory monitoring index data set and other data points; and if the number of the abnormal points in the memory monitoring index data set exceeds a preset number threshold, determining that the target system has a memory leak fault. By means of the method, targeted fault detection on specific fault scenes such as memory leakage is achieved, and when the target system has the memory leakage fault, the fault of memory leakage of the target system can be accurately and timely detected.

Description

Technical Field

[0001] The present invention relates to the field of intelligent operation and maintenance technology, and in particular to a KNN-based memory leak detection method, device and medium. Background Art

[0002] Memory leak refers to the failure to release memory that is no longer needed in a program, resulting in a waste of memory resources and a degradation of program performance. Memory leak is a common and far-reaching problem in computer systems. Memory leaks can cause the system's memory usage to continue to increase, which may eventually lead to system memory bottlenecks, memory overflows, and other problems, ultimately causing the system to crash. Therefore, timely detection and resolution of memory leaks is crucial to improving system stability and reliability.

[0003] The existing memory anomaly detection algorithms are mainly aimed at general and common faults such as resource bottlenecks and insufficient capacity (CPU 100%, disk 100%). There is no targeted fault detection solution for the specific scenario of memory leakage. When a memory leakage fault occurs, the corresponding alarm cannot be given in time. In other words, the existing memory anomaly detection algorithms are not accurate enough in identifying memory leakage faults and the fault identification is delayed. Summary of the invention

[0004] The present invention provides a KNN-based memory leak detection method, device and medium to solve the technical problems that the existing memory anomaly detection algorithm is mainly aimed at common memory failures such as resource bottlenecks and insufficient capacity, and the memory leak failure identification is not accurate enough and the failure identification is delayed.

[0005] In a first aspect, the present invention provides a memory leak detection method based on KNN, comprising:

[0006] Obtain a set of memory monitoring indicator data for the target system in a preset time period;

[0007] Determine whether any data point in the memory monitoring indicator data set is an abnormal point based on the distance between the data point and other data points;

[0008] If the number of abnormal points in the memory monitoring indicator data set exceeds a preset number threshold, it is determined that a memory leak fault exists in the target system.

[0009] In a feasible implementation manner, the target system includes at least one of a JVM application, a Redis application, and a .NET application, and obtaining a memory monitoring indicator data set of the target system in a preset time period includes:

[0010] When the target system is a JVM application, obtaining at least one of used memory, committed memory, and old generation memory during FullGC of the target system within a preset time;

[0011] When the target system is a Redis application, obtaining at least one of an amount of memory used within Redis and an amount of memory occupied by a Redis process of the target system within a preset time period;

[0012] When the target system is a .NET application, at least one of the total memory occupied by processes in the target system, the memory occupied by the Gen1 generation, and the memory occupied by the Gen2 generation is obtained.

[0013] In a feasible implementation manner, after obtaining a memory monitoring indicator data set of the target system in a preset time period, the method further includes:

[0014] Based on the formula Normalize any data point in the memory monitoring indicator data set, where x is the data before normalization, and x norm is the data after the normalization processing, min(x) is the minimum value in the memory monitoring data set, and max(x) is the maximum value in the memory monitoring data set.

[0015] In a feasible implementation manner, determining whether any data point in the memory monitoring indicator data set is an abnormal point based on the distance between the data point and other data points includes:

[0016] Based on the distance between any data point and other data points, determine K neighboring points of any data point in the memory monitoring indicator data set;

[0017] Calculate the sum of the distances between any data point and the K neighboring points;

[0018] Determine the ratio of the sum of the distances to K as the target distance of any data point;

[0019] Determining an initial distance threshold based on the target distance of any data point;

[0020] If the target distance of any data point exceeds the initial distance threshold, the any data point is determined as an abnormal point.

[0021] In a feasible implementation manner, based on the distance between any data point and other data points, K neighboring points of any data point are determined in the memory monitoring indicator data set, including:

[0022] Determine the distance between any one of the data points and other data points;

[0023] The first K other data points with the smallest distance to the any data point are determined as the K nearest neighbor points of the any data point.

[0024] In a feasible implementation manner, determining the distance between any data point and other data points includes:

[0025] According to the formula Determine the distance between any data point and other data points, where x i and x j represents two data points, d(x i ,x j ) represents the data point x i and data point x j The distance between them, n represents the dimension of the data point, x ik and x jk Represents the data point x i and x j The value in the kth dimension.

[0026] In a feasible implementation manner, determining the initial distance threshold based on the target distance of any data point includes:

[0027] Calculating the sum of target distances of all data points in the memory monitoring indicator data set;

[0028] Determine the ratio between the sum of the target distances and the number of data points in the memory monitoring indicator data set as the distance mean;

[0029] Based on the formula and formula Determine the distance standard deviation, where σ is the distance standard deviation, υ is the distance variance, μ is the distance mean, and d i is the target distance of any data point, and n is the number of data points in the memory monitoring indicator data set;

[0030] An initial distance threshold is determined based on the distance mean and the distance standard deviation.

[0031] In a feasible implementation manner, after determining that the target system has a memory leak fault, the method further includes:

[0032] A handling action corresponding to a memory leak fault is triggered, where the handling action includes at least one of memory debugging, capturing a memory snapshot, service restarting, and traffic restriction.

[0033] In a second aspect, the present invention provides a KNN-based memory leak detection device, the device comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor so that the at least one processor can execute a KNN-based memory leak detection method described in any of the above embodiments.

[0034] In a third aspect, the present invention provides a non-volatile computer storage medium, which is a non-volatile computer-readable storage medium, and the non-volatile computer-readable storage medium stores at least one program, each of which includes instructions, and when the instructions are executed by a terminal, the terminal executes a KNN-based memory leak detection method described in any of the above embodiments.

[0035] The KNN-based memory leak detection method, device and medium provided by the present invention have the following beneficial technical effects compared with the prior art:

[0036] (1) After obtaining the memory monitoring indicator data set of the target system in a preset time period, the present invention determines whether any data point in the memory monitoring indicator set is an abnormal point based on the distance between the data point and other data points. When the number of abnormal points exceeds the preset number threshold, it is determined that the target system has a memory leakage fault. The present invention provides a targeted fault detection method for a specific fault scenario such as memory leakage, which can accurately and timely detect the memory leakage fault of the target system when the target system has a memory leakage fault, thereby improving the stability and reliability of the system.

[0037] (2) The targeted fault detection method for a specific fault scenario such as memory leak provided by the present invention is universal and can be applied to various types of target systems, such as JVM applications, Redis applications, and .NET applications. For different types of target systems, it is sufficient to obtain the corresponding memory monitoring indicator data set.

[0038] (3) After determining that a memory leakage fault exists in the target system, the present invention triggers a corresponding handling action, which helps to achieve rapid fault handling of the memory leakage fault. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0040] Figure 1 A flowchart of a memory leak detection method based on KNN provided by the present invention;

[0041] Figure 2 A schematic diagram of a memory monitoring indicator data set when a target system does not have a memory leak fault provided by the present invention;

[0042] Figure 3 A schematic diagram of a memory monitoring indicator data set when a memory leak fault occurs in a target system provided by the present invention;

[0043] Figure 4 A schematic diagram of the structure of a KNN-based memory leak detection device provided by the present invention. DETAILED DESCRIPTION

[0044] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the specific embodiments of the present invention and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0045] The present invention is based on the K-Nearest Neighbors (KNN) algorithm and combines the technical features of memory leakage to provide a memory leakage detection method, device and medium based on KNN for a specific fault scenario of memory leakage. The technical solution proposed by the present invention is described in detail below through the accompanying drawings.

[0046] Figure 1 The flowchart of a memory leak detection method based on KNN provided by the present invention. Figure 1 As shown, the method includes the following execution steps:

[0047] S101. Obtain a memory monitoring indicator data set of a target system in a preset time period.

[0048] The target system in the present invention is an observed system that may have a memory leak failure. The target system can be various types of software systems. That is to say, the present invention is applicable to various types of software systems, for example, basic software such as databases, middleware software systems such as Redis, application software such as ERP, and web server Internet software.

[0049] In some embodiments, the memory monitoring indicator data set can be collected by combining the capabilities and characteristics of the target system and selecting a data collection method suitable for the characteristics of the system. For example, the memory monitoring indicator data set can be obtained through a built-in observation component, such as the Spring Boot Actuator module; the memory monitoring indicator data set can also be obtained through a third-party monitoring component, such as Prometheus exportor, Zabbix Agent, etc.

[0050] In some embodiments, based on experience, the sampling interval of the memory indicator is typically 5 seconds.

[0051] In some embodiments, based on the characteristics of the target system being observed, key indicator data with high correlation with the memory status of the target system can be selected for key collection and analysis. In other words, the memory monitoring indicator data set can be a set of key indicator data with high correlation with the memory status of the target system.

[0052] As a possible implementation manner, the target system includes at least one of a JVM application, a Redis application, and a .NET application, and obtaining a memory monitoring indicator data set of the target system in a preset time period includes:

[0053] When the target system is a JVM application, at least one of used memory (jvm_memory_used), committed memory (jvm_memory_committed), and old generation memory (jvm_gc_live_data_size) of the target system during a preset time is obtained.

[0054] When the target system is a Redis application, at least one of the amount of memory (used_memory) used within Redis and the amount of memory occupied by the Redis process (used_memory_rss) of the target system within a preset time period is obtained.

[0055] When the target system is a .NET application, at least one of the total memory occupied by the process in the target system (#Bytes in allHeaps), the memory occupied by the Gen1 generation (Gen 1heap size), and the memory occupied by the Gen2 generation (Gen2heap size) is obtained.

[0056] As a possible implementation method, in order to eliminate the noise influence of various interference factors in the collection process on the collected data and to improve the accuracy and performance of the detection model, after obtaining the memory monitoring indicator data set of the target system in a preset time period, before determining the abnormal points in the memory monitoring indicator data set, the data in the obtained memory monitoring indicator data set can also be preprocessed.

[0057] For example, one can base the formula Normalize any data point in the memory monitoring indicator data set, map the data in the memory monitoring indicator data set to the [0, 1] interval, and obtain the normalized data.

[0058] Among them, x is the data before normalization, x norm It is the normalized data. min(x) is the minimum value in the memory monitoring data set, and max(x) is the maximum value in the memory monitoring data set.

[0059] S102: Determine whether any data point is an abnormal point based on the distance between any data point and other data points in the memory monitoring indicator data set.

[0060] When a memory leak occurs in the target system, there will be multiple data points in the memory monitoring indicator data set with abnormal distances from other data points, that is, there will be multiple abnormal points.

[0061] For example, Figure 2 A schematic diagram of a memory monitoring indicator data set when a target system does not have a memory leak fault provided by the present invention, Figure 3 A schematic diagram of a memory monitoring indicator data set when a target system has a memory leak fault provided by the present invention. Figure 2 As shown in , when there is no memory leak fault in the target system, the value of the memory monitoring indicator data fluctuates steadily over time. Figure 3 As shown in FIG. 1 , when a memory leak occurs in the target system, the value of the memory monitoring indicator data increases over time.

[0062] Therefore, when determining whether a target system has a memory leak fault, it is necessary to determine whether a data point in the memory monitoring indicator data set is an abnormal point.

[0063] The present invention determines whether any data point in the memory monitoring indicator data set is an abnormal point based on the distance between the data point and other data points, and can adopt a distance-based method or a density-based method.

[0064] As a possible implementation manner, S102 determines whether any data point is an abnormal point based on the distance between any data point and other data points in the memory monitoring indicator data set, including:

[0065] S1021. Based on the distance between any data point and other data points, determine K nearest neighbor points of any data point in the memory monitoring indicator data set.

[0066] The present invention may determine the K nearest neighbor points of each data point by using a sorting method or other methods.

[0067] To ensure the timeliness and accuracy of detection, it is recommended to set the K value to 5 by default, and then adjust and verify it according to different data environments. In addition, it is usually recommended to set the K value to an odd number to simplify the decision-making process.

[0068] As a possible implementation method, a sorting method can be used to determine the K nearest neighbor points of any data point. S1021 determines the K nearest neighbor points of any data point in the memory monitoring indicator data set based on the distance between any data point and other data points, including: determining the distance between any data point and other data points; and determining the first K other data points with the smallest distance to any data point as the K nearest neighbor points of any data point.

[0069] As a possible implementation method, the Euclidean distance can be used to determine the distance between any data point and other data points: According to the formula Determine the distance between any data point and any other data point, where x i and x j represents two data points, d(x i ,x j ) represents the data point x i and data point x j The distance between them, n represents the dimension of the data point, x ik and x jk Represents the data point x i and x j The value in the kth dimension.

[0070] For example, taking the JVM memory detection scenario as an example, the dimensions of the data points can be indicators such as used memory (jvm_memory_used), committed memory (jvm_memory_committed), and old generation memory during FullGC (jvm_gc_live_data_size).

[0071] S1022. Calculate the sum of the distances between any data point and its K nearest neighbor points.

[0072] S1023. Determine the target distance of any data point as the ratio of the sum of distances to K.

[0073] The present invention can determine the average value of the distances between any data point and K nearest neighbor points as the target distance of this data point.

[0074] Exemplarily, assume K = 5, and there are 8 data points in the memory monitoring metric data set, namely the target data point, the first data point, the second data point, the third data point, the fourth data point, the fifth data point, the sixth data point, and the seventh data point. The distances between the target data point and the first to seventh data points are L1, L2, L3, L4, L5, L6, and L7 respectively. Assume L1 < L2 < L3 < L4 < L5 < L6 < L7, then determine the first to fifth data points as the 5 nearest neighbor points of the target data point. The sum of the distances between the target data point and the 5 nearest neighbor points is L1 + L2 + L3 + L4 + L5, and the target distance of the target data point is the average value of the sum of the above distances, that is, (L1 + L2 + L3 + L4 + L5) / 5.

[0075] S1024. Determine an initial distance threshold based on the target distance of any data point.

[0076] The present invention can determine the initial distance threshold corresponding to the memory monitoring metric data set based on the target distances of each data point in the memory monitoring metric data set.

[0077] As a possible implementation, determining an initial distance threshold based on the target distance of any data point includes: calculating the sum of the target distances of all data points in the memory monitoring metric data set; determining the ratio between the sum of the target distances and the number of data points in the memory monitoring metric data set as the distance average value.

[0078] Exemplarily, assume there are n data points in the memory monitoring metric data set. For the i-th data point, the target distance of this data point is d i , then the distance average value

[0079] Calculate the distance standard deviation (σ): Calculate the square of the difference between the distance of each data point from its K nearest neighbor points and the distance average value, sum these squares of differences, divide the sum by the difference obtained by subtracting 1 from the total number of data points to get the distance variance, and then take the square root of the distance variance to obtain the distance standard deviation.

[0080] That is, based on the formula determine the distance variance, where υ is the distance variance, μ is the distance average value, d i is the target distance of any data point, and n is the total number of data points in the memory monitoring metric data set. Based on the formula Determine the distance standard deviation, where σ is the distance standard deviation.

[0081] After the distance mean and the distance standard deviation are determined, an initial distance threshold may be determined based on the distance mean and the distance standard deviation.

[0082] In some embodiments, according to actual application conditions, the sum of the distance mean plus 1.5 times the distance standard deviation μ+1.5σ is first used as the initial distance threshold, and then the initial distance threshold is adjusted according to actual detection results.

[0083] S1025: If the target distance of any data point exceeds the initial distance threshold, the data point is determined as an abnormal point.

[0084] If the target distance of any data point exceeds the initial distance threshold, it means that the distance between the data point and other data points in the memory monitoring indicator data set is far. At this time, the data point is determined as an abnormal point.

[0085] As described in the above example, the target distance of the target data point is (L1+L2+L3+L4+L5) / 5, and the initial distance threshold is T. If (L1+L2+L3+L4+L5) / 5>T, the target data point is determined as an outlier.

[0086] S103: If the number of abnormal points in the memory monitoring indicator data set exceeds a preset number threshold, it is determined that a memory leak fault exists in the target system.

[0087] like Figure 2 and Figure 3 As shown in the figure, when the target system does not have a memory leak fault, the memory monitoring indicator data still fluctuates over time, and there are also some abnormal points in the memory monitoring indicator data set; but when the target system has a memory leak fault, the memory monitoring indicator data fluctuates and rises over time, and at this time, there are more abnormal points in the memory monitoring indicator data set. Therefore, when the number of abnormal points in the memory monitoring indicator data set exceeds the preset number threshold, it is determined that the target system has a memory leak fault.

[0088] The present invention can determine whether the target system has a memory leak fault according to the number of abnormal points or the ratio of the number of abnormal points to the total number of data points in the memory monitoring indicator data set.

[0089] Specifically, the preset number threshold may be a preset constant, that is, when the number of abnormal points in the memory monitoring indicator data set exceeds the preset constant, it is determined that a memory leak fault exists in the target system.

[0090] The preset quantity threshold may also be a certain proportion of the total number of data points in the memory monitoring indicator data set. For example, the preset quantity threshold may be 3% of the total number of data points. That is, when the number of abnormal points exceeds 3% of the total number of data points, it is determined that the target system has a memory leak fault.

[0091] In some embodiments, the preset number threshold can be set according to the tolerance of the target system to memory leak failures. If the target system has a low tolerance for memory leak failures, the ratio of the preset number threshold to the total number of data points can be set lower, such as setting the preset number threshold to 3% of the total number of data points; if the target system has a high tolerance for memory leak failures, the preset number threshold can be set to 10% to 15% of the total number of data points. To ensure detection accuracy, it is generally not recommended to set the preset number threshold too large.

[0092] As a possible implementation method, after determining that the target system has a memory leak fault, the method also includes: triggering a handling action corresponding to the memory leak fault, the handling action including at least one of memory debugging, capturing memory snapshots, service restarting and traffic restriction.

[0093] When the present invention detects a memory leak fault in the target system, it can add quick fault handling actions according to the system characteristics of the target system, such as triggering memory snapshot capture, service restart, traffic restriction, etc.

[0094] For example, for JVM applications, you can trigger the call of the Jcmd GC.heap_dump command to capture the core dump at the time of the exception; for Redis programs, you can trigger the call of the Redis save command to generate an RDB memory snapshot at the time of the problem, etc.

[0095] The present invention also provides a memory leak detection device based on KNN, which includes a data acquisition module, a data preprocessing module, a result judgment module and an application disposal module.

[0096] Data collection module: used to collect memory monitoring indicator data sets within a preset time period, specifically to provide a data collection interface that can integrate memory monitoring indicator data.

[0097] Data preprocessing module: used to preprocess the data in the collected memory monitoring indicator data set, such as normalization processing.

[0098] Anomaly detection module: Use the KNN algorithm to perform anomaly detection on the data points in the preprocessed memory monitoring indicator data set, and determine whether any data point in the memory monitoring indicator data set is an anomaly based on the distance between the data point and other data points.

[0099] Result judgment module: used to judge whether the target system has a memory leak fault according to the detection results of the anomaly detection module. When the number of anomalies in the memory monitoring indicator data set exceeds the preset number threshold, it is determined that the target system has a memory leak fault.

[0100] Application handling module: an application used to provide detection results, specifically providing interface capabilities to trigger the next action, such as providing message notification capabilities, providing the ability to trigger the generation of memory snapshots, etc. After determining that the target system has a memory leak fault, it triggers the corresponding handling action for the memory leak fault, where the handling actions include memory debugging, capturing memory snapshots, service restart, and traffic restriction.

[0101] Corresponding to the above embodiment, the present invention also provides a memory leak detection device based on KNN. Figure 4 A structural schematic diagram of a KNN-based memory leak detection device provided for an embodiment of the present invention, the device may include: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, so that the at least one processor can execute a KNN-based memory leak detection method as described in the above embodiment.

[0102] In a possible implementation of the present invention, the aforementioned at least one processor is capable of executing, obtaining a memory monitoring indicator data set of the target system in a preset time period; determining whether any data point is an abnormal point based on the distance between any data point in the memory monitoring indicator data set and other data points; if the number of abnormal points in the memory monitoring indicator data set exceeds a preset number threshold, it is determined that the target system has a memory leak fault.

[0103] In a specific implementation, the present invention can also be provided as a non-volatile computer storage medium, wherein the storage medium is a non-volatile computer-readable storage medium, and the non-volatile computer-readable storage medium stores at least one program, each program includes instructions, and when the instructions are executed by the terminal, the terminal executes a KNN-based memory leak detection method as described in the above embodiment.

[0104] In a possible implementation of the present invention, the aforementioned terminal executes to obtain a memory monitoring indicator data set of the target system in a preset time period; based on the distance between any data point in the memory monitoring indicator data set and other data points, determines whether any data point is an abnormal point; if the number of abnormal points in the memory monitoring indicator data set exceeds a preset number threshold, it is determined that the target system has a memory leak fault.

[0105] The various embodiments of the present invention are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0106] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0107] The above description is only an embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A memory leak detection method based on KNN, characterized in that: The method comprises: Obtain a set of memory monitoring indicator data for the target system in a preset time period; Determine whether any data point in the memory monitoring indicator data set is an abnormal point based on the distance between the data point and other data points; If the number of abnormal points in the memory monitoring indicator data set exceeds a preset number threshold, it is determined that a memory leak fault exists in the target system.

2. According to the KNN-based memory leak detection method of claim 1, it is characterized in that: The target system includes at least one of a JVM application, a Redis application, and a .NET application. Acquiring a memory monitoring indicator data set of the target system in a preset time period includes: When the target system is a JVM application, obtaining at least one of used memory, committed memory, and old generation memory during FullGC of the target system within a preset time; When the target system is a Redis application, obtaining at least one of an amount of memory used within Redis and an amount of memory occupied by a Redis process of the target system within a preset time period; When the target system is a .NET application, at least one of the total memory occupied by processes in the target system, the memory occupied by the Gen1 generation, and the memory occupied by the Gen2 generation is obtained.

3. The memory leak detection method based on KNN according to claim 1, characterized in that: After obtaining a memory monitoring indicator data set of the target system in a preset time period, the method further includes: Based on the formula Normalize any data point in the memory monitoring indicator data set, where x is the data before normalization, x norm is the data after the normalization processing, min(x) is the minimum value in the memory monitoring data set, and max(x) is the maximum value in the memory monitoring data set.

4. The memory leak detection method based on KNN according to claim 1, characterized in that: Determining whether any data point in the memory monitoring indicator data set is an abnormal point based on the distance between the data point and other data points includes: Based on the distance between any data point and other data points, determine K neighboring points of any data point in the memory monitoring indicator data set; Calculate the sum of the distances between any data point and the K neighboring points; Determine the ratio of the sum of the distances to K as the target distance of any data point; Determining an initial distance threshold based on the target distance of any data point; If the target distance of any data point exceeds the initial distance threshold, the any data point is determined as an abnormal point.

5. The memory leak detection method based on KNN according to claim 4, characterized in that: Based on the distance between any data point and other data points, K neighboring points of any data point are determined in the memory monitoring indicator data set, including: Determine the distance between any one of the data points and other data points; The first K other data points with the smallest distance to the any data point are determined as the K nearest neighbor points of the any data point.

6. The KNN-based memory leak detection method according to claim 5, characterized in that: Determining the distance between any of the data points and other data points includes: According to the formula Determine the distance between any data point and other data points, where x i and x j represents two data points, d(x i ,x j ) represents the data point x i and data point x j The distance between them, n represents the dimension of the data point, x ik and x jk Represents the data point x i and x j The value in the kth dimension.

7. The memory leak detection method based on KNN according to claim 4, characterized in that: Based on the target distance of any data point, determining an initial distance threshold comprises: Calculating the sum of target distances of all data points in the memory monitoring indicator data set; Determine the ratio between the sum of the target distances and the number of data points in the memory monitoring indicator data set as the distance mean; Based on the formula and formula Determine the distance standard deviation, where σ is the distance standard deviation, υ is the distance variance, μ is the distance mean, and d i is the target distance of any data point, and n is the number of data points in the memory monitoring indicator data set; An initial distance threshold is determined based on the distance mean and the distance standard deviation.

8. The memory leak detection method based on KNN according to claim 1, characterized in that: After determining that the target system has a memory leak fault, the method further includes: A handling action corresponding to a memory leak fault is triggered, where the handling action includes at least one of memory debugging, capturing a memory snapshot, service restarting, and traffic restriction.

9. A memory leak detection device based on KNN, characterized in that: The device comprises: at least one processor; and, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, so that the at least one processor can execute a KNN-based memory leak detection method according to any one of claims 1-8.

10. A non-volatile computer storage medium, characterized in that: The storage medium is a non-volatile computer-readable storage medium, and the non-volatile computer-readable storage medium stores at least one program, each of which includes instructions, and when the instructions are executed by the terminal, the terminal executes a KNN-based memory leak detection method according to any one of claims 1-8.

Images